{"record":{"id":"31811507385628ea","repo":"hyperledger/fabric","slug":"no-signatures-for-nil-signedconfigitem","errorCode":null,"errorMessage":"No signatures for nil SignedConfigItem","messagePattern":"No signatures for nil SignedConfigItem","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"protoutil/signeddata.go","lineNumber":37,"sourceCode":"\t\"google.golang.org/protobuf/proto\"\n)\n\n// SignedData is used to represent the general triplet required to verify a signature\n// This is intended to be generic across crypto schemes, while most crypto schemes will\n// include the signing identity and a nonce within the Data, this is left to the crypto\n// implementation.\ntype SignedData struct {\n\tData      []byte\n\tIdentity  []byte\n\tSignature []byte\n}\n\n// ConfigUpdateEnvelopeAsSignedData returns the set of signatures for the\n// ConfigUpdateEnvelope as SignedData or an error indicating why this was not\n// possible.\nfunc ConfigUpdateEnvelopeAsSignedData(ce *common.ConfigUpdateEnvelope) ([]*SignedData, error) {\n\tif ce == nil {\n\t\treturn nil, errors.New(\"No signatures for nil SignedConfigItem\")\n\t}\n\n\tresult := make([]*SignedData, len(ce.Signatures))\n\tfor i, configSig := range ce.Signatures {\n\t\tsigHeader := &common.SignatureHeader{}\n\t\terr := proto.Unmarshal(configSig.SignatureHeader, sigHeader)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tresult[i] = &SignedData{\n\t\t\tData:      bytes.Join([][]byte{configSig.SignatureHeader, ce.ConfigUpdate}, nil),\n\t\t\tIdentity:  sigHeader.Creator,\n\t\t\tSignature: configSig.Signature,\n\t\t}\n\n\t}\n","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/protoutil/signeddata.go#L19-L55","documentation":"ConfigUpdateEnvelopeAsSignedData converts the signatures of a common.ConfigUpdateEnvelope into SignedData entries for signature verification. The function cannot produce any signed data from a nil envelope, so it returns this error before touching ce.Signatures.","triggerScenarios":"Calling ConfigUpdateEnvelopeAsSignedData with a nil *common.ConfigUpdateEnvelope — typically from authorizeUpdate when the config update envelope failed to be constructed or passed through as nil.","commonSituations":"Orderer config processing where an earlier unmarshal returned (nil, err) but the error was ignored; tests passing nil envelopes; code paths where the config transaction was rejected earlier but the envelope still flows into signature collection.","solutions":["Check the envelope for nil before calling, and skip or reject the config update when nil.","Fix the upstream code path so a nil envelope short-circuits with its real error instead of being passed along.","Unmarshal the ConfigUpdateEnvelope from the payload before invoking, and fail fast on unmarshal errors.","In tests, construct a real envelope (even empty but non-nil) instead of passing nil."],"exampleFix":"// before\nsigs, err := protoutil.ConfigUpdateEnvelopeAsSignedData(env)\n\n// after\nif env == nil {\n    return errors.New(\"no config update envelope\")\n}\nsigs, err := protoutil.ConfigUpdateEnvelopeAsSignedData(env)","handlingStrategy":"type-guard","validationCode":"if ce == nil {\n    return nil, errors.New(\"config update envelope required for signature verification\")\n}\nif len(ce.Signatures) == 0 {\n    return nil, errors.New(\"config update has no signatures\")\n}","typeGuard":"func isNilEnvelope(v interface{}) bool { return v == nil }","tryCatchPattern":"sd, err := protoutil.ConfigUpdateEnvelopeAsSignedData(ce)\nif err != nil {\n    return fmt.Errorf(\"cannot authorize config update: %w\", err)\n}","preventionTips":["Handle unmarshal errors from payload parsing immediately so nil envelopes never propagate to signature collection.","Nil-check envelopes at every API boundary before signature verification.","Keep the orderer's config-processing path fail-fast: reject bad payloads at ingress.","Add a nil-envelope unit test for any custom signature-verification wrapper."],"tags":["fabric","config","signature","nil-envelope"],"backgroundTag":"nil-envelope-signature","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}