{"record":{"id":"a985dc654e926d74","repo":"hyperledger/fabric","slug":"chaincode-deployment-spec-cannot-be-nil-in-a-packa","errorCode":null,"errorMessage":"chaincode deployment spec cannot be nil in a package","messagePattern":"chaincode deployment spec cannot be nil in a package","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/common/ccprovider/sigcdspackage.go","lineNumber":192,"sourceCode":"\n\tid := hash.Sum(nil)\n\n\treturn b, id, scdsdata, nil\n}\n\n// ValidateCC returns error if the chaincode is not found or if its not a\n// ChaincodeDeploymentSpec\nfunc (ccpack *SignedCDSPackage) ValidateCC(ccdata *ChaincodeData) error {\n\tif ccpack.sDepSpec == nil {\n\t\treturn errors.New(\"uninitialized package\")\n\t}\n\n\tif ccpack.sDepSpec.ChaincodeDeploymentSpec == nil {\n\t\treturn errors.New(\"signed chaincode deployment spec cannot be nil in a package\")\n\t}\n\n\tif ccpack.depSpec == nil {\n\t\treturn errors.New(\"chaincode deployment spec cannot be nil in a package\")\n\t}\n\n\t// This is a hack. LSCC expects a specific LSCC error when names are invalid so it\n\t// has its own validation code. We can't use that error because of import cycles.\n\t// Unfortunately, we also need to check if what have makes some sort of sense as\n\t// protobuf will gladly deserialize garbage and there are paths where we assume that\n\t// a successful unmarshal means everything works but, if it fails, we try to unmarshal\n\t// into something different.\n\tif !isPrintable(ccdata.Name) {\n\t\treturn fmt.Errorf(\"invalid chaincode name: %q\", ccdata.Name)\n\t}\n\n\tif ccdata.Name != ccpack.depSpec.ChaincodeSpec.ChaincodeId.Name || ccdata.Version != ccpack.depSpec.ChaincodeSpec.ChaincodeId.Version {\n\t\treturn fmt.Errorf(\"invalid chaincode data %v (%v)\", ccdata, ccpack.depSpec.ChaincodeSpec.ChaincodeId)\n\t}\n\n\totherdata := &SignedCDSData{}\n\terr := proto.Unmarshal(ccdata.Data, otherdata)","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/common/ccprovider/sigcdspackage.go#L174-L210","documentation":"ValidateCC rejects a signed chaincode package whose ChaincodeDeploymentSpec inside the SignedChaincodeDeploymentSpec is nil. The library cannot validate or instantiate a package without the underlying deployment spec, so it fails early. This is a structural integrity check on the deserialized package.","triggerScenarios":"Calling GetCCPackage on a signed CDS package whose SignedChaincodeDeploymentSpec.chaincode_deployment_spec field was never populated, or whose bytes were built manually with an empty inner spec.","commonSituations":"Hand-crafted or corrupted chaincode package files; tooling that serialized only the signature envelope but omitted the inner deployment spec; truncated/corrupted tar packages transferred between environments.","solutions":["Rebuild the chaincode package with `peer chaincode package` so the signed deployment spec is fully populated","Verify the SignedChaincodeDeploymentSpec.ChaincodeDeploymentSpec bytes are non-empty before packaging","Regenerate the package from the original ChaincodeDeploymentSpec rather than patching existing bytes"],"exampleFix":"// before (manual struct, missing spec)\nsDepSpec := &pb.SignedChaincodeDeploymentSpec{}\n// after\nsDepSpec := &pb.SignedChaincodeDeploymentSpec{\n    ChaincodeDeploymentSpec: depSpecBytes, // proto.Marshal of a populated ChaincodeDeploymentSpec\n    OwnerEndorsements: endorsements,\n}","handlingStrategy":"validation","validationCode":"func validateSignedCDS(s *pb.SignedChaincodeDeploymentSpec) error {\n    if s == nil || len(s.ChaincodeDeploymentSpec) == 0 {\n        return errors.New(\"signed CDS missing inner deployment spec\")\n    }\n    cds := &pb.ChaincodeDeploymentSpec{}\n    return proto.Unmarshal(s.ChaincodeDeploymentSpec, cds)\n}","typeGuard":"func hasDepSpec(s *pb.SignedChaincodeDeploymentSpec) bool {\n    return s != nil && s.ChaincodeDeploymentSpec != nil && len(s.ChaincodeDeploymentSpec) > 0\n}","tryCatchPattern":"if _, err := ccpack.InitFromBuffer(buf); err != nil {\n    if strings.Contains(err.Error(), \"deployment spec cannot be nil\") {\n        // regenerate the package\n    }\n    return err\n}","preventionTips":["Always build packages with `peer chaincode package`, never by hand-assembling protobuf structs","Verify the inner CDS unmarshals before signing","Validate package files after generation with a load-then-validate step"],"tags":["chaincode","packaging","fabric","validation"],"backgroundTag":"missing-required-payload","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}