{"record":{"id":"5c45ea513833ab3c","repo":"hyperledger/fabric","slug":"chaincode-instantiation-policy-violated-error-s-5c45ea","errorCode":null,"errorMessage":"chaincode instantiation policy violated, error %s","messagePattern":"chaincode instantiation policy violated, error (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/handlers/validation/builtin/v13/lscc_validation_logic.go","lineNumber":54,"sourceCode":"}\n\n// checkInstantiationPolicy evaluates an instantiation policy against a signed proposal\nfunc (vscc *Validator) checkInstantiationPolicy(chainName string, env *common.Envelope, instantiationPolicy []byte, payl *common.Payload) commonerrors.TxValidationError {\n\t// get the signature header\n\tshdr, err := protoutil.UnmarshalSignatureHeader(payl.Header.SignatureHeader)\n\tif err != nil {\n\t\treturn policyErr(err)\n\t}\n\n\t// construct signed data we can evaluate the instantiation policy against\n\tsd := []*protoutil.SignedData{{\n\t\tData:      env.Payload,\n\t\tIdentity:  shdr.Creator,\n\t\tSignature: env.Signature,\n\t}}\n\terr = vscc.policyEvaluator.Evaluate(instantiationPolicy, sd)\n\tif err != nil {\n\t\treturn policyErr(fmt.Errorf(\"chaincode instantiation policy violated, error %s\", err))\n\t}\n\treturn nil\n}\n\nfunc validateNewCollectionConfigs(newCollectionConfigs []*pb.CollectionConfig) error {\n\tnewCollectionsMap := make(map[string]bool, len(newCollectionConfigs))\n\t// Process each collection config from a set of collection configs\n\tfor _, newCollectionConfig := range newCollectionConfigs {\n\n\t\tnewCollection := newCollectionConfig.GetStaticCollectionConfig()\n\t\tif newCollection == nil {\n\t\t\treturn errors.New(\"unknown collection configuration type\")\n\t\t}\n\n\t\t// Ensure that there are no duplicate collection names\n\t\tcollectionName := newCollection.GetName()\n\n\t\tif err := validateCollectionName(collectionName); err != nil {","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/handlers/validation/builtin/v13/lscc_validation_logic.go#L36-L72","documentation":"The instantiation policy is evaluated against the transaction's creator/endorser signatures. If policyEvaluator.Evaluate returns an error — the endorsements do not satisfy the policy — the transaction is rejected with this message. This enforces that only principals authorized by the chaincode's instantiation policy may deploy/upgrade it.","triggerScenarios":"An lscc deploy/upgrade transaction whose endorsements fail to satisfy the chaincode's instantiation policy during checkInstantiationPolicy evaluation.","commonSituations":"Endorsing with identities outside the orgs listed in the instantiation policy (e.g. default 'ANY of Peers of Orgs...' vs actual endorsers); expired/revoked admin certificates; MSP reconfiguration after the policy was written; using a member/admin signature mismatch.","solutions":["Ensure the transaction is endorsed by identities satisfying the recorded instantiation policy (correct orgs/roles)","Renew or update enrollment certificates if the admin certs expired or rotated","If the policy is stale, have an authorized principal perform the upgrade with valid endorsements, or redeploy with a corrected policy"],"exampleFix":"// before\npeer chaincode invoke ... -C mychannel -n mycc (endorsed only by Org2, policy requires Org1)\n// after\ncollect endorsements from Org1 peers required by the instantiation policy before submitting","handlingStrategy":"try-catch","validationCode":"const endorsers = tx.endorsements.map(e => e.mspid);\nconst satisfied = policyOrgs.some(org => endorsers.includes(org));\nif (!satisfied) {\n  throw new Error(`Endorsements ${endorsers} do not satisfy instantiation policy orgs ${policyOrgs}`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  await upgradeContract.submitTransaction(...);\n} catch (e) {\n  if (String(e).includes('instantiation policy violated')) {\n    // collect endorsements from the required orgs and resubmit\n  }\n}","preventionTips":["Collect endorsements from the orgs listed in the instantiation policy","Track admin cert expiry and rotate before transactions","Review the policy recorded at instantiate time before upgrades"],"tags":["hyperledger-fabric","vscc","instantiation-policy","endorsement"],"backgroundTag":"instantiation-policy-violated","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}