{"record":{"id":"a5f83886b0eb9112","repo":"hyperledger/fabric","slug":"failure-opening-codepackage-gzip-stream-s","errorCode":null,"errorMessage":"failure opening codepackage gzip stream: %s","messagePattern":"failure opening codepackage gzip stream: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/chaincode/platforms/golang/platform.go","lineNumber":80,"sourceCode":"\t}\n\n\t// not a module\n\tif modInfo == nil {\n\t\treturn rawPath, nil\n\t}\n\n\treturn modInfo.ImportPath, nil\n}\n\n// ValidateCodePackage examines the chaincode archive to ensure it is valid.\n//\n// NOTE: this code is used in some transaction validation paths but can be changed\n// post 2.0.\nfunc (p *Platform) ValidateCodePackage(code []byte) error {\n\tis := bytes.NewReader(code)\n\tgr, err := gzip.NewReader(is)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failure opening codepackage gzip stream: %s\", err)\n\t}\n\n\tre := regexp.MustCompile(`^(src|META-INF)/`)\n\ttr := tar.NewReader(gr)\n\tfor {\n\t\theader, err := tr.Next()\n\t\tif err == io.EOF {\n\t\t\tbreak\n\t\t}\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\t// maintain check for conforming paths for validation\n\t\tif !re.MatchString(header.Name) {\n\t\t\treturn fmt.Errorf(\"illegal file name in payload: %s\", header.Name)\n\t\t}\n","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/chaincode/platforms/golang/platform.go#L62-L98","documentation":"Platform.ValidateCodePackage treats an install package as a gzip-compressed tar; it wraps gzip.NewReader failure with 'failure opening codepackage gzip stream: %s'. The submitted package bytes are not valid gzip, so validation fails before any tar inspection.","triggerScenarios":"Calling ValidateCodePackage(code) (used in some transaction validation paths pre-2.0) with bytes that are not gzip: empty payload, raw tar, plain files, or truncated/corrupt gzip stream.","commonSituations":"Uploading an uncompressed .tar instead of .tar.gz; corrupted package over the network; client SDK packaging bug; Fabric 1.4-era validation path fed a 2.x-style (non-gzip-shaped) package.","solutions":["Package the chaincode as gzip: 'tar czf code.tar.gz src/...' and resubmit","Verify the payload starts with gzip magic bytes 1f 8b before submitting","Check the client packaging code path — use the platform's GetDeploymentPayload rather than hand-rolled tars","If the package came from a transfer, re-download and compare hashes to rule out truncation"],"exampleFix":"// before\ntar -cf code.tar src/\n// after\ntar -czf code.tar.gz src/","handlingStrategy":"validation","validationCode":"func isGzip(b []byte) bool { return len(b) > 2 && b[0] == 0x1f && b[1] == 0x8b }\nif !isGzip(code) { return errors.New(\"package is not gzip\") }\nif _, err := gzip.NewReader(bytes.NewReader(code)); err != nil { return err }","typeGuard":"func isGzip(b []byte) bool { return len(b) > 2 && b[0] == 0x1f && b[1] == 0x8b }","tryCatchPattern":"if err := platform.ValidateCodePackage(code); err != nil {\n  if strings.Contains(err.Error(), \"failure opening codepackage gzip stream\") {\n    return fmt.Errorf(\"repackage as tar.gz: %w\", err)\n  }\n  return err\n}","preventionTips":["Always package with tar -czf","Validate gzip magic bytes client-side before submit","Use the platform's GetDeploymentPayload for packaging","Compare checksums after network transfer"],"tags":["gzip","validation","codepackage","fabric"],"backgroundTag":"invalid-gzip-stream","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}