{"record":{"id":"7e149a355be96387","repo":"hyperledger/fabric","slug":"must-provide-an-instantiation-policy","errorCode":null,"errorMessage":"must provide an instantiation policy","messagePattern":"must provide an instantiation policy","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/common/ccpackage/ccpackage.go","lineNumber":167,"sourceCode":"\t\t}\n\n\t\tif endorsementExists {\n\t\t\tendorsements[n] = cip.OwnerEndorsements[0]\n\t\t}\n\t}\n\n\treturn createSignedCCDepSpec(baseCip.ChaincodeDeploymentSpec, baseCip.InstantiationPolicy, endorsements)\n}\n\n// OwnerCreateSignedCCDepSpec creates a package from a ChaincodeDeploymentSpec and\n// optionally endorses it\nfunc OwnerCreateSignedCCDepSpec(cds *peer.ChaincodeDeploymentSpec, instPolicy *common.SignaturePolicyEnvelope, owner identity.SignerSerializer) (*common.Envelope, error) {\n\tif cds == nil {\n\t\treturn nil, errors.New(\"invalid chaincode deployment spec\")\n\t}\n\n\tif instPolicy == nil {\n\t\treturn nil, errors.New(\"must provide an instantiation policy\")\n\t}\n\n\tcdsbytes := protoutil.MarshalOrPanic(cds)\n\n\tinstpolicybytes := protoutil.MarshalOrPanic(instPolicy)\n\n\tvar endorsements []*peer.Endorsement\n\t// it is not mandatory (at this protoutil level) to have a signature\n\t// this is especially convenient during dev/test\n\t// it may be necessary to enforce it via a policy at a higher level\n\tif owner != nil {\n\t\t// serialize the signing identity\n\t\tendorser, err := owner.Serialize()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Could not serialize the signing identity: %s\", err)\n\t\t}\n\n\t\t// sign the concatenation of cds, instpolicy and the serialized endorser identity with this endorser's key","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/common/ccpackage/ccpackage.go#L149-L185","documentation":"OwnerCreateSignedCCDepSpec requires an endorsement (instantiation) policy expressed as a *common.SignaturePolicyEnvelope. When instPolicy is nil there is no policy to embed in the signed package, so the call fails immediately. The library deliberately does not choose a default policy.","triggerScenarios":"Calling OwnerCreateSignedCCDepSpec(cds, nil, owner) — e.g. omitting the -P policy on `peer chaincode instantiate`, or programmatically building a SignedCDS without cauthdsl policies.","commonSituations":"Users invoking `peer chaincode instantiate` without -P (older Fabric versions required a policy); SDK code that builds the CDS envelope by hand and forgets SignaturePolicyEnvelope; migrating code that relied on a default policy.","solutions":["Provide a SignaturePolicyEnvelope, e.g. cauthdsl.SignedByMspMember(\"Org1MSP\") or policies.SignaturePolicyEnvelope built with cauthdsl helpers","Pass the same policy used at instantiation when re-signing packages","If a system chaincode default is acceptable upstream, ensure the caller layer sets it before reaching ccpackage"],"exampleFix":"// before\nenv, err := ccpackage.OwnerCreateSignedCCDepSpec(cds, nil, signer)\n// after\ninstPolicy := cauthdsl.SignedByAnyMember([]string{\"Org1MSP\"})\nenv, err := ccpackage.OwnerCreateSignedCCDepSpec(cds, instPolicy, signer)","handlingStrategy":"validation","validationCode":"if instPolicy == nil {\n    instPolicy = cauthdsl.SignedByAnyMember([]string{mspid})\n}\nenv, err := ccpackage.OwnerCreateSignedCCDepSpec(cds, instPolicy, owner)","typeGuard":"func hasInstPolicy(p *common.SignaturePolicyEnvelope) bool { return p != nil && p.Rule != nil }","tryCatchPattern":"env, err := ccpackage.OwnerCreateSignedCCDepSpec(cds, instPolicy, owner)\nif err != nil {\n    if strings.Contains(err.Error(), \"instantiation policy\") {\n        return fmt.Errorf(\"provide -P policy or build one via cauthdsl: %w\", err)\n    }\n    return err\n}","preventionTips":["Build the policy via cauthdsl helpers, never hand-roll proto bytes","Mirror the same policy across all owners endorsing the package","Keep policy construction in one utility so it is never forgotten"],"tags":["hyperledger-fabric","endorsement-policy","missing-argument","chaincode-lifecycle"],"backgroundTag":"missing-required-policy","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}