{"record":{"id":"f82f559812d50765","repo":"cli/cli","slug":"error-getting-trust-domain-make-sure-you-are-auth","errorCode":null,"errorMessage":"error getting trust domain, make sure you are authenticated against the host: %w","messagePattern":"error getting trust domain, make sure you are authenticated against the host: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/attestation/inspect/inspect.go","lineNumber":103,"sourceCode":"\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\texternalClient, err := f.ExternalHttpClient()\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\tconfig := verification.SigstoreConfig{\n\t\t\t\tExternalHttpClient: externalClient,\n\t\t\t\tLogger:             opts.Logger,\n\t\t\t}\n\n\t\t\tif ghauth.IsTenancy(opts.Hostname) {\n\t\t\t\tapiClient := api.NewLiveClient(hc, externalClient, opts.Hostname, opts.Logger)\n\t\t\t\ttd, err := apiClient.GetTrustDomain()\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error getting trust domain, make sure you are authenticated against the host: %w\", err)\n\t\t\t\t}\n\t\t\t\t_, found := ghinstance.TenantName(opts.Hostname)\n\t\t\t\tif !found {\n\t\t\t\t\treturn fmt.Errorf(\"invalid hostname provided: '%s'\",\n\t\t\t\t\t\topts.Hostname)\n\t\t\t\t}\n\n\t\t\t\tconfig.TrustDomain = td\n\t\t\t}\n\n\t\t\tsgVerifier, err := verification.NewLiveSigstoreVerifier(config)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to create Sigstore verifier: %w\", err)\n\t\t\t}\n\t\t\topts.SigstoreVerifier = sgVerifier\n\n\t\t\tif runF != nil {\n\t\t\t\treturn runF(opts)","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/cli/cli/blob/0eeec0b92edbe70199f9768522f831d3534f41ad/pkg/cmd/attestation/inspect/inspect.go#L85-L121","documentation":"Thrown by `gh attestation inspect/verify` on tenancy hosts (ghe.com) when apiClient.GetTrustDomain() fails while building the Sigstore verifier config. The '%w' wrap preserves the cause; the message hints the usual root cause is missing authentication against the tenancy host.","triggerScenarios":"ghauth.IsTenancy(opts.Hostname) is true and the trust-domain API call errors: no valid token for <tenant>.ghe.com, 401/403 from the host, or a network failure reaching it.","commonSituations":"Running `gh attestation verify --hostname <tenant>.ghe.com` without ever authenticating to that host (`gh auth login --hostname <tenant>.ghe.com`), or with an expired token.","solutions":["Authenticate against the tenancy host: `gh auth login --hostname <tenant>.ghe.com`","Run `gh auth status` and confirm the host has a valid token","Check network reachability of the tenancy API if auth is fine"],"exampleFix":"# before\ngh attestation verify ./artifact.bin --hostname ghe.mytenant.com\n# after\ngh auth login --hostname ghe.mytenant.com\ngh attestation verify ./artifact.bin --hostname ghe.mytenant.com","handlingStrategy":"retry","validationCode":"if ghauth.IsTenancy(hostname) {\n\tif _, err := cfg.AuthToken(hostname); err != nil {\n\t\treturn fmt.Errorf(\"not authenticated against %s; run gh auth login\", hostname)\n\t}\n}","typeGuard":null,"tryCatchPattern":"td, err := apiClient.GetTrustDomain()\nif err != nil {\n\t// most common cause is missing auth for the tenancy host; re-auth then retry once\n\tif authErr := checkAuth(hostname); authErr != nil { return authErr }\n\treturn fmt.Errorf(\"trust domain for %s: %w\", hostname, err)\n}","preventionTips":["Run `gh auth login --hostname <tenant>.ghe.com` once in each environment that verifies tenancy artifacts","Assert `gh auth status` lists the tenancy host in CI preflight","Cache trust domain results per host to reduce repeated API calls"],"tags":["authentication","tenancy","ghe","sigstore","attestation"],"backgroundTag":null,"analyzedSha":"0eeec0b92edbe70199f9768522f831d3534f41ad","analyzedAt":"2026-08-15T12:31:05.478Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}