{"record":{"id":"a8732afcd3e4755f","repo":"hyperledger/fabric","slug":"cannot-specify-both-signature-policy-and-ch-a8732a","errorCode":null,"errorMessage":"cannot specify both \"--signature-policy\" and \"--channel-config-policy\"","messagePattern":"cannot specify both \"--signature-policy\" and \"--channel-config-policy\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/peer/lifecycle/chaincode/common.go","lineNumber":81,"sourceCode":"\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn &pb.SignedProposal{\n\t\tProposalBytes: proposalBytes,\n\t\tSignature:     signature,\n\t}, nil\n}\n\nfunc createPolicyBytes(signaturePolicy, channelConfigPolicy string) ([]byte, error) {\n\tif signaturePolicy == \"\" && channelConfigPolicy == \"\" {\n\t\t// no policy, no problem\n\t\treturn nil, nil\n\t}\n\n\tif signaturePolicy != \"\" && channelConfigPolicy != \"\" {\n\t\t// mo policies, mo problems\n\t\treturn nil, errors.New(\"cannot specify both \\\"--signature-policy\\\" and \\\"--channel-config-policy\\\"\")\n\t}\n\n\tvar applicationPolicy *pb.ApplicationPolicy\n\tif signaturePolicy != \"\" {\n\t\tsignaturePolicyEnvelope, err := policydsl.FromString(signaturePolicy)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Errorf(\"invalid signature policy: %s\", signaturePolicy)\n\t\t}\n\n\t\tapplicationPolicy = &pb.ApplicationPolicy{\n\t\t\tType: &pb.ApplicationPolicy_SignaturePolicy{\n\t\t\t\tSignaturePolicy: signaturePolicyEnvelope,\n\t\t\t},\n\t\t}\n\t}\n\n\tif channelConfigPolicy != \"\" {\n\t\tapplicationPolicy = &pb.ApplicationPolicy{","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/internal/peer/lifecycle/chaincode/common.go#L63-L99","documentation":"createPolicyBytes converts the user-supplied endorsement policy flags into a pb.ApplicationPolicy. Fabric forbids supplying both a signature policy (--signature-policy) and a channel config policy (--channel-config-policy) at once, so it returns this error. The two policy types are mutually exclusive representations of the endorsement policy.","triggerScenarios":"Approve or Install (via createInput → createPolicyBytes) invoked with both --signature-policy and --channel-config-policy set to non-empty values.","commonSituations":"Copy-pasting a command line and adding a second policy flag; scripts that append policy flags unconditionally leaving a stale default.","solutions":["Remove one of the two flags from the command line","Keep only --signature-policy 'OR(...)' for inline policy expressions","Use only --channel-config-policy /Channel/Application/Endorsement for channel-defined policies"],"exampleFix":"// before\npeer lifecycle chaincode approveformyorg --signature-policy \"OR('Org1.peer','Org2.peer')\" --channel-config-policy /Channel/Application/Endorsement ...\n// after\npeer lifecycle chaincode approveformyorg --signature-policy \"OR('Org1.peer','Org2.peer')\" ...","handlingStrategy":"validation","validationCode":"if sigPolicy != \"\" && ccPolicy != \"\" {\n    return errors.New(\"pass either --signature-policy or --channel-config-policy, not both\")\n}","typeGuard":null,"tryCatchPattern":"if err := approveCmd.Execute(); err != nil {\n    if strings.Contains(err.Error(), \"cannot specify both\") {\n        // strip one of the policy flags and rerun\n    }\n}","preventionTips":["Keep only one policy flag in scripts/templates","Sanitize inherited command-line strings before appending policy flags","Prefer channel config policies in multi-org setups to avoid duplicates"],"tags":["fabric","lifecycle","cli-flags","policy"],"backgroundTag":"conflicting-flags","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}