GH-ATTESTATION-TRUSTED-ROOT(1)

🎀 GH-ATTESTATION-TRUSTED-ROOT(1) 🎀

okay bestie, so this is a page straight out of the GitHub CLI manual — yes, that GitHub CLI, the gh you already know and love 💅 — and it's all about one very specific, very iconic little subcommand. Sit down, hydrate, let's get into it ✨

---

💖 NAME 💖

gh-attestation-trusted-root — it outputs the contents of a trusted_root.jsonl file, and the whole point is lowkey that you can do offline verification with it 🫶

---

✨ SYNOPSIS ✨

gh attestation trusted-root [--tuf-url <url> --tuf-root <file-path>]
[--verify-only] [flags]

that's the whole shape of it, no cap 🌸

---

🦋 DESCRIPTION 🦋

So what does it actually do? It outputs the contents for a trusted_root.jsonl file, and yeah, the most likely reason you'd want that is offline verification 💖

Here's the tea ☕: when you're using gh attestation verify and your machine is on the internet, this whole thing happens automatically — no effort required, slay. But if you need to do offline verification, you have to supply a trusted root file yourself via --custom-trusted-root. That's literally the exact situation this command exists for — it helps you fetch a trusted_root.jsonl file for that purpose 🎀

And the best part? You can call this command with zero flags and get a trusted root file that covers the Sigstore Public Good Instance as well as GitHub's Sigstore instance. Two for the price of none, we love to see it 👑

Otherwise — like if you're feeling custom — you can use --tuf-url to specify the URL of a custom TUF repository mirror, and --tuf-root should be the path to the root.json file that you securely obtained out-of-band 🔐 (yes, securely, out-of-band, don't be out here being casual with your root.json, bestie, that's main character security energy fr fr)

and if you just want to verify the integrity of your local TUF repository, and you genuinely do not want the contents of a trusted_root.jsonl file? that's exactly what --verify-only is for 🧚

---

🌈 OPTIONS 🌈

• --hostname <string> — configure the host to use 🖥️
• --tuf-root <string> — the path to the root.json file for TUF, on disk 💾
• --tuf-url <string> — the URL to the TUF repository mirror 🔗
• --verify-only — don't output trusted_root.jsonl contents, just verify-only vibes 🙈

---

⭐ EXIT CODES ⭐

the vibe check results, if you will:

• 0 — successful execution, we ate 💅
• 1 — error 😭
• 2 — command canceled 💀
• 4 — authentication required 🔑

NOTE: specific commands may have additional exit codes. Refer to the command's help for more information 👀

---

🔥 EXAMPLE 🔥

# Get a trusted_root.jsonl for both Sigstore Public Good and GitHub's instance
$ gh attestation trusted-root

look at her go, not a single flag in sight 🌟

---

💜 SEE ALSO 💜

• gh-attestation(1) — go read that one too, iykyk 🦋

---

and that's the whole page, bestie!! mwah 🫶 this gem is from GitHub CLI v2.102.0, dated Oct 2026 — iconic behavior honestly, periodt 💖✨🎀