cli/cli · error

failed to create TUF client: %v

Error message

failed to create TUF client: %v

What it means

Error "failed to create TUF client: %v" thrown in cli/cli.

Source

Thrown at pkg/cmd/attestation/verification/sigstore.go:343

	if len(trustedRoot.RekorLogs()) > 0 {
		verifierConfig = append(verifierConfig, verify.WithTransparencyLog(1))
	}

	gv, err := verify.NewVerifier(trustedRoot, verifierConfig...)
	if err != nil {
		return nil, fmt.Errorf("failed to create custom verifier: %v", err)
	}

	return gv, nil
}

func newGitHubVerifier(trustDomain string, tufMetadataDir o.Option[string], hc *http.Client) (*verify.Verifier, error) {
	var tr string

	opts := GitHubTUFOptions(tufMetadataDir, hc)
	client, err := tuf.New(opts)
	if err != nil {
		return nil, fmt.Errorf("failed to create TUF client: %v", err)
	}

	if trustDomain == "" {
		tr = "trusted_root.json"
	} else {
		tr = fmt.Sprintf("%s.trusted_root.json", trustDomain)
	}
	jsonBytes, err := client.GetTarget(tr)
	if err != nil {
		return nil, err
	}
	trustedRoot, err := root.NewTrustedRootFromJSON(jsonBytes)
	if err != nil {
		return nil, err
	}
	return newGitHubVerifierWithTrustedRoot(trustedRoot)
}

View on GitHub (pinned to 0eeec0b92e)

Solutions

1. Check network access to the TUF repository and retry; clearing the local TUF cache may also help.

When it happens

Trigger: Thrown at pkg/cmd/attestation/verification/sigstore.go:343 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of cli/cli@0eeec0b92e (2026-08-15). Data as JSON: /api/errors/fe3a687e212449a2. Report an issue: GitHub.