{"record":{"id":"b5dc81dab33e97dc","repo":"hyperledger/fabric","slug":"error-unmarshalling-signaturepolicyenvelope","errorCode":null,"errorMessage":"error unmarshalling SignaturePolicyEnvelope","messagePattern":"error unmarshalling SignaturePolicyEnvelope","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"protoutil/unmarshalers.go","lineNumber":200,"sourceCode":"// UnmarshalKVRWSet unmarshals bytes to a KVRWSet\nfunc UnmarshalKVRWSet(bytes []byte) (*kvrwset.KVRWSet, error) {\n\trws := &kvrwset.KVRWSet{}\n\terr := proto.Unmarshal(bytes, rws)\n\treturn rws, errors.Wrap(err, \"error unmarshalling KVRWSet\")\n}\n\n// UnmarshalHashedRWSet unmarshals bytes to a HashedRWSet\nfunc UnmarshalHashedRWSet(bytes []byte) (*kvrwset.HashedRWSet, error) {\n\thrws := &kvrwset.HashedRWSet{}\n\terr := proto.Unmarshal(bytes, hrws)\n\treturn hrws, errors.Wrap(err, \"error unmarshalling HashedRWSet\")\n}\n\n// UnmarshalSignaturePolicy unmarshals bytes to a SignaturePolicyEnvelope\nfunc UnmarshalSignaturePolicy(bytes []byte) (*common.SignaturePolicyEnvelope, error) {\n\tsp := &common.SignaturePolicyEnvelope{}\n\terr := proto.Unmarshal(bytes, sp)\n\treturn sp, errors.Wrap(err, \"error unmarshalling SignaturePolicyEnvelope\")\n}\n\n// UnmarshalPayloadOrPanic unmarshals bytes to a Payload structure or panics\n// on error\nfunc UnmarshalPayloadOrPanic(encoded []byte) *common.Payload {\n\tpayload, err := UnmarshalPayload(encoded)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\treturn payload\n}\n\n// UnmarshalEnvelopeOrPanic unmarshals bytes to an Envelope structure or panics\n// on error\nfunc UnmarshalEnvelopeOrPanic(encoded []byte) *common.Envelope {\n\tenvelope, err := UnmarshalEnvelope(encoded)\n\tif err != nil {\n\t\tpanic(err)","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/protoutil/unmarshalers.go#L182-L218","documentation":"UnmarshalSignaturePolicy wraps proto.Unmarshal failures for common.SignaturePolicyEnvelope bytes. It is returned when policy bytes are malformed, not a SignaturePolicyEnvelope, or the wrong serialization (e.g. YAML/JSON policy text instead of marshalled proto). Only parsing tooling (parseWritesetMetadata, info commands) calls it.","triggerScenarios":"Calling UnmarshalSignaturePolicy on a policy definition string that was never proto-marshalled, empty bytes, policy bytes stored by an incompatible Fabric version, or truncated config values.","commonSituations":"Inspecting collection/lifecycle endorsement policies, CLI 'info' commands decoding policy metadata, or operators passing raw policy strings where marshalled bytes are expected.","solutions":["Ensure the bytes are proto.Marshal output of a SignaturePolicyEnvelope, not a policy expression string (use cauthdsl/policy parsers for strings first)","Check the policy bytes are non-empty before unmarshalling","Re-marshal the policy with the same fabric-protos version if it came from an older network","Validate the decoded envelope's identities/rules are sane before trusting it"],"exampleFix":"// before\nsp, err := protoutil.UnmarshalSignaturePolicy([]byte(\"AND('Org1.peer')\")) // string, not proto\n// after\nenv, err := cauthdsl.FromString(\"AND('Org1.peer')\")\nspBytes, _ := proto.Marshal(env)\nsp, err := protoutil.UnmarshalSignaturePolicy(spBytes)","handlingStrategy":"validation","validationCode":"func validPolicyBytes(b []byte) bool {\n    if len(b) == 0 { return false }\n    sp, err := protoutil.UnmarshalSignaturePolicy(b)\n    return err == nil && sp != nil && sp.Rule != nil\n}","typeGuard":"func safeUnmarshalPolicy(b []byte) (sp *common.SignaturePolicyEnvelope, ok bool) {\n    sp, err := protoutil.UnmarshalSignaturePolicy(b)\n    return sp, err == nil && sp != nil\n}","tryCatchPattern":"sp, err := protoutil.UnmarshalSignaturePolicy(policyBytes)\nif err != nil {\n    return nil, fmt.Errorf(\"policy bytes are not a marshalled SignaturePolicyEnvelope: %w\", err)\n}","preventionTips":["Never pass policy expression strings directly; convert with cauthdsl.FromString first","Verify stored policy bytes were written as marshalled proto, not JSON/YAML","Guard empty bytes from config/metadata lookups","Re-encode policies when migrating across Fabric versions"],"tags":["protobuf","unmarshal","fabric","signature-policy"],"backgroundTag":"proto-unmarshal-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}