GH-ATTESTATION-TRUSTED-ROOT(1) GitHub CLI manual GH-ATTESTATION-TRUSTED-ROOT(1)

# [NAME](#NAME)

gh-attestation-trusted-root - Output trusted\_root.jsonl contents, likely for offline verification

# [SYNOPSIS](#SYNOPSIS)

**gh attestation trusted-root \[--tuf-url <url> --tuf-root <file-path>] \[--verify-only] \[flags]**

# [DESCRIPTION](#DESCRIPTION)

Output contents for a trusted\_root.jsonl file, likely for offline verification.

When using **gh attestation verify**, if your machine is on the internet, this will happen automatically. But to do offline verification, you need to supply a trusted root file with **--custom-trusted-root**; this command will help you fetch a **trusted\_root.jsonl** file for that purpose.

You can call this command without any flags to get a trusted root file covering the Sigstore Public Good Instance as well as GitHub's Sigstore instance.

Otherwise you can use **--tuf-url** to specify the URL of a custom TUF repository mirror, and **--tuf-root** should be the path to the **root.json** file that you securely obtained out-of-band.

If you just want to verify the integrity of your local TUF repository, and don't want the contents of a trusted\_root.jsonl file, use **--verify-only**.

# [OPTIONS](#OPTIONS)

[**--hostname** **<string>**](#hostname)

Configure host to use

[**--tuf-root** **<string>**](#tuf_root)

Path to the TUF root.json file on disk

[**--tuf-url** **<string>**](#tuf_url)

URL to the TUF repository mirror

[**--verify-only**](#verify_only)

Don't output trusted\_root.jsonl contents

# [EXIT CODES](#EXIT_CODES)

0: Successful execution

1: Error

2: Command canceled

4: Authentication required

NOTE: Specific commands may have additional exit codes. Refer to the command's help for more information.

# [EXAMPLE](#EXAMPLE)

```
# Get a trusted_root.jsonl for both Sigstore Public Good and GitHub's instance
$ gh attestation trusted-root
```

# [SEE ALSO](#SEE_ALSO)

[**gh-attestation(1)**](/man/os/gh/gh-attestation.1)

Oct 2026

---

Document: gh-attestation-trusted-root(1) from gh 2.103.0-r0 (Chainguard OS)
Source: https://github.com/cli/cli