Repository: cli/cli
Pull request #9599 (2024-09-11 10:53:53)

Suggest installing Rosetta when extension installation fails due to missing `darwin-arm64` binary, but a `darwin-amd64` binary is available
When installing an extension, the CLI must to select the correct binary to download for the machine (see the [`installBin` function](https://github.com/cli/cli/blob/78c1d00eccac1b2ae82ac0bfeea3e2292c98056a/pkg/cmd/extension/manager.go#L240)).

By default, the CLI will download a binary matching the current machine's architecture.

However, to provide better support for Macs running on Apple Silicon, it will [fall back](https://github.com/cli/cli/blob/78c1d00eccac1b2ae82ac0bfeea3e2292c98056a/pkg/cmd/extension/manager.go#L267-L274) from `darwin-arm64` to `darwin-amd64` if [Rosetta](https://support.apple.com/en-gb/102527) (Apple's compatibility layer) is installed.

If Rosetta isn't installed, this fallback doesn't happen, which can lead to surprising and confusing results when one Mac has Rosetta and another doesn't, because the extension will install on one machine but not another.

In the situation where a `darwin-arm64` binary isn't available but the CLI can't fall back to `amd64` because Rosetta isn't installed, this updates our error message to suggest installing Rosetta.

Fixes https://github.com/cli/cli/issues/9592.


Patch:
diff --git a/.gitignore b/.gitignore
index 272b7703d..b2b66aaf7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,7 +27,4 @@
 # vim
 *.swp
 
-# Emacs
-*~
-
 vendor/
diff --git a/go.mod b/go.mod
index 78ceb7f70..50278d733 100644
--- a/go.mod
+++ b/go.mod
@@ -38,15 +38,15 @@ require (
 	github.com/rivo/tview v0.0.0-20221029100920-c4a7e501810d
 	github.com/shurcooL/githubv4 v0.0.0-20240120211514-18a1ae0e79dc
 	github.com/sigstore/protobuf-specs v0.3.2
-	github.com/sigstore/sigstore-go v0.6.2
+	github.com/sigstore/sigstore-go v0.6.1
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.9.0
 	github.com/zalando/go-keyring v0.2.5
-	golang.org/x/crypto v0.27.0
+	golang.org/x/crypto v0.26.0
 	golang.org/x/sync v0.8.0
-	golang.org/x/term v0.24.0
-	golang.org/x/text v0.18.0
+	golang.org/x/term v0.23.0
+	golang.org/x/text v0.17.0
 	google.golang.org/grpc v1.64.1
 	google.golang.org/protobuf v1.34.2
 	gopkg.in/h2non/gock.v1 v1.1.2
@@ -159,7 +159,7 @@ require (
 	golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect
 	golang.org/x/mod v0.20.0 // indirect
 	golang.org/x/net v0.27.0 // indirect
-	golang.org/x/sys v0.25.0 // indirect
+	golang.org/x/sys v0.23.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
diff --git a/go.sum b/go.sum
index 37c40407d..407739dfe 100644
--- a/go.sum
+++ b/go.sum
@@ -395,8 +395,8 @@ github.com/sigstore/rekor v1.3.6 h1:QvpMMJVWAp69a3CHzdrLelqEqpTM3ByQRt5B5Kspbi8=
 github.com/sigstore/rekor v1.3.6/go.mod h1:JDTSNNMdQ/PxdsS49DJkJ+pRJCO/83nbR5p3aZQteXc=
 github.com/sigstore/sigstore v1.8.9 h1:NiUZIVWywgYuVTxXmRoTT4O4QAGiTEKup4N1wdxFadk=
 github.com/sigstore/sigstore v1.8.9/go.mod h1:d9ZAbNDs8JJfxJrYmulaTazU3Pwr8uLL9+mii4BNR3w=
-github.com/sigstore/sigstore-go v0.6.2 h1:8uiywjt73vzfrGfWYVwVsiB1E1Qmwmpgr1kVpl4fs6A=
-github.com/sigstore/sigstore-go v0.6.2/go.mod h1:pOIUH7Jx+ctwMICo+2zNrViOJJN5sGaQgwX4yAVJkA0=
+github.com/sigstore/sigstore-go v0.6.1 h1:tGkkv1oDIER+QYU5MrjqlttQOVDWfSkmYwMqkJhB/cg=
+github.com/sigstore/sigstore-go v0.6.1/go.mod h1:Xe5GHmUeACRFbomUWzVkf/xYCn8xVifb9DgqJrV2dIw=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.3 h1:LTfPadUAo+PDRUbbdqbeSl2OuoFQwUFTnJ4stu+nwWw=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.3/go.mod h1:QV/Lxlxm0POyhfyBtIbTWxNeF18clMlkkyL9mu45y18=
 github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.3 h1:xgbPRCr2npmmsuVVteJqi/ERw9+I13Wou7kq0Yk4D8g=
@@ -485,8 +485,8 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
-golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
+golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
+golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
 golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 h1:hNQpMuAJe5CtcUqCXaWga3FHu+kQvCqcsoVaQgSV60o=
 golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -514,19 +514,19 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220906165534-d0df966e6959/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
-golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
+golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=
-golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=
+golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU=
+golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
-golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
+golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
diff --git a/pkg/cmd/auth/status/status.go b/pkg/cmd/auth/status/status.go
index 73ee084e9..2139bda1e 100644
--- a/pkg/cmd/auth/status/status.go
+++ b/pkg/cmd/auth/status/status.go
@@ -129,7 +129,6 @@ type StatusOptions struct {
 
 	Hostname  string
 	ShowToken bool
-	Active    bool
 }
 
 func NewCmdStatus(f *cmdutil.Factory, runF func(*StatusOptions) error) *cobra.Command {
@@ -164,7 +163,6 @@ func NewCmdStatus(f *cmdutil.Factory, runF func(*StatusOptions) error) *cobra.Co
 
 	cmd.Flags().StringVarP(&opts.Hostname, "hostname", "h", "", "Check only a specific hostname's auth status")
 	cmd.Flags().BoolVarP(&opts.ShowToken, "show-token", "t", false, "Display the auth token")
-	cmd.Flags().BoolVarP(&opts.Active, "active", "a", false, "Display the active account only")
 
 	return cmd
 }
@@ -226,10 +224,6 @@ func statusRun(opts *StatusOptions) error {
 			err = cmdutil.SilentError
 		}
 
-		if opts.Active {
-			continue
-		}
-
 		users := authCfg.UsersForHost(hostname)
 		for _, username := range users {
 			if username == activeUser {
diff --git a/pkg/cmd/extension/manager.go b/pkg/cmd/extension/manager.go
index 0ab429c2e..45186d689 100644
--- a/pkg/cmd/extension/manager.go
+++ b/pkg/cmd/extension/manager.go
@@ -263,10 +263,16 @@ func (m *Manager) installBin(repo ghrepo.Interface, target string) error {
 		}
 	}
 
-	// if an arm64 binary is unavailable, fall back to amd64 if it can be executed through Rosetta 2
-	if asset == nil && isMacARM && hasRosetta() {
+	// if using an ARM-based Mac and an arm64 binary is unavailable, fall back to amd64 if a relevant binary is available and Rosetta 2 is installed
+	if asset == nil && isMacARM {
 		for _, a := range r.Assets {
 			if strings.HasSuffix(a.Name, "darwin-amd64") {
+				if !hasRosetta() {
+					return fmt.Errorf(
+						"%[1]s unsupported for %[2]s. Install Rosetta with `softwareupdate --install-rosetta` to use the available darwin-amd64 binary, or open an issue: `gh issue create -R %[3]s/%[1]s -t'Support %[2]s'`",
+						repo.RepoName(), platform, repo.RepoOwner())
+				}
+
 				asset = &a
 				break
 			}
@@ -765,7 +771,7 @@ func possibleDists() []string {
 	}
 }
 
-func hasRosetta() bool {
+var hasRosetta = func() bool {
 	_, err := os.Stat("/Library/Apple/usr/libexec/oah/libRosettaRuntime")
 	return err == nil
 }


Test patch:
diff --git a/pkg/cmd/attestation/api/client.go b/pkg/cmd/attestation/api/client.go
index 460ae3aad..b0cafa6e9 100644
--- a/pkg/cmd/attestation/api/client.go
+++ b/pkg/cmd/attestation/api/client.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/cli/cli/v2/api"
 	ioconfig "github.com/cli/cli/v2/pkg/cmd/attestation/io"
+	"github.com/cli/go-gh/v2/pkg/auth"
 )
 
 const (
@@ -17,14 +18,12 @@ const (
 )
 
 type apiClient interface {
-	REST(hostname, method, p string, body io.Reader, data interface{}) error
 	RESTWithNext(hostname, method, p string, body io.Reader, data interface{}) (string, error)
 }
 
 type Client interface {
 	GetByRepoAndDigest(repo, digest string, limit int) ([]*Attestation, error)
 	GetByOwnerAndDigest(owner, digest string, limit int) ([]*Attestation, error)
-	GetTrustDomain() (string, error)
 }
 
 type LiveClient struct {
@@ -33,7 +32,9 @@ type LiveClient struct {
 	logger *ioconfig.Handler
 }
 
-func NewLiveClient(hc *http.Client, host string, l *ioconfig.Handler) *LiveClient {
+func NewLiveClient(hc *http.Client, l *ioconfig.Handler) *LiveClient {
+	host, _ := auth.DefaultHost()
+
 	return &LiveClient{
 		api:    api.NewClientFromHTTP(hc),
 		host:   strings.TrimSuffix(host, "/"),
@@ -63,12 +64,6 @@ func (c *LiveClient) GetByOwnerAndDigest(owner, digest string, limit int) ([]*At
 	return c.getAttestations(url, owner, digest, limit)
 }
 
-// GetTrustDomain returns the current trust domain. If the default is used
-// the empty string is returned
-func (c *LiveClient) GetTrustDomain() (string, error) {
-	return c.getTrustDomain(MetaPath)
-}
-
 func (c *LiveClient) getAttestations(url, name, digest string, limit int) ([]*Attestation, error) {
 	c.logger.VerbosePrintf("Fetching attestations for artifact digest %s\n\n", digest)
 
@@ -107,14 +102,3 @@ func (c *LiveClient) getAttestations(url, name, digest string, limit int) ([]*At
 
 	return attestations, nil
 }
-
-func (c *LiveClient) getTrustDomain(url string) (string, error) {
-	var resp MetaResponse
-
-	err := c.api.REST(c.host, http.MethodGet, url, nil, &resp)
-	if err != nil {
-		return "", err
-	}
-
-	return resp.Domains.ArtifactAttestations.TrustDomain, nil
-}
diff --git a/pkg/cmd/attestation/api/client_test.go b/pkg/cmd/attestation/api/client_test.go
index bfcb40f5a..693e3266e 100644
--- a/pkg/cmd/attestation/api/client_test.go
+++ b/pkg/cmd/attestation/api/client_test.go
@@ -172,35 +172,3 @@ func TestGetByDigest_Error(t *testing.T) {
 	require.Error(t, err)
 	require.Nil(t, attestations)
 }
-
-func TestGetTrustDomain(t *testing.T) {
-	fetcher := mockMetaGenerator{
-		TrustDomain: "foo",
-	}
-
-	t.Run("with returned trust domain", func(t *testing.T) {
-		c := LiveClient{
-			api: mockAPIClient{
-				OnREST: fetcher.OnREST,
-			},
-			logger: io.NewTestHandler(),
-		}
-		td, err := c.GetTrustDomain()
-		require.Nil(t, err)
-		require.Equal(t, "foo", td)
-
-	})
-
-	t.Run("with error", func(t *testing.T) {
-		c := LiveClient{
-			api: mockAPIClient{
-				OnREST: fetcher.OnRESTError,
-			},
-			logger: io.NewTestHandler(),
-		}
-		td, err := c.GetTrustDomain()
-		require.Equal(t, "", td)
-		require.ErrorContains(t, err, "test error")
-	})
-
-}
diff --git a/pkg/cmd/attestation/api/mock_apiClient_test.go b/pkg/cmd/attestation/api/mock_apiClient_test.go
index d58cdbc79..1d4f61cd9 100644
--- a/pkg/cmd/attestation/api/mock_apiClient_test.go
+++ b/pkg/cmd/attestation/api/mock_apiClient_test.go
@@ -10,17 +10,12 @@ import (
 
 type mockAPIClient struct {
 	OnRESTWithNext func(hostname, method, p string, body io.Reader, data interface{}) (string, error)
-	OnREST         func(hostname, method, p string, body io.Reader, data interface{}) error
 }
 
 func (m mockAPIClient) RESTWithNext(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
 	return m.OnRESTWithNext(hostname, method, p, body, data)
 }
 
-func (m mockAPIClient) REST(hostname, method, p string, body io.Reader, data interface{}) error {
-	return m.OnREST(hostname, method, p, body, data)
-}
-
 type mockDataGenerator struct {
 	NumAttestations int
 }
@@ -92,26 +87,3 @@ func (m mockDataGenerator) OnRESTWithNextNoAttestations(hostname, method, p stri
 func (m mockDataGenerator) OnRESTWithNextError(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
 	return "", errors.New("failed to get attestations")
 }
-
-type mockMetaGenerator struct {
-	TrustDomain string
-}
-
-func (m mockMetaGenerator) OnREST(hostname, method, p string, body io.Reader, data interface{}) error {
-	var template = `
-{
-  "domains": {
-    "artifact_attestations": {
-      "trust_domain": "%s"
-    }
-  }
-}
-`
-	var jsonString = fmt.Sprintf(template, m.TrustDomain)
-	return json.Unmarshal([]byte(jsonString), &data)
-
-}
-
-func (m mockMetaGenerator) OnRESTError(hostname, method, p string, body io.Reader, data interface{}) error {
-	return errors.New("test error")
-}
diff --git a/pkg/cmd/attestation/api/mock_client.go b/pkg/cmd/attestation/api/mock_client.go
index bcb51c414..edb51ee6e 100644
--- a/pkg/cmd/attestation/api/mock_client.go
+++ b/pkg/cmd/attestation/api/mock_client.go
@@ -9,7 +9,6 @@ import (
 type MockClient struct {
 	OnGetByRepoAndDigest  func(repo, digest string, limit int) ([]*Attestation, error)
 	OnGetByOwnerAndDigest func(owner, digest string, limit int) ([]*Attestation, error)
-	OnGetTrustDomain      func() (string, error)
 }
 
 func (m MockClient) GetByRepoAndDigest(repo, digest string, limit int) ([]*Attestation, error) {
@@ -20,10 +19,6 @@ func (m MockClient) GetByOwnerAndDigest(owner, digest string, limit int) ([]*Att
 	return m.OnGetByOwnerAndDigest(owner, digest, limit)
 }
 
-func (m MockClient) GetTrustDomain() (string, error) {
-	return m.OnGetTrustDomain()
-}
-
 func makeTestAttestation() Attestation {
 	return Attestation{Bundle: data.SigstoreBundle(nil)}
 }
diff --git a/pkg/cmd/attestation/api/trust_domain.go b/pkg/cmd/attestation/api/trust_domain.go
deleted file mode 100644
index 5cf9309ae..000000000
--- a/pkg/cmd/attestation/api/trust_domain.go
+++ /dev/null
@@ -1,15 +0,0 @@
-package api
-
-const MetaPath = "meta"
-
-type ArtifactAttestations struct {
-	TrustDomain string `json:"trust_domain"`
-}
-
-type Domain struct {
-	ArtifactAttestations ArtifactAttestations `json:"artifact_attestations"`
-}
-
-type MetaResponse struct {
-	Domains Domain `json:"domains"`
-}
diff --git a/pkg/cmd/attestation/auth/host.go b/pkg/cmd/attestation/auth/host.go
index a40df8335..1b5a344ea 100644
--- a/pkg/cmd/attestation/auth/host.go
+++ b/pkg/cmd/attestation/auth/host.go
@@ -4,11 +4,14 @@ import (
 	"errors"
 
 	"github.com/cli/cli/v2/internal/ghinstance"
+	"github.com/cli/go-gh/v2/pkg/auth"
 )
 
 var ErrUnsupportedHost = errors.New("An unsupported host was detected. Note that gh attestation does not currently support GHES")
 
-func IsHostSupported(host string) error {
+func IsHostSupported() error {
+	host, _ := auth.DefaultHost()
+
 	// Note that this check is slightly redundant as Tenancy should not be considered Enterprise
 	// but the ghinstance package has not been updated to reflect this yet.
 	if ghinstance.IsEnterprise(host) && !ghinstance.IsTenancy(host) {
diff --git a/pkg/cmd/attestation/auth/host_test.go b/pkg/cmd/attestation/auth/host_test.go
index 5d905bd04..1d84888c4 100644
--- a/pkg/cmd/attestation/auth/host_test.go
+++ b/pkg/cmd/attestation/auth/host_test.go
@@ -3,8 +3,6 @@ package auth
 import (
 	"testing"
 
-	ghauth "github.com/cli/go-gh/v2/pkg/auth"
-
 	"github.com/stretchr/testify/require"
 )
 
@@ -40,8 +38,7 @@ func TestIsHostSupported(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Setenv("GH_HOST", tc.host)
 
-			host, _ := ghauth.DefaultHost()
-			err := IsHostSupported(host)
+			err := IsHostSupported()
 			if tc.expectedErr {
 				require.ErrorIs(t, err, ErrUnsupportedHost)
 			} else {
diff --git a/pkg/cmd/attestation/download/download.go b/pkg/cmd/attestation/download/download.go
index 770fa442b..3af3b6200 100644
--- a/pkg/cmd/attestation/download/download.go
+++ b/pkg/cmd/attestation/download/download.go
@@ -11,7 +11,6 @@ import (
 	"github.com/cli/cli/v2/pkg/cmd/attestation/io"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/verification"
 	"github.com/cli/cli/v2/pkg/cmdutil"
-	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 
 	"github.com/MakeNowJust/heredoc"
 	"github.com/spf13/cobra"
@@ -79,18 +78,16 @@ func NewDownloadCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Comman
 			if err != nil {
 				return err
 			}
+			opts.APIClient = api.NewLiveClient(hc, opts.Logger)
 
-			if opts.Hostname == "" {
-				opts.Hostname, _ = ghauth.DefaultHost()
-			}
-			if err := auth.IsHostSupported(opts.Hostname); err != nil {
-				return err
-			}
-
-			opts.APIClient = api.NewLiveClient(hc, opts.Hostname, opts.Logger)
 			opts.OCIClient = oci.NewLiveClient()
+
 			opts.Store = NewLiveStore("")
 
+			if err := auth.IsHostSupported(); err != nil {
+				return err
+			}
+
 			if runF != nil {
 				return runF(opts)
 			}
@@ -109,7 +106,6 @@ func NewDownloadCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Comman
 	downloadCmd.Flags().StringVarP(&opts.PredicateType, "predicate-type", "", "", "Filter attestations by provided predicate type")
 	cmdutil.StringEnumFlag(downloadCmd, &opts.DigestAlgorithm, "digest-alg", "d", "sha256", []string{"sha256", "sha512"}, "The algorithm used to compute a digest of the artifact")
 	downloadCmd.Flags().IntVarP(&opts.Limit, "limit", "L", api.DefaultLimit, "Maximum number of attestations to fetch")
-	downloadCmd.Flags().StringVarP(&opts.Hostname, "hostname", "", "", "Configure host to use")
 
 	return downloadCmd
 }
diff --git a/pkg/cmd/attestation/download/options.go b/pkg/cmd/attestation/download/options.go
index 91f724853..cc1c4d3b5 100644
--- a/pkg/cmd/attestation/download/options.go
+++ b/pkg/cmd/attestation/download/options.go
@@ -24,7 +24,6 @@ type Options struct {
 	Owner           string
 	PredicateType   string
 	Repo            string
-	Hostname        string
 }
 
 func (opts *Options) AreFlagsValid() error {
diff --git a/pkg/cmd/attestation/inspect/bundle.go b/pkg/cmd/attestation/inspect/bundle.go
index d6dc5a4bb..283b2c14e 100644
--- a/pkg/cmd/attestation/inspect/bundle.go
+++ b/pkg/cmd/attestation/inspect/bundle.go
@@ -55,27 +55,17 @@ type AttestationDetail struct {
 	WorkflowID     string `json:"workflowId"`
 }
 
-func getOrgAndRepo(tenant, repoURL string) (string, string, error) {
-	var after string
-	var found bool
-	if tenant == "" {
-		after, found = strings.CutPrefix(repoURL, "https://github.com/")
-		if !found {
-			return "", "", fmt.Errorf("failed to get org and repo from %s", repoURL)
-		}
-	} else {
-		after, found = strings.CutPrefix(repoURL,
-			fmt.Sprintf("https://%s.ghe.com/", tenant))
-		if !found {
-			return "", "", fmt.Errorf("failed to get org and repo from %s", repoURL)
-		}
+func getOrgAndRepo(repoURL string) (string, string, error) {
+	after, found := strings.CutPrefix(repoURL, "https://github.com/")
+	if !found {
+		return "", "", fmt.Errorf("failed to get org and repo from %s", repoURL)
 	}
 
 	parts := strings.Split(after, "/")
 	return parts[0], parts[1], nil
 }
 
-func getAttestationDetail(tenant string, attr api.Attestation) (AttestationDetail, error) {
+func getAttestationDetail(attr api.Attestation) (AttestationDetail, error) {
 	envelope, err := attr.Bundle.Envelope()
 	if err != nil {
 		return AttestationDetail{}, fmt.Errorf("failed to get envelope from bundle: %v", err)
@@ -97,7 +87,7 @@ func getAttestationDetail(tenant string, attr api.Attestation) (AttestationDetai
 		return AttestationDetail{}, fmt.Errorf("failed to unmarshal predicate: %v", err)
 	}
 
-	org, repo, err := getOrgAndRepo(tenant, predicate.BuildDefinition.ExternalParameters.Workflow.Repository)
+	org, repo, err := getOrgAndRepo(predicate.BuildDefinition.ExternalParameters.Workflow.Repository)
 	if err != nil {
 		return AttestationDetail{}, fmt.Errorf("failed to parse attestation content: %v", err)
 	}
@@ -111,11 +101,11 @@ func getAttestationDetail(tenant string, attr api.Attestation) (AttestationDetai
 	}, nil
 }
 
-func getDetailsAsSlice(tenant string, results []*verification.AttestationProcessingResult) ([][]string, error) {
+func getDetailsAsSlice(results []*verification.AttestationProcessingResult) ([][]string, error) {
 	details := make([][]string, len(results))
 
 	for i, result := range results {
-		detail, err := getAttestationDetail(tenant, *result.Attestation)
+		detail, err := getAttestationDetail(*result.Attestation)
 		if err != nil {
 			return nil, fmt.Errorf("failed to get attestation detail: %v", err)
 		}
@@ -124,11 +114,11 @@ func getDetailsAsSlice(tenant string, results []*verification.AttestationProcess
 	return details, nil
 }
 
-func getAttestationDetails(tenant string, results []*verification.AttestationProcessingResult) ([]AttestationDetail, error) {
+func getAttestationDetails(results []*verification.AttestationProcessingResult) ([]AttestationDetail, error) {
 	details := make([]AttestationDetail, len(results))
 
 	for i, result := range results {
-		detail, err := getAttestationDetail(tenant, *result.Attestation)
+		detail, err := getAttestationDetail(*result.Attestation)
 		if err != nil {
 			return nil, fmt.Errorf("failed to get attestation detail: %v", err)
 		}
diff --git a/pkg/cmd/attestation/inspect/bundle_test.go b/pkg/cmd/attestation/inspect/bundle_test.go
index 61b8d7bfc..d7e9babd8 100644
--- a/pkg/cmd/attestation/inspect/bundle_test.go
+++ b/pkg/cmd/attestation/inspect/bundle_test.go
@@ -12,7 +12,7 @@ import (
 func TestGetOrgAndRepo(t *testing.T) {
 	t.Run("with valid source URL", func(t *testing.T) {
 		sourceURL := "https://github.com/github/gh-attestation"
-		org, repo, err := getOrgAndRepo("", sourceURL)
+		org, repo, err := getOrgAndRepo(sourceURL)
 		require.Nil(t, err)
 		require.Equal(t, "github", org)
 		require.Equal(t, "gh-attestation", repo)
@@ -20,19 +20,11 @@ func TestGetOrgAndRepo(t *testing.T) {
 
 	t.Run("with invalid source URL", func(t *testing.T) {
 		sourceURL := "hub.com/github/gh-attestation"
-		org, repo, err := getOrgAndRepo("", sourceURL)
+		org, repo, err := getOrgAndRepo(sourceURL)
 		require.Error(t, err)
 		require.Zero(t, org)
 		require.Zero(t, repo)
 	})
-
-	t.Run("with valid source tenant URL", func(t *testing.T) {
-		sourceURL := "https://foo.ghe.com/github/gh-attestation"
-		org, repo, err := getOrgAndRepo("foo", sourceURL)
-		require.Nil(t, err)
-		require.Equal(t, "github", org)
-		require.Equal(t, "gh-attestation", repo)
-	})
 }
 
 func TestGetAttestationDetail(t *testing.T) {
@@ -43,7 +35,7 @@ func TestGetAttestationDetail(t *testing.T) {
 	require.NoError(t, err)
 
 	attestation := attestations[0]
-	detail, err := getAttestationDetail("", *attestation)
+	detail, err := getAttestationDetail(*attestation)
 	require.NoError(t, err)
 
 	require.Equal(t, "sigstore", detail.OrgName)
diff --git a/pkg/cmd/attestation/inspect/inspect.go b/pkg/cmd/attestation/inspect/inspect.go
index 867ff8c1b..2731ee7a4 100644
--- a/pkg/cmd/attestation/inspect/inspect.go
+++ b/pkg/cmd/attestation/inspect/inspect.go
@@ -3,16 +3,13 @@ package inspect
 import (
 	"fmt"
 
-	"github.com/cli/cli/v2/internal/ghinstance"
 	"github.com/cli/cli/v2/internal/tableprinter"
-	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/artifact"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/artifact/oci"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/auth"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/io"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/verification"
 	"github.com/cli/cli/v2/pkg/cmdutil"
-	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 
 	"github.com/MakeNowJust/heredoc"
 	"github.com/spf13/cobra"
@@ -69,11 +66,8 @@ func NewInspectCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			opts.OCIClient = oci.NewLiveClient()
-			if opts.Hostname == "" {
-				opts.Hostname, _ = ghauth.DefaultHost()
-			}
 
-			if err := auth.IsHostSupported(opts.Hostname); err != nil {
+			if err := auth.IsHostSupported(); err != nil {
 				return err
 			}
 
@@ -84,26 +78,6 @@ func NewInspectCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 			config := verification.SigstoreConfig{
 				Logger: opts.Logger,
 			}
-			// Prepare for tenancy if detected
-			if ghinstance.IsTenancy(opts.Hostname) {
-				hc, err := f.HttpClient()
-				if err != nil {
-					return err
-				}
-				apiClient := api.NewLiveClient(hc, opts.Hostname, opts.Logger)
-				td, err := apiClient.GetTrustDomain()
-				if err != nil {
-					return err
-				}
-				tenant, found := ghinstance.TenantName(opts.Hostname)
-				if !found {
-					return fmt.Errorf("Invalid hostname provided: '%s'",
-						opts.Hostname)
-				}
-
-				config.TrustDomain = td
-				opts.Tenant = tenant
-			}
 
 			opts.SigstoreVerifier = verification.NewLiveSigstoreVerifier(config)
 
@@ -116,7 +90,6 @@ func NewInspectCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 
 	inspectCmd.Flags().StringVarP(&opts.BundlePath, "bundle", "b", "", "Path to bundle on disk, either a single bundle in a JSON file or a JSON lines file with multiple bundles")
 	inspectCmd.MarkFlagRequired("bundle") //nolint:errcheck
-	inspectCmd.Flags().StringVarP(&opts.Hostname, "hostname", "", "", "Configure host to use")
 	cmdutil.StringEnumFlag(inspectCmd, &opts.DigestAlgorithm, "digest-alg", "d", "sha256", []string{"sha256", "sha512"}, "The algorithm used to compute a digest of the artifact")
 	cmdutil.AddFormatFlags(inspectCmd, &opts.exporter)
 
@@ -152,7 +125,7 @@ func runInspect(opts *Options) error {
 
 	// If the user provides the --format=json flag, print the results in JSON format
 	if opts.exporter != nil {
-		details, err := getAttestationDetails(opts.Tenant, res.VerifyResults)
+		details, err := getAttestationDetails(res.VerifyResults)
 		if err != nil {
 			return fmt.Errorf("failed to get attestation detail: %v", err)
 		}
@@ -165,7 +138,7 @@ func runInspect(opts *Options) error {
 	}
 
 	// otherwise, print results in a table
-	details, err := getDetailsAsSlice(opts.Tenant, res.VerifyResults)
+	details, err := getDetailsAsSlice(res.VerifyResults)
 	if err != nil {
 		return fmt.Errorf("failed to parse attestation details: %v", err)
 	}
diff --git a/pkg/cmd/attestation/inspect/options.go b/pkg/cmd/attestation/inspect/options.go
index 1a5a1b937..b9c8819c4 100644
--- a/pkg/cmd/attestation/inspect/options.go
+++ b/pkg/cmd/attestation/inspect/options.go
@@ -18,8 +18,6 @@ type Options struct {
 	OCIClient        oci.Client
 	SigstoreVerifier verification.SigstoreVerifier
 	exporter         cmdutil.Exporter
-	Hostname         string
-	Tenant           string
 }
 
 // Clean cleans the file path option values
diff --git a/pkg/cmd/attestation/test/data/custom-issuer-artifact b/pkg/cmd/attestation/test/data/custom-issuer-artifact
deleted file mode 100644
index bdd51cc27..000000000
--- a/pkg/cmd/attestation/test/data/custom-issuer-artifact
+++ /dev/null
@@ -1,1 +0,0 @@
-hello-world
\ No newline at end of file
diff --git a/pkg/cmd/attestation/test/data/custom-issuer.sigstore.json b/pkg/cmd/attestation/test/data/custom-issuer.sigstore.json
deleted file mode 100644
index ad47e2478..000000000
--- a/pkg/cmd/attestation/test/data/custom-issuer.sigstore.json
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json",
-  "verificationMaterial": {
-    "tlogEntries": [
-      {
-        "logIndex": "129601213",
-        "logId": {
-          "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
-        },
-        "kindVersion": {
-          "kind": "dsse",
-          "version": "0.0.1"
-        },
-        "integratedTime": "1726082343",
-        "inclusionPromise": {
-          "signedEntryTimestamp": "MEQCICL0FAIR4ISP9CZJERTDWm0ZWQXmBfk1n2rNaKcThjFnAiAOpJMbjiwKD+Nt32VgodKh3whOZWERIerwtuTGChcKVg=="
-        },
-        "inclusionProof": {
-          "logIndex": "7696951",
-          "rootHash": "jFHZ9WG6TKsPs3sSueywIxZ8kCLggGmqg2toWJ8seXk=",
-          "treeSize": "7696953",
-          "hashes": [
-            "CYHKf/bh3CxW39mRO4FlajMmrzH8KleobYBryPGMjhQ=",
-            "kAIZZLHLd1KnJQ3CNShHaxG5wQjuF0wG49oq5AC4vXQ=",
-            "f9/xH+QDA5+muxMr2QouK2OLOLkI+jPM2lUX7diPaOA=",
-            "mlhYVIwuxUw07ewtU3um0c8IkYPf55EhyXwuOlzwJbs=",
-            "K2QMn27+dp+8+2utA7P0W1+pFT18nvdFMIlz3qXBC/0=",
-            "+5kLbgrjmfzkYQ0V+vofM18LsqyNpLa5oRr/24gOH+s=",
-            "kNWva6L6IlKsmCkDx0cdNtZJztdunXsjWqzwn/k9moQ=",
-            "W8NjV+EXoTQRJYFsLhEueUiT6vxbPXYoSIONJIJmCvM=",
-            "8tdMgSRLWN3UxGVxNBjKm/4Sjivq1EMAAomCJVhscmU=",
-            "hPmHSU/WMp+ST2P+1mEnh/wjLLY9KbulaYu+ELcIJ2o=",
-            "KYw9/y5e7chXWKn9xKSkwIm0ZV/niE9MccszZ/yMVH8=",
-            "52g33BcJumS4u9qvM95+2WQcPJoG3zKFTsDQU/yGT/Q=",
-            "57ZnG4cTkj/dfCv8Vz7kMnUbcY3NL1PkfzMA2cgdg0c=",
-            "uRsmea7eVXshBNN6huh/owmfaAy9Rx4Cq2M2vFb2Ntk=",
-            "NeHKGVl6KVXfx3+wnQrIrxra4Pr9Fa7YDpTlf86mlTc="
-          ],
-          "checkpoint": {
-            "envelope": "rekor.sigstore.dev - 1193050959916656506\n7696953\njFHZ9WG6TKsPs3sSueywIxZ8kCLggGmqg2toWJ8seXk=\n\n— rekor.sigstore.dev wNI9ajBFAiEA4cRIk3KpKhPAmONZTnKJ84MWoy/uylIgvcQ5hZsQdsQCIFrXcNcJfpQQAXlhca0jAsz/4vqXvuFdHTT12JDyXhjW\n"
-          }
-        },
-        "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiNTM0ZDM4OWFmY2ZiMGYyOGE1MzE2MDEzNmRhOTNmODQyNGEwOGMzMzZhMTQ5YzcxNjg5NWFiY2EyZDlhMzAxMSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjhkOWMxNzg0NjA5ZGJkZmQxMjhhMjFlMzdiNzJhY2QwZDVmY2RhNjBlMzRjZjQwZGI2ZGYwMDQyODJmMGFjMDQifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVZQ0lRRG82SGN1ZkQxWDVXK0FMcUFzK0d0VXZvcEZYQlFGNUpDRFJXODlWTndOV1FJaEFKdjRTSjhINlJPM3JwV3Zib3VUWTdrNGJzUWN1NWNDa2l1aXRRSjlkMEgvIiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VjNGFrTkRRbTV0WjBGM1NVSkJaMGxWVDBwd05EVmpPVTExVGxKU1JISk5XSEpMZG5sSWJHc3JVbFpKZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwUmQwOVVSWGhOVkd0NFQxUkJlbGRvWTA1TmFsRjNUMVJGZUUxVWEzbFBWRUY2VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVlpUbVZEZFVsMUsySnRhRzR4UkdsdmRHRnVNakZpUjFsTGVGcHdSVFpOV2paUFlTOEtWMjh4WTNsNU5raFhNVVZJVEZsQ00wbG5XRE56Y1RkdFNFSklaMWQyY1dwMlFWVkdVelZZTUZaVFZGWktkR0Z4TkV0UFEwSmFaM2RuWjFkVlRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVXJkVkkxQ2tSMFRHeDRWelJQTnpCMWFWcGtXVXBZTWlzd01EUnpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMWwzV1VSV1VqQlNRVkZJTDBKR2EzZFdORnBXWVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hWWk1qbDBURE5TZG1KNU1YTmFWMlJ3WkVNNWFBcGtTRkpzWXpOUmRreHRaSEJrUjJneFdXazVNMkl6U25KYWJYaDJaRE5OZG1GWE5UQmFWMlI1V1ZoU2NHSXlOSFZsVnpGelVVaEtiRnB1VFhaaFIxWm9DbHBJVFhaaVYwWndZbXBDUmtKbmIzSkNaMFZGUVZsUEwwMUJSVUpDUkdSdlpFaFNkMk42YjNaTU0xSjJZVEpXZFV4dFJtcGtSMngyWW01TmRWb3liREFLWVVoV2FXUllUbXhqYlU1MlltNVNiR0p1VVhWWk1qbDBUREpvYUdKWE1XeGphVEV3WVZjeGJFMUNPRWREYVhOSFFWRlJRbWMzT0hkQlVVbEZSVmhrZGdwamJYUnRZa2M1TTFneVVuQmpNMEpvWkVkT2IwMUVXVWREYVhOSFFWRlJRbWMzT0hkQlVVMUZTMFJKTkUweVNtMVBWRmt6V20xRmVsbDZWVFZOVkd0NUNrNVhVbXROYWxac1RtMUZNbHBVYUd4T2VtZDRUbFJSZVUxVVJUTlpiVmwzUzJkWlMwdDNXVUpDUVVkRWRucEJRa0pCVVdOUldGSXdXbGhPTUZsWVVuQUtZakkwWjFOWE5UQmFWMlI1V1ZoU2NHSXlOR2RXUjFaNlpFUkJaVUpuYjNKQ1owVkZRVmxQTDAxQlJVWkNRa0l3WWpJNGRHSkhWbTVoV0ZGMldWaFNNQXBhV0U0d1RVSXdSME5wYzBkQlVWRkNaemM0ZDBGUldVVkVNMHBzV201TmRtRkhWbWhhU0UxMllsZEdjR0pxUWtoQ1oyOXlRbWRGUlVGWlR5OU5RVVZKQ2tKRWEwMU9NbWd3WkVoQ2VrOXBPSFprUnpseVdsYzBkVmxYVGpCaFZ6bDFZM2sxYm1GWVVtOWtWMG94WXpKV2VWa3lPWFZrUjFaMVpFTTFhbUl5TUhZS1lVZEdkR0pYVm5sTVdGSndZbGRWZDFwUldVdExkMWxDUWtGSFJIWjZRVUpEVVZKWVJFWldiMlJJVW5kamVtOTJUREprY0dSSGFERlphVFZxWWpJd2RncGtSemwyVEZkNGJGb3liREJNTWtZd1pFZFdlbVJET0hWYU1td3dZVWhXYVV3elpIWmpiWFJ0WWtjNU0yTjVPWEJpYmxKc1dqTkthR1JIYkhaaWFUVTFDbUpYZUVGamJWWnRZM2s1YjFwWFJtdGplVGwwV1Zkc2RVMUVaMGREYVhOSFFWRlJRbWMzT0hkQlVXOUZTMmQzYjAxcVozcFpiVmsxVG1wa2JWbFVUbW9LVGxScmVFOVVTVEZhUjFGNVRsZFZNbGxVV214UFIxVXpUMFJGTVU1RVNYaE5WR1JwV21wQlpFSm5iM0pDWjBWRlFWbFBMMDFCUlV4Q1FUaE5SRmRrY0Fwa1IyZ3hXV2t4YjJJelRqQmFWMUYzVFhkWlMwdDNXVUpDUVVkRWRucEJRa1JCVVd4RVEwNXZaRWhTZDJONmIzWk1NbVJ3WkVkb01WbHBOV3BpTWpCMkNtUkhPWFpNVjNoc1dqSnNNRXd5UmpCa1IxWjZaRVJCTkVKbmIzSkNaMFZGUVZsUEwwMUJSVTVDUTI5TlMwUkpORTB5U20xUFZGa3pXbTFGZWxsNlZUVUtUVlJyZVU1WFVtdE5hbFpzVG0xRk1scFVhR3hPZW1kNFRsUlJlVTFVUlROWmJWbDNTSGRaUzB0M1dVSkNRVWRFZG5wQlFrUm5VVkpFUVRsNVdsZGFlZ3BNTW1oc1dWZFNla3d5TVdoaFZ6UjNSMUZaUzB0M1dVSkNRVWRFZG5wQlFrUjNVVXhFUVdzMFRsUkZORTlVVVRSTmFsRjNURUZaUzB0M1dVSkNRVWRFQ25aNlFVSkZRVkZsUkVKNGIyUklVbmRqZW05MlRESmtjR1JIYURGWmFUVnFZakl3ZG1SSE9YWk1WM2hzV2pKc01FMUNhMGREYVhOSFFWRlJRbWMzT0hjS1FWSkZSVU4zZDBwTlZHZDNUWHBSTkUxRVVUSk5SMVZIUTJselIwRlJVVUpuTnpoM1FWSkpSVlozZUZaaFNGSXdZMGhOTmt4NU9XNWhXRkp2WkZkSmRRcFpNamwwVEROU2RtSjVNWE5hVjJSd1pFTTVhR1JJVW14ak0xRjJURzFrY0dSSGFERlphVGt6WWpOS2NscHRlSFprTTAxMllWYzFNRnBYWkhsWldGSndDbUl5TkhWbFZ6RnpVVWhLYkZwdVRYWmhSMVpvV2toTmRtSlhSbkJpYWtFMFFtZHZja0puUlVWQldVOHZUVUZGVkVKRGIwMUxSRWswVFRKS2JVOVVXVE1LV20xRmVsbDZWVFZOVkd0NVRsZFNhMDFxVm14T2JVVXlXbFJvYkU1NlozaE9WRkY1VFZSRk0xbHRXWGRKVVZsTFMzZFpRa0pCUjBSMmVrRkNSa0ZSVkFwRVFrWXpZak5LY2xwdGVIWmtNVGxyWVZoT2QxbFlVbXBoUkVKWVFtZHZja0puUlVWQldVOHZUVUZGVmtKRmEwMVNNbWd3WkVoQ2VrOXBPSFphTW13d0NtRklWbWxNYlU1MllsTTVNR0l5T0hSaVIxWnVZVmhSZGxsWVVqQmFXRTR3VERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hoTlJHZDRUMFJKZVU1cVJYa0tUbE01YUdSSVVteGlXRUl3WTNrNGVFMUNXVWREYVhOSFFWRlJRbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVsSFMwSm5iM0pDWjBWRlFXUmFOUXBCWjFGRFFraDNSV1ZuUWpSQlNGbEJNMVF3ZDJGellraEZWRXBxUjFJMFkyMVhZek5CY1VwTFdISnFaVkJMTXk5b05IQjVaME00Y0Rkdk5FRkJRVWRTQ2pSdldtbFpRVUZCUWtGTlFWSjZRa1pCYVVGamJHNDNUR1JRUkZOS1lXZzVSRzFDTVdwT2EwMXlRMVZVYVU5WEwxbzNTMkpJZWtoNFZWQjZNek4zU1dnS1FVdGFhVmhwTDFjelVsSTVjbXh2ZVdWV1JsTlFOemc0U1VsdVprcERiekJPY21acWIybFhNRWh4TkhkTlFXOUhRME54UjFOTk5EbENRVTFFUVRKalFRcE5SMUZEVFVFd2RFWTFObmRDYlZCSWNtdzBVQ3RWTUVGaGNuRnNWbGg1VVV4eloxQkphVFU0UmxWeFlqVjNkMVZLZUZwQmRFOU1kbFJMYTI1dWNrVmxDakpNU3pCWlFVbDNVVTFtVUZsa2NHeHlWUzlWVUdaWlJtWlZOSFV2YlhGV05HdFBOVWh6WXpoUGFGcG9lVTE1WjBJNWJVSnhSMnBpYlRkVlFrNTRlakFLWXpNMVZXMUhRbWNLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfX0="
-      }
-    ],
-    "timestampVerificationData": {
-    },
-    "certificate": {
-      "rawBytes": "MIIG8jCCBnmgAwIBAgIUOJp45c9MuNRRDrMXrKvyHlk+RVIwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjQwOTExMTkxOTAzWhcNMjQwOTExMTkyOTAzWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYNeCuIu+bmhn1Diotan21bGYKxZpE6MZ6Oa/Wo1cyy6HW1EHLYB3IgX3sq7mHBHgWvqjvAUFS5X0VSTVJtaq4KOCBZgwggWUMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQU+uR5DtLlxW4O70uiZdYJX2+004swHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wYwYDVR0RAQH/BFkwV4ZVaHR0cHM6Ly9naXRodWIuY29tL3Rvby1sZWdpdC9hdHRlc3QvLmdpdGh1Yi93b3JrZmxvd3MvaW50ZWdyYXRpb24ueW1sQHJlZnMvaGVhZHMvbWFpbjBFBgorBgEEAYO/MAEBBDdodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2hhbW1lci10aW1lMB8GCisGAQQBg78wAQIEEXdvcmtmbG93X2Rpc3BhdGNoMDYGCisGAQQBg78wAQMEKDI4M2JmOTY3ZmEzYzU5MTkyNWRkMjVlNmE2ZThlNzgxNTQyMTE3YmYwKgYKKwYBBAGDvzABBAQcQXR0ZXN0YXRpb24gSW50ZWdyYXRpb24gVGVzdDAeBgorBgEEAYO/MAEFBBB0b28tbGVnaXQvYXR0ZXN0MB0GCisGAQQBg78wAQYED3JlZnMvaGVhZHMvbWFpbjBHBgorBgEEAYO/MAEIBDkMN2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20vaGFtbWVyLXRpbWUwZQYKKwYBBAGDvzABCQRXDFVodHRwczovL2dpdGh1Yi5jb20vdG9vLWxlZ2l0L2F0dGVzdC8uZ2l0aHViL3dvcmtmbG93cy9pbnRlZ3JhdGlvbi55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wAQoEKgwoMjgzYmY5NjdmYTNjNTkxOTI1ZGQyNWU2YTZlOGU3ODE1NDIxMTdiZjAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwMwYKKwYBBAGDvzABDAQlDCNodHRwczovL2dpdGh1Yi5jb20vdG9vLWxlZ2l0L2F0dGVzdDA4BgorBgEEAYO/MAENBCoMKDI4M2JmOTY3ZmEzYzU5MTkyNWRkMjVlNmE2ZThlNzgxNTQyMTE3YmYwHwYKKwYBBAGDvzABDgQRDA9yZWZzL2hlYWRzL21haW4wGQYKKwYBBAGDvzABDwQLDAk4NTE4OTQ4MjQwLAYKKwYBBAGDvzABEAQeDBxodHRwczovL2dpdGh1Yi5jb20vdG9vLWxlZ2l0MBkGCisGAQQBg78wAREECwwJMTgwMzQ4MDQ2MGUGCisGAQQBg78wARIEVwxVaHR0cHM6Ly9naXRodWIuY29tL3Rvby1sZWdpdC9hdHRlc3QvLmdpdGh1Yi93b3JrZmxvd3MvaW50ZWdyYXRpb24ueW1sQHJlZnMvaGVhZHMvbWFpbjA4BgorBgEEAYO/MAETBCoMKDI4M2JmOTY3ZmEzYzU5MTkyNWRkMjVlNmE2ZThlNzgxNTQyMTE3YmYwIQYKKwYBBAGDvzABFAQTDBF3b3JrZmxvd19kaXNwYXRjaDBXBgorBgEEAYO/MAEVBEkMR2h0dHBzOi8vZ2l0aHViLmNvbS90b28tbGVnaXQvYXR0ZXN0L2FjdGlvbnMvcnVucy8xMDgxODIyNjEyNS9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGR4oZiYAAABAMARzBFAiAcln7LdPDSJah9DmB1jNkMrCUTiOW/Z7KbHzHxUPz33wIhAKZiXi/W3RR9rloyeVFSP788IInfJCo0NrfjoiW0Hq4wMAoGCCqGSM49BAMDA2cAMGQCMA0tF56wBmPHrl4P+U0AarqlVXyQLsgPIi58FUqb5wwUJxZAtOLvTKknnrEe2LK0YAIwQMfPYdplrU/UPfYFfU4u/mqV4kO5Hsc8OhZhyMygB9mBqGjbm7UBNxz0c35UmGBg"
-    }
-  },
-  "dsseEnvelope": {
-    "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QiLCJkaWdlc3QiOnsic2hhMjU2IjoiYWZhMjdiNDRkNDNiMDJhOWZlYTQxZDEzY2VkYzJlNDAxNmNmY2Y4N2M1ZGJmOTkwZTU5MzY2OWFhOGNlMjg2ZCJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vYWN0aW9ucy5naXRodWIuaW8vYnVpbGR0eXBlcy93b3JrZmxvdy92MSIsImV4dGVybmFsUGFyYW1ldGVycyI6eyJ3b3JrZmxvdyI6eyJyZWYiOiJyZWZzL2hlYWRzL21haW4iLCJyZXBvc2l0b3J5IjoiaHR0cHM6Ly9naXRodWIuY29tL3Rvby1sZWdpdC9hdHRlc3QiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvaW50ZWdyYXRpb24ueW1sIn19LCJpbnRlcm5hbFBhcmFtZXRlcnMiOnsiZ2l0aHViIjp7ImV2ZW50X25hbWUiOiJ3b3JrZmxvd19kaXNwYXRjaCIsInJlcG9zaXRvcnlfaWQiOiI4NTE4OTQ4MjQiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiMTgwMzQ4MDQ2IiwicnVubmVyX2Vudmlyb25tZW50IjoiZ2l0aHViLWhvc3RlZCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vdG9vLWxlZ2l0L2F0dGVzdEByZWZzL2hlYWRzL21haW4iLCJkaWdlc3QiOnsiZ2l0Q29tbWl0IjoiMjgzYmY5NjdmYTNjNTkxOTI1ZGQyNWU2YTZlOGU3ODE1NDIxMTdiZiJ9fV19LCJydW5EZXRhaWxzIjp7ImJ1aWxkZXIiOnsiaWQiOiJodHRwczovL2dpdGh1Yi5jb20vdG9vLWxlZ2l0L2F0dGVzdC8uZ2l0aHViL3dvcmtmbG93cy9pbnRlZ3JhdGlvbi55bWxAcmVmcy9oZWFkcy9tYWluIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS90b28tbGVnaXQvYXR0ZXN0L2FjdGlvbnMvcnVucy8xMDgxODIyNjEyNS9hdHRlbXB0cy8xIn19fX0=",
-    "payloadType": "application/vnd.in-toto+json",
-    "signatures": [
-      {
-        "sig": "MEYCIQDo6HcufD1X5W+ALqAs+GtUvopFXBQF5JCDRW89VNwNWQIhAJv4SJ8H6RO3rpWvbouTY7k4bsQcu5cCkiuitQJ9d0H/"
-      }
-    ]
-  }
-}
\ No newline at end of file
diff --git a/pkg/cmd/attestation/trustedroot/trustedroot.go b/pkg/cmd/attestation/trustedroot/trustedroot.go
index c9c3fdb04..e28ceab62 100644
--- a/pkg/cmd/attestation/trustedroot/trustedroot.go
+++ b/pkg/cmd/attestation/trustedroot/trustedroot.go
@@ -6,13 +6,9 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/cli/cli/v2/internal/ghinstance"
-	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/auth"
-	"github.com/cli/cli/v2/pkg/cmd/attestation/io"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/verification"
 	"github.com/cli/cli/v2/pkg/cmdutil"
-	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 
 	"github.com/MakeNowJust/heredoc"
 	"github.com/sigstore/sigstore-go/pkg/tuf"
@@ -23,8 +19,6 @@ type Options struct {
 	TufUrl      string
 	TufRootPath string
 	VerifyOnly  bool
-	Hostname    string
-	TrustDomain string
 }
 
 type tufClientInstantiator func(o *tuf.Options) (*tuf.Client, error)
@@ -60,28 +54,10 @@ func NewTrustedRootCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Com
 			gh attestation trusted-root
 		`),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			if opts.Hostname == "" {
-				opts.Hostname, _ = ghauth.DefaultHost()
-			}
-
-			if err := auth.IsHostSupported(opts.Hostname); err != nil {
+			if err := auth.IsHostSupported(); err != nil {
 				return err
 			}
 
-			if ghinstance.IsTenancy(opts.Hostname) {
-				hc, err := f.HttpClient()
-				if err != nil {
-					return err
-				}
-				logger := io.NewHandler(f.IOStreams)
-				apiClient := api.NewLiveClient(hc, opts.Hostname, logger)
-				td, err := apiClient.GetTrustDomain()
-				if err != nil {
-					return err
-				}
-				opts.TrustDomain = td
-			}
-
 			if runF != nil {
 				return runF(opts)
 			}
@@ -98,19 +74,12 @@ func NewTrustedRootCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Com
 	trustedRootCmd.Flags().StringVarP(&opts.TufRootPath, "tuf-root", "", "", "Path to the TUF root.json file on disk")
 	trustedRootCmd.MarkFlagsRequiredTogether("tuf-url", "tuf-root")
 	trustedRootCmd.Flags().BoolVarP(&opts.VerifyOnly, "verify-only", "", false, "Don't output trusted_root.jsonl contents")
-	trustedRootCmd.Flags().StringVarP(&opts.Hostname, "hostname", "", "", "Configure host to use")
 
 	return &trustedRootCmd
 }
 
-type tufConfig struct {
-	tufOptions *tuf.Options
-	targets    []string
-}
-
 func getTrustedRoot(makeTUF tufClientInstantiator, opts *Options) error {
-	var tufOptions []tufConfig
-	var defaultTR = "trusted_root.json"
+	var tufOptions []*tuf.Options
 
 	tufOpt := verification.DefaultOptionsWithCacheSetting()
 	// Disable local caching, so we get up-to-date response from TUF repository
@@ -124,54 +93,37 @@ func getTrustedRoot(makeTUF tufClientInstantiator, opts *Options) error {
 
 		tufOpt.Root = tufRoot
 		tufOpt.RepositoryBaseURL = opts.TufUrl
-		tufOptions = append(tufOptions, tufConfig{
-			tufOptions: tufOpt,
-			targets:    []string{defaultTR},
-		})
+		tufOptions = append(tufOptions, tufOpt)
 	} else {
 		// Get from both Sigstore public good and GitHub private instance
-		tufOptions = append(tufOptions, tufConfig{
-			tufOptions: tufOpt,
-			targets:    []string{defaultTR},
-		})
+		tufOptions = append(tufOptions, tufOpt)
 
 		tufOpt = verification.GitHubTUFOptions()
 		tufOpt.CacheValidity = 0
-		targets := []string{defaultTR}
-		if opts.TrustDomain != "" {
-			targets = append(targets, fmt.Sprintf("%s.%s",
-				opts.TrustDomain, defaultTR))
-		}
-		tufOptions = append(tufOptions, tufConfig{
-			tufOptions: tufOpt,
-			targets:    targets,
-		})
+		tufOptions = append(tufOptions, tufOpt)
 	}
 
-	for _, tufOpt := range tufOptions {
-		tufClient, err := makeTUF(tufOpt.tufOptions)
+	for _, tufOpt = range tufOptions {
+		tufClient, err := makeTUF(tufOpt)
 		if err != nil {
 			return fmt.Errorf("failed to create TUF client: %v", err)
 		}
 
-		for _, target := range tufOpt.targets {
-			t, err := tufClient.GetTarget(target)
-			if err != nil {
-				return fmt.Errorf("failed to retrieve trusted root %s via TUF: %w",
-					target, err)
-			}
+		t, err := tufClient.GetTarget("trusted_root.json")
+		if err != nil {
+			return err
+		}
 
-			output := new(bytes.Buffer)
-			err = json.Compact(output, t)
-			if err != nil {
-				return err
-			}
+		output := new(bytes.Buffer)
+		err = json.Compact(output, t)
+		if err != nil {
+			return err
+		}
 
-			if !opts.VerifyOnly {
-				fmt.Println(output)
-			} else {
-				fmt.Printf("Local TUF repository for %s updated and verified\n", tufOpt.tufOptions.RepositoryBaseURL)
-			}
+		if !opts.VerifyOnly {
+			fmt.Println(output)
+		} else {
+			fmt.Printf("Local TUF repository for %s updated and verified\n", tufOpt.RepositoryBaseURL)
 		}
 	}
 
diff --git a/pkg/cmd/attestation/verification/extensions.go b/pkg/cmd/attestation/verification/extensions.go
index 727feb72c..1915152dc 100644
--- a/pkg/cmd/attestation/verification/extensions.go
+++ b/pkg/cmd/attestation/verification/extensions.go
@@ -1,50 +1,28 @@
 package verification
 
 import (
-	"errors"
 	"fmt"
 	"strings"
 )
 
-func VerifyCertExtensions(results []*AttestationProcessingResult, tenant, owner, repo string) error {
-	if len(results) == 0 {
-		return errors.New("no attestations proccessing results")
-	}
-
+func VerifyCertExtensions(results []*AttestationProcessingResult, owner string, repo string) error {
 	for _, attestation := range results {
-		if err := verifyCertExtensions(attestation, tenant, owner, repo); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func verifyCertExtensions(attestation *AttestationProcessingResult, tenant, owner, repo string) error {
-	var want string
-
-	if tenant == "" {
-		want = fmt.Sprintf("https://github.com/%s", owner)
-	} else {
-		want = fmt.Sprintf("https://%s.ghe.com/%s", tenant, owner)
-	}
-	sourceRepositoryOwnerURI := attestation.VerificationResult.Signature.Certificate.Extensions.SourceRepositoryOwnerURI
-	if !strings.EqualFold(want, sourceRepositoryOwnerURI) {
-		return fmt.Errorf("expected SourceRepositoryOwnerURI to be %s, got %s", want, sourceRepositoryOwnerURI)
-	}
-
-	// if repo is set, check the SourceRepositoryURI field
-	if repo != "" {
-		if tenant == "" {
-			want = fmt.Sprintf("https://github.com/%s", repo)
-		} else {
-			want = fmt.Sprintf("https://%s.ghe.com/%s", tenant, repo)
+		// TODO: handle proxima prefix
+		expectedSourceRepositoryOwnerURI := fmt.Sprintf("https://github.com/%s", owner)
+		sourceRepositoryOwnerURI := attestation.VerificationResult.Signature.Certificate.Extensions.SourceRepositoryOwnerURI
+		if !strings.EqualFold(expectedSourceRepositoryOwnerURI, sourceRepositoryOwnerURI) {
+			return fmt.Errorf("expected SourceRepositoryOwnerURI to be %s, got %s", expectedSourceRepositoryOwnerURI, sourceRepositoryOwnerURI)
 		}
 
-		sourceRepositoryURI := attestation.VerificationResult.Signature.Certificate.Extensions.SourceRepositoryURI
-		if !strings.EqualFold(want, sourceRepositoryURI) {
-			return fmt.Errorf("expected SourceRepositoryURI to be %s, got %s", want, sourceRepositoryURI)
+		// if repo is set, check the SourceRepositoryURI field
+		if repo != "" {
+			// TODO: handle proxima prefix
+			expectedSourceRepositoryURI := fmt.Sprintf("https://github.com/%s", repo)
+			sourceRepositoryURI := attestation.VerificationResult.Signature.Certificate.Extensions.SourceRepositoryURI
+			if !strings.EqualFold(expectedSourceRepositoryURI, sourceRepositoryURI) {
+				return fmt.Errorf("expected SourceRepositoryURI to be %s, got %s", expectedSourceRepositoryURI, sourceRepositoryURI)
+			}
 		}
 	}
-
 	return nil
 }
diff --git a/pkg/cmd/attestation/verification/extensions_test.go b/pkg/cmd/attestation/verification/extensions_test.go
index c86f2030a..7aec4ec45 100644
--- a/pkg/cmd/attestation/verification/extensions_test.go
+++ b/pkg/cmd/attestation/verification/extensions_test.go
@@ -25,74 +25,22 @@ func TestVerifyCertExtensions(t *testing.T) {
 	}
 
 	t.Run("VerifyCertExtensions with owner and repo", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "", "owner", "owner/repo")
+		err := VerifyCertExtensions(results, "owner", "owner/repo")
 		require.NoError(t, err)
 	})
 
-	t.Run("VerifyCertExtensions with owner and repo, but wrong tenant", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "foo", "owner", "owner/repo")
-		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://foo.ghe.com/owner, got https://github.com/owner")
-	})
-
 	t.Run("VerifyCertExtensions with owner", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "", "owner", "")
+		err := VerifyCertExtensions(results, "owner", "")
 		require.NoError(t, err)
 	})
 
 	t.Run("VerifyCertExtensions with wrong owner", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "", "wrong", "")
+		err := VerifyCertExtensions(results, "wrong", "")
 		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://github.com/wrong, got https://github.com/owner")
 	})
 
 	t.Run("VerifyCertExtensions with wrong repo", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "", "owner", "wrong")
+		err := VerifyCertExtensions(results, "owner", "wrong")
 		require.ErrorContains(t, err, "expected SourceRepositoryURI to be https://github.com/wrong, got https://github.com/owner/repo")
 	})
 }
-
-func TestVerifyTenancyCertExtensions(t *testing.T) {
-	results := []*AttestationProcessingResult{
-		{
-			VerificationResult: &verify.VerificationResult{
-				Signature: &verify.SignatureVerificationResult{
-					Certificate: &certificate.Summary{
-						Extensions: certificate.Extensions{
-							SourceRepositoryOwnerURI: "https://foo.ghe.com/owner",
-							SourceRepositoryURI:      "https://foo.ghe.com/owner/repo",
-						},
-					},
-				},
-			},
-		},
-	}
-
-	t.Run("VerifyCertExtensions with owner and repo", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "foo", "owner", "owner/repo")
-		require.NoError(t, err)
-	})
-
-	t.Run("VerifyCertExtensions with owner and repo, no tenant", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "", "owner", "owner/repo")
-		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://github.com/owner, got https://foo.ghe.com/owner")
-	})
-
-	t.Run("VerifyCertExtensions with owner and repo, wrong tenant", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "bar", "owner", "owner/repo")
-		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://bar.ghe.com/owner, got https://foo.ghe.com/owner")
-	})
-
-	t.Run("VerifyCertExtensions with owner", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "foo", "owner", "")
-		require.NoError(t, err)
-	})
-
-	t.Run("VerifyCertExtensions with wrong owner", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "foo", "wrong", "")
-		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://foo.ghe.com/wrong, got https://foo.ghe.com/owner")
-	})
-
-	t.Run("VerifyCertExtensions with wrong repo", func(t *testing.T) {
-		err := VerifyCertExtensions(results, "foo", "owner", "wrong")
-		require.ErrorContains(t, err, "expected SourceRepositoryURI to be https://foo.ghe.com/wrong, got https://foo.ghe.com/owner/repo")
-	})
-}
diff --git a/pkg/cmd/attestation/verification/sigstore.go b/pkg/cmd/attestation/verification/sigstore.go
index 927eacf49..9a4ac5194 100644
--- a/pkg/cmd/attestation/verification/sigstore.go
+++ b/pkg/cmd/attestation/verification/sigstore.go
@@ -36,8 +36,6 @@ type SigstoreConfig struct {
 	TrustedRoot  string
 	Logger       *io.Handler
 	NoPublicGood bool
-	// If tenancy mode is not used, trust domain is empty
-	TrustDomain string
 }
 
 type SigstoreVerifier interface {
@@ -146,7 +144,7 @@ func (v *LiveSigstoreVerifier) chooseVerifier(b *bundle.Bundle) (*verify.SignedE
 
 		return publicGoodVerifier, issuer, nil
 	} else if leafCert.Issuer.Organization[0] == GitHubIssuerOrg || v.config.NoPublicGood {
-		ghVerifier, err := newGitHubVerifier(v.config.TrustDomain)
+		ghVerifier, err := newGitHubVerifier()
 		if err != nil {
 			return nil, "", fmt.Errorf("failed to create GitHub Sigstore verifier: %v", err)
 		}
@@ -242,25 +240,13 @@ func newCustomVerifier(trustedRoot *root.TrustedRoot) (*verify.SignedEntityVerif
 	return gv, nil
 }
 
-func newGitHubVerifier(trustDomain string) (*verify.SignedEntityVerifier, error) {
-	var tr string
-
+func newGitHubVerifier() (*verify.SignedEntityVerifier, error) {
 	opts := GitHubTUFOptions()
 	client, err := tuf.New(opts)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create TUF client: %v", err)
 	}
-
-	if trustDomain == "" {
-		tr = "trusted_root.json"
-	} else {
-		tr = fmt.Sprintf("%s.trusted_root.json", trustDomain)
-	}
-	jsonBytes, err := client.GetTarget(tr)
-	if err != nil {
-		return nil, err
-	}
-	trustedRoot, err := root.NewTrustedRootFromJSON(jsonBytes)
+	trustedRoot, err := root.GetTrustedRoot(client)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/cmd/attestation/verify/options.go b/pkg/cmd/attestation/verify/options.go
index 126159023..3ec2d49f1 100644
--- a/pkg/cmd/attestation/verify/options.go
+++ b/pkg/cmd/attestation/verify/options.go
@@ -6,7 +6,6 @@ import (
 	"strings"
 
 	"github.com/cli/cli/v2/internal/gh"
-	"github.com/cli/cli/v2/internal/ghinstance"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/artifact/oci"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/io"
@@ -38,9 +37,6 @@ type Options struct {
 	OCIClient             oci.Client
 	SigstoreVerifier      verification.SigstoreVerifier
 	exporter              cmdutil.Exporter
-	Hostname              string
-	// Tenant is only set when tenancy is used
-	Tenant string
 }
 
 // Clean cleans the file path option values
@@ -61,12 +57,12 @@ func (opts *Options) SetPolicyFlags() {
 		opts.Owner = splitRepo[0]
 
 		if !isSignerIdentityProvided(opts) {
-			opts.SANRegex = expandToGitHubURL(opts.Tenant, opts.Repo)
+			opts.SANRegex = expandToGitHubURL(opts.Repo)
 		}
 		return
 	}
 	if !isSignerIdentityProvided(opts) {
-		opts.SANRegex = expandToGitHubURL(opts.Tenant, opts.Owner)
+		opts.SANRegex = expandToGitHubURL(opts.Owner)
 	}
 }
 
@@ -98,13 +94,6 @@ func (opts *Options) AreFlagsValid() error {
 		return fmt.Errorf("bundle-from-oci flag cannot be used with bundle-path flag")
 	}
 
-	// Verify provided hostname
-	if opts.Hostname != "" {
-		if err := ghinstance.HostnameValidator(opts.Hostname); err != nil {
-			return fmt.Errorf("error parsing hostname: %w", err)
-		}
-	}
-
 	return nil
 }
 
diff --git a/pkg/cmd/attestation/verify/policy.go b/pkg/cmd/attestation/verify/policy.go
index 0c7a686c2..4d850ddcc 100644
--- a/pkg/cmd/attestation/verify/policy.go
+++ b/pkg/cmd/attestation/verify/policy.go
@@ -1,8 +1,8 @@
 package verify
 
 import (
-	"errors"
 	"fmt"
+	"os"
 	"regexp"
 
 	"github.com/sigstore/sigstore-go/pkg/fulcio/certificate"
@@ -13,23 +13,21 @@ import (
 )
 
 const (
-	GitHubOIDCIssuer       = "https://token.actions.githubusercontent.com"
-	GitHubTenantOIDCIssuer = "https://token.actions.%s.ghe.com"
+	GitHubOIDCIssuer = "https://token.actions.githubusercontent.com"
 	// represents the GitHub hosted runner in the certificate RunnerEnvironment extension
 	GitHubRunner = "github-hosted"
+	githubHost   = "github.com"
 	hostRegex    = `^[a-zA-Z0-9-]+\.[a-zA-Z0-9-]+.*$`
 )
 
-func expandToGitHubURL(tenant, ownerOrRepo string) string {
-	if tenant == "" {
-		return fmt.Sprintf("(?i)^https://github.com/%s/", ownerOrRepo)
-	}
-	return fmt.Sprintf("(?i)^https://%s.ghe.com/%s/", tenant, ownerOrRepo)
+func expandToGitHubURL(ownerOrRepo string) string {
+	// TODO: handle proxima prefix
+	return fmt.Sprintf("(?i)^https://github.com/%s/", ownerOrRepo)
 }
 
 func buildSANMatcher(opts *Options) (verify.SubjectAlternativeNameMatcher, error) {
 	if opts.SignerRepo != "" {
-		signedRepoRegex := expandToGitHubURL(opts.Tenant, opts.SignerRepo)
+		signedRepoRegex := expandToGitHubURL(opts.SignerRepo)
 		return verify.NewSANMatcher("", signedRepoRegex)
 	} else if opts.SignerWorkflow != "" {
 		validatedWorkflowRegex, err := validateSignerWorkflow(opts)
@@ -120,9 +118,37 @@ func validateSignerWorkflow(opts *Options) (string, error) {
 		return addSchemeToRegex(opts.SignerWorkflow), nil
 	}
 
-	if opts.Hostname == "" {
-		return "", errors.New("unknown host")
+	// if the provided workflow does not contain a host, check for a host
+	// and prepend it to the workflow
+	host, err := chooseHost(opts)
+	if err != nil {
+		return "", err
+	}
+
+	return addSchemeToRegex(fmt.Sprintf("%s/%s", host, opts.SignerWorkflow)), nil
+}
+
+// if a host was not provided as part of a flag argument choose a host based
+// on gh cli configuration
+func chooseHost(opts *Options) (string, error) {
+	// check if GH_HOST is set and use that host if it is
+	host := os.Getenv("GH_HOST")
+	if host != "" {
+		return host, nil
+	}
+
+	// check if the CLI is authenticated with any hosts
+	cfg, err := opts.Config()
+	if err != nil {
+		return "", err
+	}
+
+	// if authenticated, return the authenticated host
+	authCfg := cfg.Authentication()
+	if host, _ := authCfg.DefaultHost(); host != "" {
+		return host, nil
 	}
 
-	return addSchemeToRegex(fmt.Sprintf("%s/%s", opts.Hostname, opts.SignerWorkflow)), nil
+	// if not authenticated, return the default host github.com
+	return githubHost, nil
 }
diff --git a/pkg/cmd/attestation/verify/policy_test.go b/pkg/cmd/attestation/verify/policy_test.go
index 89f989b45..40435d19e 100644
--- a/pkg/cmd/attestation/verify/policy_test.go
+++ b/pkg/cmd/attestation/verify/policy_test.go
@@ -1,6 +1,7 @@
 package verify
 
 import (
+	"os"
 	"testing"
 
 	"github.com/cli/cli/v2/pkg/cmd/attestation/artifact"
@@ -31,12 +32,13 @@ func TestBuildPolicy(t *testing.T) {
 	require.NoError(t, err)
 }
 
-func TestValidateSignerWorkflow(t *testing.T) {
+func ValidateSignerWorkflow(t *testing.T) {
 	type testcase struct {
 		name                   string
 		providedSignerWorkflow string
 		expectedWorkflowRegex  string
-		host                   string
+		ghHost                 string
+		authHost               string
 	}
 
 	testcases := []testcase{
@@ -54,19 +56,13 @@ func TestValidateSignerWorkflow(t *testing.T) {
 			name:                   "workflow with GH_HOST set",
 			providedSignerWorkflow: "github/artifact-attestations-workflows/.github/workflows/attest.yml",
 			expectedWorkflowRegex:  "^https://myhost.github.com/github/artifact-attestations-workflows/.github/workflows/attest.yml",
-			host:                   "myhost.github.com",
+			ghHost:                 "myhost.github.com",
 		},
 		{
 			name:                   "workflow with authenticated host",
 			providedSignerWorkflow: "github/artifact-attestations-workflows/.github/workflows/attest.yml",
 			expectedWorkflowRegex:  "^https://authedhost.github.com/github/artifact-attestations-workflows/.github/workflows/attest.yml",
-			host:                   "authedhost.github.com",
-		},
-		{
-			name:                   "workflow with authenticated host",
-			providedSignerWorkflow: "github/artifact-attestations-workflows/.github/workflows/attest.yml",
-			expectedWorkflowRegex:  "^https://authedhost.github.com/github/artifact-attestations-workflows/.github/workflows/attest.yml",
-			host:                   "authedhost.github.com",
+			authHost:               "authedhost.github.com",
 		},
 	}
 
@@ -78,29 +74,22 @@ func TestValidateSignerWorkflow(t *testing.T) {
 			SignerWorkflow: tc.providedSignerWorkflow,
 		}
 
-		// All host resolution is done verify.go:RunE
-		if tc.host == "" {
-			// Set to default host
-			tc.host = "github.com"
+		if tc.ghHost != "" {
+			err := os.Setenv("GH_HOST", tc.ghHost)
+			require.NoError(t, err)
+		}
+
+		if tc.authHost != "" {
+			cfg, err := opts.Config()
+			require.NoError(t, err)
+
+			// if authenticated, return the authenticated host
+			authCfg := cfg.Authentication()
+			authCfg.SetDefaultHost(tc.authHost, "")
 		}
-		opts.Hostname = tc.host
 
 		workflowRegex, err := validateSignerWorkflow(opts)
 		require.NoError(t, err)
 		require.Equal(t, tc.expectedWorkflowRegex, workflowRegex)
-
 	}
 }
-
-func TestValidateSignerWorkflowNoHost(t *testing.T) {
-	cmdFactory := factory.New("test")
-	opts := &Options{
-		Config:         cmdFactory.Config,
-		SignerWorkflow: "github/artifact-attestations-workflows/.github/workflows/attest.yml",
-	}
-
-	workflowRegex, err := validateSignerWorkflow(opts)
-	require.Error(t, err)
-	require.ErrorContains(t, err, "unknown host")
-	require.Equal(t, "", workflowRegex)
-}
diff --git a/pkg/cmd/attestation/verify/verify.go b/pkg/cmd/attestation/verify/verify.go
index 9e508e994..055636ad5 100644
--- a/pkg/cmd/attestation/verify/verify.go
+++ b/pkg/cmd/attestation/verify/verify.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"regexp"
 
-	"github.com/cli/cli/v2/internal/ghinstance"
 	"github.com/cli/cli/v2/internal/text"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/api"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/artifact"
@@ -14,7 +13,6 @@ import (
 	"github.com/cli/cli/v2/pkg/cmd/attestation/io"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/verification"
 	"github.com/cli/cli/v2/pkg/cmdutil"
-	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 
 	"github.com/MakeNowJust/heredoc"
 	"github.com/spf13/cobra"
@@ -111,6 +109,9 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 			// Clean file path options
 			opts.Clean()
 
+			// set policy flags based on what has been provided
+			opts.SetPolicyFlags()
+
 			return nil
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -118,18 +119,17 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 			if err != nil {
 				return err
 			}
+			opts.APIClient = api.NewLiveClient(hc, opts.Logger)
 
 			opts.OCIClient = oci.NewLiveClient()
 
-			if opts.Hostname == "" {
-				opts.Hostname, _ = ghauth.DefaultHost()
-			}
-			err = auth.IsHostSupported(opts.Hostname)
-			if err != nil {
+			if err := auth.IsHostSupported(); err != nil {
 				return err
 			}
 
-			opts.APIClient = api.NewLiveClient(hc, opts.Hostname, opts.Logger)
+			if runF != nil {
+				return runF(opts)
+			}
 
 			config := verification.SigstoreConfig{
 				TrustedRoot:  opts.TrustedRoot,
@@ -137,30 +137,6 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 				NoPublicGood: opts.NoPublicGood,
 			}
 
-			// Prepare for tenancy if detected
-			if ghinstance.IsTenancy(opts.Hostname) {
-				td, err := opts.APIClient.GetTrustDomain()
-				if err != nil {
-					return fmt.Errorf("error getting trust domain, make sure you are authenticated against the host: %w", err)
-				}
-
-				tenant, found := ghinstance.TenantName(opts.Hostname)
-				if !found {
-					return fmt.Errorf("invalid hostname provided: '%s'",
-						opts.Hostname)
-				}
-				config.TrustDomain = td
-				opts.Tenant = tenant
-				opts.OIDCIssuer = fmt.Sprintf(GitHubTenantOIDCIssuer, tenant)
-			}
-
-			// set policy flags based on what has been provided
-			opts.SetPolicyFlags()
-
-			if runF != nil {
-				return runF(opts)
-			}
-
 			opts.SigstoreVerifier = verification.NewLiveSigstoreVerifier(config)
 			opts.Config = f.Config
 
@@ -193,7 +169,6 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
 	verifyCmd.Flags().StringVarP(&opts.SignerWorkflow, "signer-workflow", "", "", "Workflow that signed attestation in the format [host/]<owner>/<repo>/<path>/<to>/<workflow>")
 	verifyCmd.MarkFlagsMutuallyExclusive("cert-identity", "cert-identity-regex", "signer-repo", "signer-workflow")
 	verifyCmd.Flags().StringVarP(&opts.OIDCIssuer, "cert-oidc-issuer", "", GitHubOIDCIssuer, "Issuer of the OIDC token")
-	verifyCmd.Flags().StringVarP(&opts.Hostname, "hostname", "", "", "Configure host to use")
 
 	return verifyCmd
 }
@@ -269,7 +244,7 @@ func runVerify(opts *Options) error {
 	}
 
 	// Verify extensions
-	if err := verification.VerifyCertExtensions(sigstoreRes.VerifyResults, opts.Tenant, opts.Owner, opts.Repo); err != nil {
+	if err := verification.VerifyCertExtensions(sigstoreRes.VerifyResults, opts.Owner, opts.Repo); err != nil {
 		opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Verification failed"))
 		return err
 	}
@@ -289,7 +264,7 @@ func runVerify(opts *Options) error {
 	opts.Logger.Printf("%s was attested by:\n", artifact.DigestWithAlg())
 
 	// Otherwise print the results to the terminal in a table
-	tableContent, err := buildTableVerifyContent(opts.Tenant, sigstoreRes.VerifyResults)
+	tableContent, err := buildTableVerifyContent(sigstoreRes.VerifyResults)
 	if err != nil {
 		opts.Logger.Println(opts.Logger.ColorScheme.Red("failed to parse results"))
 		return err
@@ -305,44 +280,30 @@ func runVerify(opts *Options) error {
 	return nil
 }
 
-func extractAttestationDetail(tenant, builderSignerURI string) (string, string, error) {
+func extractAttestationDetail(builderSignerURI string) (string, string, error) {
 	// If given a build signer URI like
 	// https://github.com/foo/bar/.github/workflows/release.yml@refs/heads/main
 	// We want to extract:
 	// * foo/bar
 	// * .github/workflows/release.yml@refs/heads/main
-	var orgAndRepoRegexp *regexp.Regexp
-	var workflowRegexp *regexp.Regexp
-
-	if tenant == "" {
-		orgAndRepoRegexp = regexp.MustCompile(`https://github\.com/([^/]+/[^/]+)/`)
-		workflowRegexp = regexp.MustCompile(`https://github\.com/[^/]+/[^/]+/(.+)`)
-	} else {
-		var tr = regexp.QuoteMeta(tenant)
-		orgAndRepoRegexp = regexp.MustCompile(fmt.Sprintf(
-			`https://%s\.ghe\.com/([^/]+/[^/]+)/`,
-			tr))
-		workflowRegexp = regexp.MustCompile(fmt.Sprintf(
-			`https://%s\.ghe\.com/[^/]+/[^/]+/(.+)`,
-			tr))
-	}
-
+	orgAndRepoRegexp := regexp.MustCompile(`https://github\.com/([^/]+/[^/]+)/`)
 	match := orgAndRepoRegexp.FindStringSubmatch(builderSignerURI)
 	if len(match) < 2 {
 		return "", "", fmt.Errorf("no match found for org and repo")
 	}
-	orgAndRepo := match[1]
+	repoAndOrg := match[1]
 
+	workflowRegexp := regexp.MustCompile(`https://github\.com/[^/]+/[^/]+/(.+)`)
 	match = workflowRegexp.FindStringSubmatch(builderSignerURI)
 	if len(match) < 2 {
 		return "", "", fmt.Errorf("no match found for workflow")
 	}
 	workflow := match[1]
 
-	return orgAndRepo, workflow, nil
+	return repoAndOrg, workflow, nil
 }
 
-func buildTableVerifyContent(tenant string, results []*verification.AttestationProcessingResult) ([][]string, error) {
+func buildTableVerifyContent(results []*verification.AttestationProcessingResult) ([][]string, error) {
 	content := make([][]string, len(results))
 
 	for i, res := range results {
@@ -352,7 +313,7 @@ func buildTableVerifyContent(tenant string, results []*verification.AttestationP
 			return nil, fmt.Errorf("bundle missing verification result fields")
 		}
 		builderSignerURI := res.VerificationResult.Signature.Certificate.Extensions.BuildSignerURI
-		repoAndOrg, workflow, err := extractAttestationDetail(tenant, builderSignerURI)
+		repoAndOrg, workflow, err := extractAttestationDetail(builderSignerURI)
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/cmd/attestation/verify/verify_integration_test.go b/pkg/cmd/attestation/verify/verify_integration_test.go
index df24b31c4..9ad7a87a3 100644
--- a/pkg/cmd/attestation/verify/verify_integration_test.go
+++ b/pkg/cmd/attestation/verify/verify_integration_test.go
@@ -11,7 +11,6 @@ import (
 	"github.com/cli/cli/v2/pkg/cmd/attestation/test"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/verification"
 	"github.com/cli/cli/v2/pkg/cmd/factory"
-	"github.com/cli/go-gh/v2/pkg/auth"
 	"github.com/stretchr/testify/require"
 )
 
@@ -29,10 +28,8 @@ func TestVerifyIntegration(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	host, _ := auth.DefaultHost()
-
 	publicGoodOpts := Options{
-		APIClient:        api.NewLiveClient(hc, host, logger),
+		APIClient:        api.NewLiveClient(hc, logger),
 		ArtifactPath:     artifactPath,
 		BundlePath:       bundlePath,
 		DigestAlgorithm:  "sha512",
@@ -85,75 +82,6 @@ func TestVerifyIntegration(t *testing.T) {
 	})
 }
 
-func TestVerifyIntegrationCustomIssuer(t *testing.T) {
-	artifactPath := test.NormalizeRelativePath("../test/data/custom-issuer-artifact")
-	bundlePath := test.NormalizeRelativePath("../test/data/custom-issuer.sigstore.json")
-
-	logger := io.NewTestHandler()
-
-	sigstoreConfig := verification.SigstoreConfig{
-		Logger: logger,
-	}
-
-	cmdFactory := factory.New("test")
-
-	hc, err := cmdFactory.HttpClient()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	host, _ := auth.DefaultHost()
-
-	baseOpts := Options{
-		APIClient:        api.NewLiveClient(hc, host, logger),
-		ArtifactPath:     artifactPath,
-		BundlePath:       bundlePath,
-		DigestAlgorithm:  "sha256",
-		Logger:           logger,
-		OCIClient:        oci.NewLiveClient(),
-		OIDCIssuer:       "https://token.actions.githubusercontent.com/hammer-time",
-		SigstoreVerifier: verification.NewLiveSigstoreVerifier(sigstoreConfig),
-	}
-
-	t.Run("with owner and valid workflow SAN", func(t *testing.T) {
-		opts := baseOpts
-		opts.Owner = "too-legit"
-		opts.SAN = "https://github.com/too-legit/attest/.github/workflows/integration.yml@refs/heads/main"
-
-		err := runVerify(&opts)
-		require.NoError(t, err)
-	})
-
-	t.Run("with owner and valid workflow SAN regex", func(t *testing.T) {
-		opts := baseOpts
-		opts.Owner = "too-legit"
-		opts.SANRegex = "^https://github.com/too-legit/attest"
-
-		err := runVerify(&opts)
-		require.NoError(t, err)
-	})
-
-	t.Run("with repo and valid workflow SAN", func(t *testing.T) {
-		opts := baseOpts
-		opts.Owner = "too-legit"
-		opts.Repo = "too-legit/attest"
-		opts.SAN = "https://github.com/too-legit/attest/.github/workflows/integration.yml@refs/heads/main"
-
-		err := runVerify(&opts)
-		require.NoError(t, err)
-	})
-
-	t.Run("with repo and valid workflow SAN regex", func(t *testing.T) {
-		opts := baseOpts
-		opts.Owner = "too-legit"
-		opts.Repo = "too-legit/attest"
-		opts.SANRegex = "^https://github.com/too-legit/attest"
-
-		err := runVerify(&opts)
-		require.NoError(t, err)
-	})
-}
-
 func TestVerifyIntegrationReusableWorkflow(t *testing.T) {
 	artifactPath := test.NormalizeRelativePath("../test/data/reusable-workflow-artifact")
 	bundlePath := test.NormalizeRelativePath("../test/data/reusable-workflow-attestation.sigstore.json")
@@ -171,10 +99,8 @@ func TestVerifyIntegrationReusableWorkflow(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	host, _ := auth.DefaultHost()
-
 	baseOpts := Options{
-		APIClient:        api.NewLiveClient(hc, host, logger),
+		APIClient:        api.NewLiveClient(hc, logger),
 		ArtifactPath:     artifactPath,
 		BundlePath:       bundlePath,
 		DigestAlgorithm:  "sha256",
@@ -259,10 +185,8 @@ func TestVerifyIntegrationReusableWorkflowSignerWorkflow(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	host, _ := auth.DefaultHost()
-
 	baseOpts := Options{
-		APIClient:        api.NewLiveClient(hc, host, logger),
+		APIClient:        api.NewLiveClient(hc, logger),
 		ArtifactPath:     artifactPath,
 		BundlePath:       bundlePath,
 		Config:           cmdFactory.Config,
@@ -279,7 +203,6 @@ func TestVerifyIntegrationReusableWorkflowSignerWorkflow(t *testing.T) {
 		name           string
 		signerWorkflow string
 		expectErr      bool
-		host           string
 	}
 
 	testcases := []testcase{
@@ -297,14 +220,12 @@ func TestVerifyIntegrationReusableWorkflowSignerWorkflow(t *testing.T) {
 			name:           "valid signer workflow without host (defaults to github.com)",
 			signerWorkflow: "github/artifact-attestations-workflows/.github/workflows/attest.yml",
 			expectErr:      false,
-			host:           "github.com",
 		},
 	}
 
 	for _, tc := range testcases {
 		opts := baseOpts
 		opts.SignerWorkflow = tc.signerWorkflow
-		opts.Hostname = tc.host
 
 		err := runVerify(&opts)
 		if tc.expectErr {
diff --git a/pkg/cmd/attestation/verify/verify_test.go b/pkg/cmd/attestation/verify/verify_test.go
index 6f71b537f..89c5ae7c1 100644
--- a/pkg/cmd/attestation/verify/verify_test.go
+++ b/pkg/cmd/attestation/verify/verify_test.go
@@ -35,21 +35,10 @@ var (
 
 func TestNewVerifyCmd(t *testing.T) {
 	testIO, _, _, _ := iostreams.Test()
-	var testReg httpmock.Registry
-	var metaResp = api.MetaResponse{
-		Domains: api.Domain{
-			ArtifactAttestations: api.ArtifactAttestations{
-				TrustDomain: "foo",
-			},
-		},
-	}
-	testReg.Register(httpmock.REST(http.MethodGet, "api/v3/meta"),
-		httpmock.StatusJSONResponse(200, &metaResp))
-
 	f := &cmdutil.Factory{
 		IOStreams: testIO,
 		HttpClient: func() (*http.Client, error) {
-			reg := &testReg
+			reg := &httpmock.Registry{}
 			client := &http.Client{}
 			httpmock.ReplaceTripper(client, reg)
 			return client, nil
@@ -74,7 +63,6 @@ func TestNewVerifyCmd(t *testing.T) {
 				OIDCIssuer:       GitHubOIDCIssuer,
 				Owner:            "sigstore",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -90,42 +78,9 @@ func TestNewVerifyCmd(t *testing.T) {
 				Owner:            "sigstore",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
-			},
-			wantsErr: false,
-		},
-		{
-			name: "Custom host",
-			cli:  fmt.Sprintf("%s --bundle %s --owner sigstore --hostname foo.ghe.com", artifactPath, bundlePath),
-			wants: Options{
-				ArtifactPath:     test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0.tgz"),
-				BundlePath:       test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json"),
-				DigestAlgorithm:  "sha256",
-				Limit:            30,
-				OIDCIssuer:       "https://token.actions.foo.ghe.com",
-				Owner:            "sigstore",
-				SANRegex:         "(?i)^https://foo.ghe.com/sigstore/",
-				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "foo.ghe.com",
 			},
 			wantsErr: false,
 		},
-		{
-			name: "Invalid custom host",
-			cli:  fmt.Sprintf("%s --bundle %s --owner sigstore --hostname foo.bar.com", artifactPath, bundlePath),
-			wants: Options{
-				ArtifactPath:     test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0.tgz"),
-				BundlePath:       test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json"),
-				DigestAlgorithm:  "sha256",
-				Limit:            30,
-				OIDCIssuer:       GitHubOIDCIssuer,
-				Owner:            "sigstore",
-				SANRegex:         "(?i)^https://github.com/sigstore/",
-				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "foo.ghe.com",
-			},
-			wantsErr: true,
-		},
 		{
 			name: "Use custom digest-alg value",
 			cli:  fmt.Sprintf("%s --bundle %s --owner sigstore --digest-alg sha512", artifactPath, bundlePath),
@@ -138,7 +93,6 @@ func TestNewVerifyCmd(t *testing.T) {
 				Owner:            "sigstore",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: false,
 		},
@@ -153,7 +107,6 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            30,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -168,7 +121,6 @@ func TestNewVerifyCmd(t *testing.T) {
 				Repo:             "sigstore/sigstore-js",
 				Limit:            30,
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -183,7 +135,6 @@ func TestNewVerifyCmd(t *testing.T) {
 				Owner:            "sigstore",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: false,
 		},
@@ -198,7 +149,6 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            101,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: false,
 		},
@@ -213,7 +163,6 @@ func TestNewVerifyCmd(t *testing.T) {
 				Limit:            0,
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -229,7 +178,6 @@ func TestNewVerifyCmd(t *testing.T) {
 				SAN:              "https://github.com/sigstore/",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsErr: true,
 		},
@@ -245,7 +193,6 @@ func TestNewVerifyCmd(t *testing.T) {
 				Owner:            "sigstore",
 				SANRegex:         "(?i)^https://github.com/sigstore/",
 				SigstoreVerifier: verification.NewMockSigstoreVerifier(t),
-				Hostname:         "github.com",
 			},
 			wantsExporter: true,
 		},
@@ -283,7 +230,6 @@ func TestNewVerifyCmd(t *testing.T) {
 			assert.Equal(t, tc.wants.Repo, opts.Repo)
 			assert.Equal(t, tc.wants.SAN, opts.SAN)
 			assert.Equal(t, tc.wants.SANRegex, opts.SANRegex)
-			assert.Equal(t, tc.wants.Hostname, opts.Hostname)
 			assert.NotNil(t, opts.APIClient)
 			assert.NotNil(t, opts.Logger)
 			assert.NotNil(t, opts.OCIClient)
@@ -411,17 +357,6 @@ func TestRunVerify(t *testing.T) {
 		require.Nil(t, runVerify(&opts))
 	})
 
-	// Test with bad tenancy
-	t.Run("with bad tenancy", func(t *testing.T) {
-		opts := publicGoodOpts
-		opts.BundlePath = ""
-		opts.Repo = "sigstore/sigstore-js"
-		opts.Tenant = "foo"
-
-		err := runVerify(&opts)
-		require.ErrorContains(t, err, "expected SourceRepositoryOwnerURI to be https://foo.ghe.com/sigstore, got https://github.com/sigstore")
-	})
-
 	t.Run("with repo which not matches SourceRepositoryURI", func(t *testing.T) {
 		opts := publicGoodOpts
 		opts.BundlePath = ""
diff --git a/pkg/cmd/auth/status/status_test.go b/pkg/cmd/auth/status/status_test.go
index 3f16baf46..03c26ca04 100644
--- a/pkg/cmd/auth/status/status_test.go
+++ b/pkg/cmd/auth/status/status_test.go
@@ -44,13 +44,6 @@ func Test_NewCmdStatus(t *testing.T) {
 				ShowToken: true,
 			},
 		},
-		{
-			name: "active",
-			cli:  "--active",
-			wants: StatusOptions{
-				Active: true,
-			},
-		},
 	}
 
 	for _, tt := range tests {
@@ -389,14 +382,14 @@ func Test_statusRun(t *testing.T) {
 		{
 			name: "multiple hosts with multiple accounts with environment tokens and with errors",
 			opts: StatusOptions{},
-			env:  map[string]string{"GH_ENTERPRISE_TOKEN": "gho_abc123"}, // monalisa-ghe-2
+			env:  map[string]string{"GH_ENTERPRISE_TOKEN": "gho_abc123"},
 			cfgStubs: func(t *testing.T, c gh.Config) {
 				login(t, c, "github.com", "monalisa", "gho_def456", "https")
 				login(t, c, "github.com", "monalisa-2", "gho_ghi789", "https")
 				login(t, c, "ghe.io", "monalisa-ghe", "gho_xyz123", "ssh")
 			},
 			httpStubs: func(reg *httpmock.Registry) {
-				// Get scopes for monalisa-2
+				// Get scopes for monalia-2
 				reg.Register(httpmock.REST("GET", ""), httpmock.ScopesResponder("repo,read:org"))
 				// Get scopes for monalisa
 				reg.Register(httpmock.REST("GET", ""), httpmock.ScopesResponder("repo"))
@@ -440,94 +433,6 @@ func Test_statusRun(t *testing.T) {
 				  - To forget about this account, run: gh auth logout -h ghe.io -u monalisa-ghe
 			`),
 		},
-		{
-			name: "multiple accounts on a host, only active users",
-			opts: StatusOptions{
-				Active: true,
-			},
-			cfgStubs: func(t *testing.T, c gh.Config) {
-				login(t, c, "github.com", "monalisa", "gho_abc123", "https")
-				login(t, c, "github.com", "monalisa-2", "gho_abc123", "https")
-			},
-			httpStubs: func(reg *httpmock.Registry) {
-				reg.Register(httpmock.REST("GET", ""), httpmock.ScopesResponder("repo,read:org"))
-			},
-			wantOut: heredoc.Doc(`
-				github.com
-				  ✓ Logged in to github.com account monalisa-2 (GH_CONFIG_DIR/hosts.yml)
-				  - Active account: true
-				  - Git operations protocol: https
-				  - Token: gho_******
-				  - Token scopes: 'repo', 'read:org'
-			`),
-		},
-		{
-			name: "multiple hosts with multiple accounts, only active users",
-			opts: StatusOptions{
-				Active: true,
-			},
-			cfgStubs: func(t *testing.T, c gh.Config) {
-				login(t, c, "github.com", "monalisa", "gho_abc123", "https")
-				login(t, c, "github.com", "monalisa-2", "gho_abc123", "https")
-				login(t, c, "ghe.io", "monalisa-ghe", "gho_abc123", "ssh")
-				login(t, c, "ghe.io", "monalisa-ghe-2", "gho_abc123", "ssh")
-			},
-			httpStubs: func(reg *httpmock.Registry) {
-				// Get scopes for monalisa-2
-				reg.Register(httpmock.REST("GET", ""), httpmock.ScopesResponder("repo,read:org"))
-				// Get scopes for monalisa-ghe-2
-				reg.Register(httpmock.REST("GET", "api/v3/"), httpmock.ScopesResponder("repo,read:org"))
-			},
-			wantOut: heredoc.Doc(`
-				github.com
-				  ✓ Logged in to github.com account monalisa-2 (GH_CONFIG_DIR/hosts.yml)
-				  - Active account: true
-				  - Git operations protocol: https
-				  - Token: gho_******
-				  - Token scopes: 'repo', 'read:org'
-
-				ghe.io
-				  ✓ Logged in to ghe.io account monalisa-ghe-2 (GH_CONFIG_DIR/hosts.yml)
-				  - Active account: true
-				  - Git operations protocol: ssh
-				  - Token: gho_******
-				  - Token scopes: 'repo', 'read:org'
-			`),
-		},
-		{
-			name: "multiple hosts with multiple accounts, only active users with errors",
-			opts: StatusOptions{
-				Active: true,
-			},
-			cfgStubs: func(t *testing.T, c gh.Config) {
-				login(t, c, "github.com", "monalisa", "gho_abc123", "https")
-				login(t, c, "github.com", "monalisa-2", "gho_abc123", "https")
-				login(t, c, "ghe.io", "monalisa-ghe", "gho_abc123", "ssh")
-				login(t, c, "ghe.io", "monalisa-ghe-2", "gho_abc123", "ssh")
-			},
-			httpStubs: func(reg *httpmock.Registry) {
-				// Get scopes for monalisa-2
-				reg.Register(httpmock.REST("GET", ""), httpmock.ScopesResponder("repo,read:org"))
-				// Error getting scopes for monalisa-ghe-2
-				reg.Register(httpmock.REST("GET", "api/v3/"), httpmock.StatusStringResponse(404, "{}"))
-			},
-			wantErr: cmdutil.SilentError,
-			wantErrOut: heredoc.Doc(`
-				github.com
-				  ✓ Logged in to github.com account monalisa-2 (GH_CONFIG_DIR/hosts.yml)
-				  - Active account: true
-				  - Git operations protocol: https
-				  - Token: gho_******
-				  - Token scopes: 'repo', 'read:org'
-
-				ghe.io
-				  X Failed to log in to ghe.io account monalisa-ghe-2 (GH_CONFIG_DIR/hosts.yml)
-				  - Active account: true
-				  - The token in GH_CONFIG_DIR/hosts.yml is invalid.
-				  - To re-authenticate, run: gh auth login -h ghe.io
-				  - To forget about this account, run: gh auth logout -h ghe.io -u monalisa-ghe-2
-			`),
-		},
 	}
 
 	for _, tt := range tests {
diff --git a/pkg/cmd/extension/manager_test.go b/pkg/cmd/extension/manager_test.go
index 6d9b63124..5de4e15cb 100644
--- a/pkg/cmd/extension/manager_test.go
+++ b/pkg/cmd/extension/manager_test.go
@@ -912,6 +912,58 @@ func TestManager_Install_binary_unsupported(t *testing.T) {
 	assert.Equal(t, "", stderr.String())
 }
 
+func TestManager_Install_rosetta_fallback_not_found(t *testing.T) {
+	repo := ghrepo.NewWithHost("owner", "gh-bin-ext", "example.com")
+
+	reg := httpmock.Registry{}
+	defer reg.Verify(t)
+	client := http.Client{Transport: &reg}
+
+	reg.Register(
+		httpmock.REST("GET", "api/v3/repos/owner/gh-bin-ext/releases/latest"),
+		httpmock.JSONResponse(
+			release{
+				Assets: []releaseAsset{
+					{
+						Name:   "gh-bin-ext-darwin-amd64",
+						APIURL: "https://example.com/release/cool",
+					},
+				},
+			}))
+	reg.Register(
+		httpmock.REST("GET", "api/v3/repos/owner/gh-bin-ext/releases/latest"),
+		httpmock.JSONResponse(
+			release{
+				Tag: "v1.0.1",
+				Assets: []releaseAsset{
+					{
+						Name:   "gh-bin-ext-darwin-amd64",
+						APIURL: "https://example.com/release/cool",
+					},
+				},
+			}))
+
+	ios, _, stdout, stderr := iostreams.Test()
+	tempDir := t.TempDir()
+
+	m := newTestManager(tempDir, &client, nil, ios)
+	m.platform = func() (string, string) {
+		return "darwin-arm64", ""
+	}
+
+	originalHasRosetta := hasRosetta
+	t.Cleanup(func() { hasRosetta = originalHasRosetta })
+	hasRosetta = func() bool {
+		return false
+	}
+
+	err := m.Install(repo, "")
+	assert.EqualError(t, err, "gh-bin-ext unsupported for darwin-arm64. Install Rosetta with `softwareupdate --install-rosetta` to use the available darwin-amd64 binary, or open an issue: `gh issue create -R owner/gh-bin-ext -t'Support darwin-arm64'`")
+
+	assert.Equal(t, "", stdout.String())
+	assert.Equal(t, "", stderr.String())
+}
+
 func TestManager_Install_binary(t *testing.T) {
 	repo := ghrepo.NewWithHost("owner", "gh-bin-ext", "example.com")
 
@@ -976,6 +1028,80 @@ func TestManager_Install_binary(t *testing.T) {
 	assert.Equal(t, "", stderr.String())
 }
 
+func TestManager_Install_amd64_when_supported(t *testing.T) {
+	repo := ghrepo.NewWithHost("owner", "gh-bin-ext", "example.com")
+
+	reg := httpmock.Registry{}
+	defer reg.Verify(t)
+	client := http.Client{Transport: &reg}
+
+	reg.Register(
+		httpmock.REST("GET", "api/v3/repos/owner/gh-bin-ext/releases/latest"),
+		httpmock.JSONResponse(
+			release{
+				Assets: []releaseAsset{
+					{
+						Name:   "gh-bin-ext-darwin-amd64",
+						APIURL: "https://example.com/release/cool",
+					},
+				},
+			}))
+	reg.Register(
+		httpmock.REST("GET", "api/v3/repos/owner/gh-bin-ext/releases/latest"),
+		httpmock.JSONResponse(
+			release{
+				Tag: "v1.0.1",
+				Assets: []releaseAsset{
+					{
+						Name:   "gh-bin-ext-darwin-amd64",
+						APIURL: "https://example.com/release/cool",
+					},
+				},
+			}))
+	reg.Register(
+		httpmock.REST("GET", "release/cool"),
+		httpmock.StringResponse("FAKE BINARY"))
+
+	ios, _, stdout, stderr := iostreams.Test()
+	tempDir := t.TempDir()
+
+	m := newTestManager(tempDir, &client, nil, ios)
+	m.platform = func() (string, string) {
+		return "darwin-arm64", ""
+	}
+
+	originalHasRosetta := hasRosetta
+	t.Cleanup(func() { hasRosetta = originalHasRosetta })
+	hasRosetta = func() bool {
+		return true
+	}
+
+	err := m.Install(repo, "")
+	assert.NoError(t, err)
+
+	manifest, err := os.ReadFile(filepath.Join(tempDir, "extensions/gh-bin-ext", manifestName))
+	assert.NoError(t, err)
+
+	var bm binManifest
+	err = yaml.Unmarshal(manifest, &bm)
+	assert.NoError(t, err)
+
+	assert.Equal(t, binManifest{
+		Name:  "gh-bin-ext",
+		Owner: "owner",
+		Host:  "example.com",
+		Tag:   "v1.0.1",
+		Path:  filepath.Join(tempDir, "extensions/gh-bin-ext/gh-bin-ext"),
+	}, bm)
+
+	fakeBin, err := os.ReadFile(filepath.Join(tempDir, "extensions/gh-bin-ext/gh-bin-ext"))
+	assert.NoError(t, err)
+	assert.Equal(t, "FAKE BINARY", string(fakeBin))
+
+	assert.Equal(t, "", stdout.String())
+	assert.Equal(t, "", stderr.String())
+}
+
 func TestManager_repo_not_found(t *testing.T) {
 	repo := ghrepo.NewWithHost("owner", "gh-bin-ext", "example.com")