expected the leaf certificate issuer to only have one organi

Error message

expected the leaf certificate issuer to only have one organization

What it means

Error "expected the leaf certificate issuer to only have one organization" thrown in cli/cli.

Source

Thrown at pkg/cmd/attestation/verification/sigstore.go:201

		line, readError = reader.ReadBytes('\n')
	}
	return verifiers, nil
}

func getBundleIssuer(b *bundle.Bundle) (string, error) {
	if !b.MinVersion("0.2") {
		return "", fmt.Errorf("unsupported bundle version: %s", b.MediaType)
	}
	verifyContent, err := b.VerificationContent()
	if err != nil {
		return "", fmt.Errorf("failed to get bundle verification content: %v", err)
	}
	leafCert := verifyContent.Certificate()
	if leafCert == nil {
		return "", fmt.Errorf("leaf cert not found")
	}
	if len(leafCert.Issuer.Organization) != 1 {
		return "", fmt.Errorf("expected the leaf certificate issuer to only have one organization")
	}
	return leafCert.Issuer.Organization[0], nil
}

func (v *LiveSigstoreVerifier) chooseVerifier(issuer string) (*verify.Verifier, error) {
	// if no custom trusted root is set, return either the Public Good or GitHub verifier
	// If the chosen verifier has not yet been created, create it as a LiveSigstoreVerifier field for use in future calls
	if v.Custom != nil {
		custom, ok := v.Custom[issuer]
		if !ok {
			return nil, fmt.Errorf("no custom verifier found for issuer \"%s\"", issuer)
		}
		return custom, nil
	}
	switch issuer {
	case PublicGoodIssuerOrg:
		if v.NoPublicGood {
			return nil, fmt.Errorf("detected public good instance but requested verification without public good instance")

View on GitHub (pinned to 0eeec0b92e)

Solutions

The attestation certificate is malformed; re-download the bundle or regenerate the attestation, then verify again.

When it happens

Trigger: Thrown at pkg/cmd/attestation/verification/sigstore.go:201 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of cli/cli@0eeec0b92e (2026-08-15). Data as JSON: /api/errors/5ec7a21b1e8bd359. Report an issue: GitHub.