{"record":{"id":"b4b2a7d2497961c4","repo":"hyperledger/fabric","slug":"invalid-creator-specified-in-the-header","errorCode":null,"errorMessage":"invalid creator specified in the header","messagePattern":"invalid creator specified in the header","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/common/validation/msgvalidation.go","lineNumber":80,"sourceCode":"\n\treturn nil\n}\n\n// checks for a valid SignatureHeader\nfunc validateSignatureHeader(sHdr *common.SignatureHeader) error {\n\t// check for nil argument\n\tif sHdr == nil {\n\t\treturn errors.New(\"nil SignatureHeader provided\")\n\t}\n\n\t// ensure that there is a nonce\n\tif len(sHdr.Nonce) == 0 {\n\t\treturn errors.New(\"invalid nonce specified in the header\")\n\t}\n\n\t// ensure that there is a creator\n\tif len(sHdr.Creator) == 0 {\n\t\treturn errors.New(\"invalid creator specified in the header\")\n\t}\n\n\treturn nil\n}\n\n// checks for a valid ChannelHeader\nfunc validateChannelHeader(cHdr *common.ChannelHeader) error {\n\t// check for nil argument\n\tif cHdr == nil {\n\t\treturn errors.New(\"nil ChannelHeader provided\")\n\t}\n\n\t// validate the header type\n\tswitch common.HeaderType(cHdr.Type) {\n\tcase common.HeaderType_ENDORSER_TRANSACTION:\n\tcase common.HeaderType_CONFIG_UPDATE:\n\tcase common.HeaderType_CONFIG:\n\tdefault:","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/common/validation/msgvalidation.go#L62-L98","documentation":"validateSignatureHeader also requires a non-empty Creator in the SignatureHeader. The Creator bytes identify the submitting identity and are deserialized later by the MSP; without them the signature cannot be attributed to any identity, so the header is rejected.","triggerScenarios":"Envelope's SignatureHeader.Creator is empty because the client did not serialize its identity (mspid/cert) into the header, or the identity-serialization step failed silently upstream.","commonSituations":"Custom clients not calling the identity serializer; missing or malformed client MSP credentials causing an empty creator to be written; SDK misconfiguration where the signing identity was not loaded; incomplete test fixtures.","solutions":["Set SignatureHeader.Creator to the serialized signing identity (from the local MSP / SDK identity) before signing","Verify client identity credentials are correctly configured and loaded (certificate + signing key present)","Check the SDK's creator/population logic — ensure the identity context is passed to the transaction builder","Validate in tests that the SignatureHeader contains both Nonce and Creator"],"exampleFix":"// before\nshdr := &common.SignatureHeader{Nonce: nonce} // Creator missing\n// after\nserializedID, err := signingIdentity.Serialize()\nif err != nil {\n    return err\n}\nshdr := &common.SignatureHeader{Nonce: nonce, Creator: serializedID}","handlingStrategy":"validation","validationCode":"func creatorPresent(shdr *common.SignatureHeader) bool {\n    return shdr != nil && len(shdr.Creator) > 0\n}","typeGuard":null,"tryCatchPattern":"if err != nil && err.Error() == \"invalid creator specified in the header\" {\n    // load/serialize the signing identity and rebuild the header\n}","preventionTips":["Serialize the signing identity via the local MSP before building the SignatureHeader","Verify client MSP credentials (cert + key) are loaded at startup","Fail fast if identity serialization returns empty bytes"],"tags":["hyperledger-fabric","validation","creator-identity","signature-header"],"backgroundTag":"missing-creator-identity","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}