error getting trust domain, make sure you are authenticated

Error message

error getting trust domain, make sure you are authenticated against the host: %w

What it means

Thrown by `gh attestation inspect/verify` on tenancy hosts (ghe.com) when apiClient.GetTrustDomain() fails while building the Sigstore verifier config. The '%w' wrap preserves the cause; the message hints the usual root cause is missing authentication against the tenancy host.

Source

Thrown at pkg/cmd/attestation/inspect/inspect.go:103

			if err != nil {
				return err
			}

			externalClient, err := f.ExternalHttpClient()
			if err != nil {
				return err
			}

			config := verification.SigstoreConfig{
				ExternalHttpClient: externalClient,
				Logger:             opts.Logger,
			}

			if ghauth.IsTenancy(opts.Hostname) {
				apiClient := api.NewLiveClient(hc, externalClient, opts.Hostname, opts.Logger)
				td, err := apiClient.GetTrustDomain()
				if err != nil {
					return fmt.Errorf("error getting trust domain, make sure you are authenticated against the host: %w", err)
				}
				_, found := ghinstance.TenantName(opts.Hostname)
				if !found {
					return fmt.Errorf("invalid hostname provided: '%s'",
						opts.Hostname)
				}

				config.TrustDomain = td
			}

			sgVerifier, err := verification.NewLiveSigstoreVerifier(config)
			if err != nil {
				return fmt.Errorf("failed to create Sigstore verifier: %w", err)
			}
			opts.SigstoreVerifier = sgVerifier

			if runF != nil {
				return runF(opts)

View on GitHub (pinned to 0eeec0b92e)

Solutions

Authenticate against the tenancy host: `gh auth login --hostname <tenant>.ghe.com`
Run `gh auth status` and confirm the host has a valid token
Check network reachability of the tenancy API if auth is fine

Example fix

# before
gh attestation verify ./artifact.bin --hostname ghe.mytenant.com
# after
gh auth login --hostname ghe.mytenant.com
gh attestation verify ./artifact.bin --hostname ghe.mytenant.com

Defensive patterns

Strategy: retry

Validate before calling

if ghauth.IsTenancy(hostname) {
	if _, err := cfg.AuthToken(hostname); err != nil {
		return fmt.Errorf("not authenticated against %s; run gh auth login", hostname)
	}
}

Try / catch

td, err := apiClient.GetTrustDomain()
if err != nil {
	// most common cause is missing auth for the tenancy host; re-auth then retry once
	if authErr := checkAuth(hostname); authErr != nil { return authErr }
	return fmt.Errorf("trust domain for %s: %w", hostname, err)
}

Prevention

Run `gh auth login --hostname <tenant>.ghe.com` once in each environment that verifies tenancy artifacts
Assert `gh auth status` lists the tenancy host in CI preflight
Cache trust domain results per host to reduce repeated API calls

When it happens

Trigger: ghauth.IsTenancy(opts.Hostname) is true and the trust-domain API call errors: no valid token for <tenant>.ghe.com, 401/403 from the host, or a network failure reaching it.

Common situations: Running `gh attestation verify --hostname <tenant>.ghe.com` without ever authenticating to that host (`gh auth login --hostname <tenant>.ghe.com`), or with an expired token.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of cli/cli@0eeec0b92e (2026-08-15). Data as JSON: /api/errors/f82f559812d50765. Report an issue: GitHub.