{"record":{"id":"805b41da520f7c5d","repo":"hyperledger/fabric","slug":"illegal-file-mode-detected-for-file-s-o-805b41","errorCode":null,"errorMessage":"illegal file mode detected for file %s: %o","messagePattern":"illegal file mode detected for file (.+?): %o","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/chaincode/platforms/node/platform.go","lineNumber":116,"sourceCode":"\t\t// Check name for conforming path\n\t\t// --------------------------------------------------------------------------------------\n\t\tif !re.MatchString(header.Name) {\n\t\t\treturn fmt.Errorf(\"illegal file detected in payload: \\\"%s\\\"\", header.Name)\n\t\t}\n\t\tif header.Name == \"src/package.json\" {\n\t\t\tfoundPackageJson = true\n\t\t}\n\t\t// --------------------------------------------------------------------------------------\n\t\t// Check that file mode makes sense\n\t\t// --------------------------------------------------------------------------------------\n\t\t// Acceptable flags:\n\t\t//      ISREG      == 0100000\n\t\t//      -rw-rw-rw- == 0666\n\t\t//\n\t\t// Anything else is suspect in this context and will be rejected\n\t\t// --------------------------------------------------------------------------------------\n\t\tif header.Mode&^0o100666 != 0 {\n\t\t\treturn fmt.Errorf(\"illegal file mode detected for file %s: %o\", header.Name, header.Mode)\n\t\t}\n\t}\n\tif !foundPackageJson {\n\t\treturn fmt.Errorf(\"no package.json found at the root of the chaincode package\")\n\t}\n\n\treturn nil\n}\n\n// Generates a deployment payload by putting source files in src/$file entries in .tar.gz format\nfunc (p *Platform) GetDeploymentPayload(path string) ([]byte, error) {\n\tvar err error\n\n\t// --------------------------------------------------------------------------------------\n\t// Write out our tar package\n\t// --------------------------------------------------------------------------------------\n\tpayload := bytes.NewBuffer(nil)\n\tgw := gzip.NewWriter(payload)","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/chaincode/platforms/node/platform.go#L98-L134","documentation":"ValidateCodePackage rejects any tar header whose mode has bits outside the allowed mask 0100666 (regular file + rw-rw-rw-). Executable, setuid, device, or directory-style modes are considered suspect in a Node.js chaincode payload, so the platform fails fast with the offending file and its octal mode.","triggerScenarios":"Packaging a chaincode tarball containing files with modes such as 0755 (executable bit set), symlinks, setuid bits, or any mode where header.Mode&^0o100666 != 0 when ValidateCodePackage is called.","commonSituations":"Files checked out with exec bits on Windows/Unix shares, scripts chmod +x'ed before packaging, tar created with preserve-permissions flags, or archives that include symlinks/directories with unusual modes.","solutions":["Normalize file permissions to 0644 (chmod 644 on all packaged files) and re-tar without preserving permissions.","Strip the executable bit: chmod -x src/**/* before packaging.","Create the tar without --preserve-permissions and without symlinks (replace symlinks with real files).","If a file genuinely needs to be executable, move that logic into a script invoked via package.json with normal file mode."],"exampleFix":"// before: files 0755 inside tar\nchmod -R 755 src/ && tar -czf pkg.tar.gz src\n// after: normalize modes\ncd <project-root> && find src -type f -exec chmod 644 {} + && tar -czf pkg.tar.gz src","handlingStrategy":"validation","validationCode":"const allowed = 0o100666;\n// before packaging: assert every file's mode satisfies\n// (mode & ~allowed) === 0, e.g. (fs.statSync(f).mode & ~allowed) === 0","typeGuard":"function hasLegalMode(mode) {\n  return (mode & ~0o100666) === 0;\n}","tryCatchPattern":null,"preventionTips":["chmod 644 all source files before packaging","Avoid --preserve-permissions when creating the tar","Replace symlinks with real files","Never mark chaincode source files executable"],"tags":["chaincode","packaging","permissions","validation"],"backgroundTag":"illegal-file-mode","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}