{"record":{"id":"43d148ec6f198edf","repo":"hyperledger/fabric","slug":"invalid-signed-deployment-spec","errorCode":null,"errorMessage":"invalid signed deployment spec","messagePattern":"invalid signed deployment spec","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/common/ccpackage/ccpackage.go","lineNumber":218,"sourceCode":"}\n\n// SignExistingPackage adds a signature to a signed package.\nfunc SignExistingPackage(env *common.Envelope, owner identity.SignerSerializer) (*common.Envelope, error) {\n\tif owner == nil {\n\t\treturn nil, errors.New(\"owner not provided\")\n\t}\n\n\tch, sdepspec, err := ExtractSignedCCDepSpec(env)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif ch == nil {\n\t\treturn nil, errors.New(\"channel header not found in the envelope\")\n\t}\n\n\tif sdepspec == nil || sdepspec.ChaincodeDeploymentSpec == nil || sdepspec.InstantiationPolicy == nil || sdepspec.OwnerEndorsements == nil {\n\t\treturn nil, errors.New(\"invalid signed deployment spec\")\n\t}\n\n\t// serialize the signing identity\n\tendorser, err := owner.Serialize()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Could not serialize the signing identity: %s\", err)\n\t}\n\n\t// sign the concatenation of cds, instpolicy and the serialized endorser identity with this endorser's key\n\tsignature, err := owner.Sign(append(sdepspec.ChaincodeDeploymentSpec, append(sdepspec.InstantiationPolicy, endorser...)...))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Could not sign the ccpackage, err %s\", err)\n\t}\n\n\tendorsements := append(sdepspec.OwnerEndorsements, &peer.Endorsement{Signature: signature, Endorser: endorser})\n\n\treturn createSignedCCDepSpec(sdepspec.ChaincodeDeploymentSpec, sdepspec.InstantiationPolicy, endorsements)\n}","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/common/ccpackage/ccpackage.go#L200-L236","documentation":"After extracting the signed deployment spec, SignExistingPackage validates that the SignedChaincodeDeploymentSpec contains all required parts: the serialized ChaincodeDeploymentSpec, InstantiationPolicy and OwnerEndorsements. If any is nil/missing the spec is considered invalid and cannot be re-signed.","triggerScenarios":"Re-signing an envelope whose SignedChaincodeDeploymentSpec lacks ChaincodeDeploymentSpec bytes, has no InstantiationPolicy, or has nil OwnerEndorsements — typically a corrupted or partially written package file, or a foreign/envelope not produced by ccpackage.","commonSituations":"Package files truncated on disk or edited by hand; packages built by external tools omitting OwnerEndorsements; cross-version incompatibilities where older packaging code omitted fields; passing a raw CDS envelope instead of a signed one.","solutions":["Regenerate the package with OwnerCreateSignedCCDepSpec (which always sets all three fields) instead of re-signing a corrupt one","Validate the package: ExtractSignedCCDepSpec then check sdepspec.ChaincodeDeploymentSpec, InstantiationPolicy and OwnerEndorsements are non-nil before calling SignExistingPackage","Re-download or re-export the original package file if it was corrupted in transit"],"exampleFix":"// before\nenv, err := ccpackage.SignExistingPackage(env, signer)\n// after\n_, sdepspec, err := ccpackage.ExtractSignedCCDepSpec(env)\nif err != nil || sdepspec == nil || sdepspec.ChaincodeDeploymentSpec == nil || sdepspec.InstantiationPolicy == nil || sdepspec.OwnerEndorsements == nil {\n    return errors.New(\"package is not a complete signed CDS; regenerate it\")\n}\nenv, err = ccpackage.SignExistingPackage(env, signer)","handlingStrategy":"validation","validationCode":"_, sdepspec, err := ccpackage.ExtractSignedCCDepSpec(env)\nif err != nil || sdepspec == nil || sdepspec.ChaincodeDeploymentSpec == nil || sdepspec.InstantiationPolicy == nil || sdepspec.OwnerEndorsements == nil {\n    return errors.New(\"package incomplete; regenerate with OwnerCreateSignedCCDepSpec\")\n}\nenv, err = ccpackage.SignExistingPackage(env, owner)","typeGuard":"func isCompleteSignedCDS(s *peer.SignedChaincodeDeploymentSpec) bool {\n    return s != nil && len(s.ChaincodeDeploymentSpec) > 0 && s.InstantiationPolicy != nil && s.OwnerEndorsements != nil\n}","tryCatchPattern":"env, err := ccpackage.SignExistingPackage(env, owner)\nif err != nil {\n    if strings.Contains(err.Error(), \"invalid signed deployment spec\") {\n        return fmt.Errorf(\"package corrupted or foreign format: %w\", err)\n    }\n    return err\n}","preventionTips":["Validate packages after writing them to disk (extract and re-check fields)","Generate packages only via ccpackage helpers","Checksum package files to detect corruption in transit"],"tags":["hyperledger-fabric","chaincode-package","malformed-input","validation"],"backgroundTag":"invalid-signed-deployment-spec","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}