{"record":{"id":"a4293406c969944e","repo":"hyperledger/fabric","slug":"instantiation-policy-cannot-be-nil-for-chaincode","errorCode":null,"errorMessage":"instantiation policy cannot be nil for chaincode (%s:%s)","messagePattern":"instantiation policy cannot be nil for chaincode \\((.+?):(.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/common/ccprovider/sigcdspackage.go","lineNumber":153,"sourceCode":"\tscdsdata := &SignedCDSData{}\n\n\t// get the code hash\n\thash.Write(cds.CodePackage)\n\tscdsdata.CodeHash = hash.Sum(nil)\n\n\thash.Reset()\n\n\t// get the metadata hash\n\thash.Write([]byte(cds.ChaincodeSpec.ChaincodeId.Name))\n\thash.Write([]byte(cds.ChaincodeSpec.ChaincodeId.Version))\n\n\tscdsdata.MetaDataHash = hash.Sum(nil)\n\n\thash.Reset()\n\n\t// get the signature hashes\n\tif scds.InstantiationPolicy == nil {\n\t\treturn nil, nil, nil, fmt.Errorf(\"instantiation policy cannot be nil for chaincode (%s:%s)\", cds.ChaincodeSpec.ChaincodeId.Name, cds.ChaincodeSpec.ChaincodeId.Version)\n\t}\n\n\thash.Write(scds.InstantiationPolicy)\n\tfor _, o := range scds.OwnerEndorsements {\n\t\thash.Write(o.Endorser)\n\t}\n\tscdsdata.SignatureHash = hash.Sum(nil)\n\n\t// marshall data\n\tb, err := proto.Marshal(scdsdata)\n\tif err != nil {\n\t\treturn nil, nil, nil, err\n\t}\n\n\thash.Reset()\n\n\t// compute the id\n\thash.Write(scdsdata.CodeHash)","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/common/ccprovider/sigcdspackage.go#L135-L171","documentation":"A SignedChaincodeDeploymentSpec must carry an instantiation policy: getCDSData hashes it together with owner endorsements to build MetaDataHash used for signature verification. If scds.InstantiationPolicy is nil, hashing is impossible, so InitFromBuffer aborts with this error. It means the package was constructed without a policy, not that the policy failed validation.","triggerScenarios":"Calling InitFromBuffer with a signed CDS package whose SignedChaincodeDeploymentSpec.InstantiationPolicy is nil/empty — packages built with an old SDK/tool, hand-crafted protobuf, or tests that sign the spec without setting a policy.","commonSituations":"Packages generated by a tool or SDK version that omitted InstantiationPolicy; deserializing a partially populated SignedChaincodeDeploymentSpec from a file or ledger; manually constructing a signed package in tests and forgetting to attach a cauthdsl policy.","solutions":["Rebuild the package ensuring SignedChaincodeDeploymentSpec.InstantiationPolicy is set (e.g. a SignedBy policy via cauthdsl) before signing.","Upgrade the packaging tool/SDK to a version that always populates InstantiationPolicy.","In test/tooling code set it explicitly, e.g. scds.InstantiationPolicy = utils.MarshalOrPanic(cauthdsl.SignedByAnyMember([]string{\"Org\"})).","If the package comes from untrusted input, check InstantiationPolicy != nil before calling InitFromBuffer and reject with a clear message."],"exampleFix":"// before\nscds := &pb.SignedChaincodeDeploymentSpec{ChaincodeDeploymentSpec: cdsBytes}\n// after\npolicy := utils.MarshalOrPanic(cauthdsl.SignedByAnyMember([]string{\"SampleOrg\"}))\nscds := &pb.SignedChaincodeDeploymentSpec{ChaincodeDeploymentSpec: cdsBytes, InstantiationPolicy: policy}","handlingStrategy":"validation","validationCode":"var scds pb.SignedChaincodeDeploymentSpec\nif err := proto.Unmarshal(bytes, &scds); err != nil {\n    return err\n}\nif scds.InstantiationPolicy == nil {\n    return errors.New(\"package rejected: instantiation policy missing\")\n}","typeGuard":null,"tryCatchPattern":"if err := pack.InitFromBuffer(buf, hasher); err != nil {\n    if strings.Contains(err.Error(), \"instantiation policy cannot be nil\") {\n        // regenerate package with a policy attached\n    }\n    return err\n}","preventionTips":["Always set InstantiationPolicy before signing a SignedChaincodeDeploymentSpec.","Add a pre-submit check that InstantiationPolicy is non-empty on every package.","Upgrade SDKs/tools known to omit the policy field.","Use canonical helpers (utils/cauthdsl) to build policies rather than hand-rolled bytes."],"tags":["chaincode","instantiation-policy","fabric","package-validation"],"backgroundTag":"missing-instantiation-policy","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}