{"record":{"id":"3f0e125347635936","repo":"hyperledger/fabric","slug":"data-mismatch-3f0e12","errorCode":null,"errorMessage":"data mismatch","messagePattern":"data mismatch","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/common/ccprovider/sigcdspackage.go","lineNumber":216,"sourceCode":"\t// protobuf will gladly deserialize garbage and there are paths where we assume that\n\t// a successful unmarshal means everything works but, if it fails, we try to unmarshal\n\t// into something different.\n\tif !isPrintable(ccdata.Name) {\n\t\treturn fmt.Errorf(\"invalid chaincode name: %q\", ccdata.Name)\n\t}\n\n\tif ccdata.Name != ccpack.depSpec.ChaincodeSpec.ChaincodeId.Name || ccdata.Version != ccpack.depSpec.ChaincodeSpec.ChaincodeId.Version {\n\t\treturn fmt.Errorf(\"invalid chaincode data %v (%v)\", ccdata, ccpack.depSpec.ChaincodeSpec.ChaincodeId)\n\t}\n\n\totherdata := &SignedCDSData{}\n\terr := proto.Unmarshal(ccdata.Data, otherdata)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif !proto.Equal(ccpack.data, otherdata) {\n\t\treturn errors.New(\"data mismatch\")\n\t}\n\n\treturn nil\n}\n\n// InitFromBuffer sets the buffer if valid and returns ChaincodeData\nfunc (ccpack *SignedCDSPackage) InitFromBuffer(buf []byte) (*ChaincodeData, error) {\n\tenv := &common.Envelope{}\n\terr := proto.Unmarshal(buf, env)\n\tif err != nil {\n\t\treturn nil, errors.New(\"failed to unmarshal envelope from bytes\")\n\t}\n\tcHdr, sDepSpec, err := ccpackage.ExtractSignedCCDepSpec(env)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif cHdr.Type != int32(common.HeaderType_CHAINCODE_PACKAGE) {","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/common/ccprovider/sigcdspackage.go#L198-L234","documentation":"After unmarshaling ccdata.Data into a fresh SignedCDSData, ValidateCC requires it to be proto.Equal to the data computed at package creation. A mismatch means the package's signature data was altered or is inconsistent, so the package is rejected.","triggerScenarios":"GetCCPackage -> ValidateCC where recomputing SignedCDSData from ccdata.Data yields a message different from ccpack.data — tampered or wrongly serialized package bytes.","commonSituations":"Packages modified after signing; incorrect serialization of the Data field by custom tooling; byte-level corruption of the installed package file.","solutions":["Re-run `peer chaincode signpackage` on the original CDS to regenerate consistent data","Compare the package file checksum against the originally packaged artifact","Do not hand-edit any field of the packaged ChaincodeData"],"exampleFix":"// before\nccdata.Data = customSerializedBytes // altered after signing\n// after\nccdata.Data = originalSignedBytes // from peer chaincode signpackage output","handlingStrategy":"validation","validationCode":"func verifyPackageIntegrity(signedFile, origFile string) error {\n    s, err := os.ReadFile(signedFile); if err != nil { return err }\n    o, err := os.ReadFile(origFile); if err != nil { return err }\n    if len(s) < len(o) { return errors.New(\"signed package truncated\") }\n    return nil\n}","typeGuard":"func looksTampered(pkgBytes, trustedChecksum string) bool {\n    sum := sha256.Sum256(pkgBytes)\n    return hex.EncodeToString(sum[:]) != trustedChecksum\n}","tryCatchPattern":"cd, err := GetCCPackage(buf, idFunc)\nif err != nil {\n    if err.Error() == \"data mismatch\" {\n        return fmt.Errorf(\"package data altered after signing; re-sign with peer chaincode signpackage: %w\", err)\n    }\n    return err\n}","preventionTips":["Treat signed packages as immutable artifacts","Record and compare SHA-256 checksums of packages across environments","Re-sign from the original CDS rather than editing signed output"],"tags":["chaincode","fabric","integrity","signature"],"backgroundTag":"payload-integrity-mismatch","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}