{"record":{"id":"3d37af5177083fb2","repo":"hyperledger/fabric","slug":"invalid-proposal-s-signatureheader-during-check-po-3d37af","errorCode":null,"errorMessage":"Invalid Proposal's SignatureHeader during check policy on channel [%s] with policy [%s]: [%s]","messagePattern":"Invalid Proposal's SignatureHeader during check policy on channel \\[(.+?)\\] with policy \\[(.+?)\\]: \\[(.+?)\\]","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/policy/policy.go","lineNumber":93,"sourceCode":"\tpolicyManager := p.channelPolicyManagerGetter.Manager(channelID)\n\tif policyManager == nil {\n\t\treturn fmt.Errorf(\"Failed to get policy manager for channel [%s]\", channelID)\n\t}\n\n\t// Prepare SignedData\n\tproposal, err := protoutil.UnmarshalProposal(signedProp.ProposalBytes)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Failing extracting proposal during check policy on channel [%s] with policy [%s]: [%s]\", channelID, policyName, err)\n\t}\n\n\theader, err := protoutil.UnmarshalHeader(proposal.Header)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Failing extracting header during check policy on channel [%s] with policy [%s]: [%s]\", channelID, policyName, err)\n\t}\n\n\tshdr, err := protoutil.UnmarshalSignatureHeader(header.SignatureHeader)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Invalid Proposal's SignatureHeader during check policy on channel [%s] with policy [%s]: [%s]\", channelID, policyName, err)\n\t}\n\n\tsd := []*protoutil.SignedData{{\n\t\tData:      signedProp.ProposalBytes,\n\t\tIdentity:  shdr.Creator,\n\t\tSignature: signedProp.Signature,\n\t}}\n\n\treturn p.CheckPolicyBySignedData(channelID, policyName, sd)\n}\n\n// CheckPolicyNoChannel checks that the passed signed proposal is valid with the respect to\n// passed policy on the local MSP.\nfunc (p *policyChecker) CheckPolicyNoChannel(policyName string, signedProp *pb.SignedProposal) error {\n\tif policyName == \"\" {\n\t\treturn errors.New(\"Invalid policy name during channelless check policy. Name must be different from nil.\")\n\t}\n","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/policy/policy.go#L75-L111","documentation":"CheckPolicy then unmarshals header.SignatureHeader with protoutil.UnmarshalSignatureHeader to obtain the creator identity used to verify the signature. If the SignatureHeader bytes are empty or malformed, the creator cannot be recovered and the error is returned with the channel, policy, and cause.","triggerScenarios":"Proposal's Header contains a SignatureHeader field that is nil/empty or bytes of a different protobuf type; a manually constructed SignatureHeader with a wrong Creator field.","commonSituations":"Custom signing code that sets the Creator incorrectly or leaves SignatureHeader unset; SDK/peer proto version drift; proposals relayed through middleware that drops nested fields.","solutions":["Construct the proposal via the SDK's ChaincodeHeader/SignatureHeader helpers so creator MSP identity is serialized correctly","Read the wrapped underlying error to distinguish empty bytes from a type mismatch","Verify the client's fabric-protos version matches the peer's","Validate client identity enrollment (Creator must be a valid serialized identity from the local MSP)"],"exampleFix":"// before\nshdr := &common.SignatureHeader{} // empty creator\n// after\ncreator, _ := id.Marshal()\nshdrBytes, _ := protoutil.Marshal(protoutil.NewSignatureHeader(id))","handlingStrategy":"try-catch","validationCode":"sh, err := protoutil.UnmarshalSignatureHeader(header.SignatureHeader)\nif err != nil || len(sh.Creator) == 0 { return errors.New(\"SignatureHeader/Creator invalid\") }","typeGuard":"function hasCreator(sh) { return sh && sh.creator && sh.creator.length > 0; }","tryCatchPattern":"err := checker.CheckPolicy(policyName, signedProp)\nif err != nil {\n    if strings.Contains(err.Error(), \"Invalid Proposal's SignatureHeader\") {\n        // creator identity unrecoverable: reject the proposal\n    }\n    return err\n}","preventionTips":["Serialize identity into Creator with the MSP APIs","Never leave SignatureHeader unset","Match proto versions across services","Verify signature headers before policy checks"],"tags":["hyperledger-fabric","protobuf","signature-header","identity"],"backgroundTag":"protobuf-unmarshal-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}