{"record":{"id":"7c4d179e9d4ae622","repo":"hyperledger/fabric","slug":"failed-to-unmarshal-applicationpolicy-bytes-7c4d17","errorCode":null,"errorMessage":"failed to unmarshal ApplicationPolicy bytes","messagePattern":"failed to unmarshal ApplicationPolicy bytes","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/policy/application.go","lineNumber":152,"sourceCode":"\t}\n\n\treturn p.EvaluateSignedData(signatureSet)\n}\n\nfunc (a *ApplicationPolicyEvaluator) evaluateChannelConfigPolicyReference(channelConfigPolicyReference string, signatureSet []*protoutil.SignedData) error {\n\tp, err := a.channelPolicyReferenceProvider.NewPolicy(channelConfigPolicyReference)\n\tif err != nil {\n\t\treturn errors.WithMessage(err, \"could not create evaluator for channel reference policy\")\n\t}\n\n\treturn p.EvaluateSignedData(signatureSet)\n}\n\nfunc (a *ApplicationPolicyEvaluator) Evaluate(policyBytes []byte, signatureSet []*protoutil.SignedData) error {\n\tp := &peer.ApplicationPolicy{}\n\terr := proto.Unmarshal(policyBytes, p)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"failed to unmarshal ApplicationPolicy bytes\")\n\t}\n\n\tswitch policy := p.Type.(type) {\n\tcase *peer.ApplicationPolicy_SignaturePolicy:\n\t\treturn a.evaluateSignaturePolicy(policy.SignaturePolicy, signatureSet)\n\tcase *peer.ApplicationPolicy_ChannelConfigPolicyReference:\n\t\treturn a.evaluateChannelConfigPolicyReference(policy.ChannelConfigPolicyReference, signatureSet)\n\tdefault:\n\t\treturn errors.Errorf(\"unsupported policy type %T\", policy)\n\t}\n}\n","sourceCodeStart":134,"sourceCodeEnd":164,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/policy/application.go#L134-L164","documentation":"ApplicationPolicyEvaluator.Evaluate expects policyBytes to be a protobuf-marshalled peer.ApplicationPolicy message. If proto.Unmarshal fails, the bytes are corrupt or not an ApplicationPolicy — wrapped as 'failed to unmarshal ApplicationPolicy bytes'.","triggerScenarios":"Passing raw policy bytes of the wrong type (e.g., a legacy cauthdsl signature-policy envelope, JSON, or a truncated/marshalled-with-different-schema buffer) into Evaluate.","commonSituations":"Mixing old-style endorsement policy envelopes with the newer ApplicationPolicy format after a Fabric upgrade, chaincode storing policy bytes serialized by a different proto version, corrupted policy bytes persisted in chaincode state or collection config.","solutions":["Ensure the bytes were produced by proto.Marshal on a peer.ApplicationPolicy (use protoutil helpers) before calling Evaluate","If you have a legacy signature policy envelope, wrap it: ApplicationPolicy{Type: &ApplicationPolicy_SignaturePolicy{SignaturePolicy: envelope}} rather than passing raw bytes","Re-generate or re-store the policy bytes with the current Fabric protobuf definitions","Hex-dump/decode the bytes with `protoc --decode` to confirm the wire format"],"exampleFix":"// before\npolicyEnvelope, _ := cauthdsl.MarshaledPolicy(...)  // wrong wire type\nerr := evaluator.Evaluate(policyEnvelope, sigData)\n// after\nappPolicy, _ := proto.Marshal(&peer.ApplicationPolicy{Type: &peer.ApplicationPolicy_SignaturePolicy{\n    SignaturePolicy: signaturePolicyEnvelope}})\nerr := evaluator.Evaluate(appPolicy, sigData)","handlingStrategy":"type-guard","validationCode":"func isApplicationPolicyBytes(b []byte) error {\n    var p peer.ApplicationPolicy\n    if err := proto.Unmarshal(b, &p); err != nil {\n        return fmt.Errorf(\"bytes are not a valid ApplicationPolicy: %w\", err)\n    }\n    if p.Type == nil {\n        return errors.New(\"ApplicationPolicy has no Type set\")\n    }\n    return nil\n}","typeGuard":"func tryUnmarshalApplicationPolicy(b []byte) (*peer.ApplicationPolicy, bool) {\n    p := &peer.ApplicationPolicy{}\n    if err := proto.Unmarshal(b, p); err != nil || p.Type == nil {\n        return nil, false\n    }\n    return p, true\n}","tryCatchPattern":"if err := evaluator.Evaluate(policyBytes, sigData); err != nil {\n    if strings.Contains(err.Error(), \"failed to unmarshal ApplicationPolicy bytes\") {\n        // re-serialize with proto.Marshal(&peer.ApplicationPolicy{...}) and retry\n    }\n    return err\n}","preventionTips":["Always produce policy bytes via proto.Marshal on peer.ApplicationPolicy, never raw envelopes or JSON","Wrap legacy cauthdsl envelopes in ApplicationPolicy_SignaturePolicy instead of passing them raw","Version-check Fabric protobufs when policies are persisted or cross-node"],"tags":["hyperledger-fabric","protobuf","policy","unmarshal"],"backgroundTag":"protobuf-unmarshal-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}