{"record":{"id":"57d5970a6aca46f7","repo":"hyperledger/fabric","slug":"invalid-signature-policy-s-57d597","errorCode":null,"errorMessage":"invalid signature policy: %s","messagePattern":"invalid signature policy: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/peer/lifecycle/chaincode/common.go","lineNumber":88,"sourceCode":"\t}, nil\n}\n\nfunc createPolicyBytes(signaturePolicy, channelConfigPolicy string) ([]byte, error) {\n\tif signaturePolicy == \"\" && channelConfigPolicy == \"\" {\n\t\t// no policy, no problem\n\t\treturn nil, nil\n\t}\n\n\tif signaturePolicy != \"\" && channelConfigPolicy != \"\" {\n\t\t// mo policies, mo problems\n\t\treturn nil, errors.New(\"cannot specify both \\\"--signature-policy\\\" and \\\"--channel-config-policy\\\"\")\n\t}\n\n\tvar applicationPolicy *pb.ApplicationPolicy\n\tif signaturePolicy != \"\" {\n\t\tsignaturePolicyEnvelope, err := policydsl.FromString(signaturePolicy)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Errorf(\"invalid signature policy: %s\", signaturePolicy)\n\t\t}\n\n\t\tapplicationPolicy = &pb.ApplicationPolicy{\n\t\t\tType: &pb.ApplicationPolicy_SignaturePolicy{\n\t\t\t\tSignaturePolicy: signaturePolicyEnvelope,\n\t\t\t},\n\t\t}\n\t}\n\n\tif channelConfigPolicy != \"\" {\n\t\tapplicationPolicy = &pb.ApplicationPolicy{\n\t\t\tType: &pb.ApplicationPolicy_ChannelConfigPolicyReference{\n\t\t\t\tChannelConfigPolicyReference: channelConfigPolicy,\n\t\t\t},\n\t\t}\n\t}\n\n\tpolicyBytes := protoutil.MarshalOrPanic(applicationPolicy)","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/internal/peer/lifecycle/chaincode/common.go#L70-L106","documentation":"When --signature-policy is provided, createPolicyBytes parses it with policydsl.FromString into a SignaturePolicyEnvelope. If the policy string is not valid policy DSL, the error is returned as \"invalid signature policy: <input>\". It means the policy text failed to parse, not that the policy was denied.","triggerScenarios":"createPolicyBytes receives a non-empty --signature-policy value that policydsl.FromString cannot parse (bad syntax, unknown principal, unbalanced quotes/parens).","commonSituations":"Typos like OR('Org1.peer') with wrong principal naming (must be 'Org1.peer' or MSP.ROLE forms), missing quotes around OR(...) in shell, Windows escaping issues.","solutions":["Check the policy string syntax: e.g. \"OR('Org1MSP.peer','Org2MSP.peer')\" or \"AND('Org1MSP.member','Org2MSP.member')\"","Quote the whole policy in the shell so single quotes survive: --signature-policy \"OR('Org1MSP.peer','Org2MSP.peer')\"","Verify MSP names exactly match the network's MSP IDs"],"exampleFix":"// before\n--signature-policy \"OR('Org1.peer', Org2.peer)\"\n// after\n--signature-policy \"OR('Org1MSP.peer','Org2MSP.peer')\"","handlingStrategy":"validation","validationCode":"if _, err := policydsl.FromString(sigPolicy); err != nil {\n    return fmt.Errorf(\"policy %q is not valid policy DSL: %v\", sigPolicy, err)\n}","typeGuard":null,"tryCatchPattern":"if err := cmd.Execute(); err != nil {\n    if strings.Contains(err.Error(), \"invalid signature policy\") {\n        // fix the --signature-policy syntax and rerun\n    }\n}","preventionTips":["Use canonical examples like OR('Org1MSP.peer','Org2MSP.peer')","Quote policies in shell to preserve single quotes","Validate MSP IDs against the channel configuration before authoring policies"],"tags":["fabric","policy","cli-flags","validation"],"backgroundTag":"invalid-policy-syntax","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}