{"record":{"id":"123f0f9dab046d83","repo":"hyperledger/fabric","slug":"failing-extracting-header-during-check-policy-s","errorCode":null,"errorMessage":"Failing extracting header during check policy [%s]: [%s]","messagePattern":"Failing extracting header during check policy \\[(.+?)\\]: \\[(.+?)\\]","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/aclmgmt/resourceprovider.go","lineNumber":112,"sourceCode":"\n// CheckACL implements AClProvider's CheckACL interface so it can be registered\n// as a provider with aclmgmt\nfunc (rp *aclmgmtPolicyProviderImpl) CheckACL(polName string, idinfo any) error {\n\taclLogger.Debugf(\"acl check(%s)\", polName)\n\n\t// we will implement other identifiers. In the end we just need a SignedData\n\tvar sd []*protoutil.SignedData\n\tswitch idinfo := idinfo.(type) {\n\tcase *pb.SignedProposal:\n\t\tsignedProp := idinfo\n\t\tproposal, err := protoutil.UnmarshalProposal(signedProp.ProposalBytes)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Failing extracting proposal during check policy with policy [%s]: [%s]\", polName, err)\n\t\t}\n\n\t\theader, err := protoutil.UnmarshalHeader(proposal.Header)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Failing extracting header during check policy [%s]: [%s]\", polName, err)\n\t\t}\n\n\t\tshdr, err := protoutil.UnmarshalSignatureHeader(header.SignatureHeader)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Invalid Proposal's SignatureHeader during check policy [%s]: [%s]\", polName, err)\n\t\t}\n\n\t\tsd = []*protoutil.SignedData{{\n\t\t\tData:      signedProp.ProposalBytes,\n\t\t\tIdentity:  shdr.Creator,\n\t\t\tSignature: signedProp.Signature,\n\t\t}}\n\n\tcase *common.Envelope:\n\t\tvar err error\n\t\tsd, err = protoutil.EnvelopeAsSignedData(idinfo)\n\t\tif err != nil {\n\t\t\treturn err","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/aclmgmt/resourceprovider.go#L94-L130","documentation":"Continuing CheckACL in resourceprovider, after the Proposal unmarshals, its Header must unmarshal via protoutil.UnmarshalHeader. Failure means the embedded Header bytes are not a valid common.Header protobuf, so the policy check aborts with this wrapped error naming the policy and underlying cause.","triggerScenarios":"A SignedProposal whose inner Proposal contains a Header field that fails protobuf decode — malformed header bytes, header populated with wrong message type, or manual byte assembly errors in custom clients.","commonSituations":"Hand-rolled fabric clients constructing header bytes by concatenation instead of proto.Marshal; older client protos inconsistent with peer's; payload corruption from custom serialization middleware.","solutions":["Build the proposal with protoutil helpers (CreateProposal/NewProposal) so Header is correctly marshaled, instead of assembling bytes manually.","Check the wrapped error text for the exact protobuf decode failure and fix the offending field.","Ensure the client and peer use compatible fabric-protos versions.","Verify signature integrity: a corrupted header usually also fails signature verification, confirming byte-level corruption upstream."],"exampleFix":"// before\nheader := &common.Header{...}\nproposal.Header = someManualEncoding(header)\n// after\nhdrBytes, _ := proto.Marshal(header)\nproposal.Header = hdrBytes","handlingStrategy":"validation","validationCode":"var prop pb.Proposal\nif err := proto.Unmarshal(signedProp.ProposalBytes, &prop); err != nil {\n    return fmt.Errorf(\"invalid proposal: %w\", err)\n}\nvar hdr common.Header\nif err := proto.Unmarshal(prop.Header, &hdr); err != nil {\n    return fmt.Errorf(\"proposal header is not a valid common.Header: %w\", err)\n}","typeGuard":"func hasValidHeader(sp *pb.SignedProposal) bool {\n    var p pb.Proposal\n    if proto.Unmarshal(sp.ProposalBytes, &p) != nil {\n        return false\n    }\n    var h common.Header\n    return proto.Unmarshal(p.Header, &h) == nil\n}","tryCatchPattern":"if err := aclProvider.CheckACL(resName, channelID, signedProp); err != nil {\n    if strings.Contains(err.Error(), \"Failing extracting header\") {\n        return fmt.Errorf(\"proposal header malformed, rebuild with protoutil helpers: %w\", err)\n    }\n    return err\n}","preventionTips":["Always marshal Header via proto.Marshal of a populated common.Header","Use protoutil.CreateProposal instead of constructing proposals field-by-field","Align fabric-protos dependency versions across client and peer","Log the wrapped underlying protobuf error to pinpoint the malformed field"],"tags":["acl","protobuf","header"],"backgroundTag":"invalid-proposal-protobuf","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}