{"record":{"id":"c0367faeaf39ee16","repo":"hyperledger/fabric","slug":"failed-deserializing-proposal-creator-during-chann","errorCode":null,"errorMessage":"Failed deserializing proposal creator during channelless check policy with policy [%s]: [%s]","messagePattern":"Failed deserializing proposal creator during channelless check policy with policy \\[(.+?)\\]: \\[(.+?)\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/policy/policy.go","lineNumber":135,"sourceCode":"\tif err != nil {\n\t\treturn fmt.Errorf(\"Failing extracting proposal during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t}\n\n\theader, err := protoutil.UnmarshalHeader(proposal.Header)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Failing extracting header during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t}\n\n\tshdr, err := protoutil.UnmarshalSignatureHeader(header.SignatureHeader)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Invalid Proposal's SignatureHeader during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t}\n\n\t// Deserialize proposal's creator with the local MSP\n\tid, err := p.localMSP.DeserializeIdentity(shdr.Creator)\n\tif err != nil {\n\t\tlogger.Warnw(\"Failed deserializing proposal creator during channelless check policy\", \"error\", err, \"policyName\", policyName, \"identity\", protoutil.LogMessageForSerializedIdentity(shdr.Creator))\n\t\treturn fmt.Errorf(\"Failed deserializing proposal creator during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t}\n\n\t// Load MSPPrincipal for policy\n\tprincipal, err := p.principalGetter.Get(policyName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Failed getting local MSP principal during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t}\n\n\t// Verify that proposal's creator satisfies the principal\n\terr = id.SatisfiesPrincipal(principal)\n\tif err != nil {\n\t\tlogger.Warnw(\"Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy\", \"error\", err, \"policyName\", policyName, \"requiredPrincipal\", principal, \"signingIdentity\", protoutil.LogMessageForSerializedIdentity(shdr.Creator))\n\t\treturn fmt.Errorf(\"Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t}\n\n\t// Verify the signature\n\treturn id.Verify(signedProp.ProposalBytes, signedProp.Signature)\n}","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/policy/policy.go#L117-L153","documentation":"The proposal structure was valid, but the local MSP could not deserialize the creator identity found in the SignatureHeader. DeserializeIdentity fails when shdr.Creator is not a well-formed serialized identity in the local MSP's expected format (mspb.SerializedIdentity), meaning the peer cannot even identify who signed the proposal before evaluating the policy.","triggerScenarios":"Creator bytes are a PEM certificate or raw cert DER instead of a marshaled mspb.SerializedIdentity; the identity was issued by an MSP not trusted/configured on the peer; identity from a different org's MSP; or creator bytes nil/empty.","commonSituations":"Client signed with a cert from an org whose MSP config is missing on the peer; MSP ID renamed or re-enrolled certificates after a CA change; custom SDK writing wrong creator format; mixing identities across Fabric versions/networks.","solutions":["Set the SignatureHeader Creator to the SDK-provided serialized identity (e.g. msp manager SerializationOfIdentity output), never a raw PEM.","Confirm the peer's local MSP (core.yaml / peer msp config) includes the CA chain that issued the signer's certificate.","Verify the signer's cert belongs to an org actually registered in the network config and hasn't expired or been revoked.","Check that the client targets the correct peer/org — identities from one network won't deserialize in another."],"exampleFix":"// before: raw PEM as creator\nshdr := &common.SignatureHeader{Creator: pemBytes}\n\n// after: proper serialized identity\nserializedID, err := mspMgr.Serialize(signingIdentity)\nif err != nil { return err }\nshdr := &common.SignatureHeader{Creator: serializedID, Nonce: nonce}","handlingStrategy":"validation","validationCode":"shdr, err := protoutil.UnmarshalSignatureHeader(hdr.SignatureHeader)\nif err != nil { return err }\nif len(shdr.Creator) == 0 {\n    return errors.New(\"SignatureHeader.Creator is empty\")\n}\nsid := &mspb.SerializedIdentity{}\nif err := proto.Unmarshal(shdr.Creator, sid); err != nil {\n    return fmt.Errorf(\"Creator is not a marshaled SerializedIdentity: %w\", err)\n}\nif sid.Mspid == \"\" || len(sid.IdBytes) == 0 {\n    return errors.New(\"SerializedIdentity missingMspid or cert\")\n}","typeGuard":"func isSerializedIdentity(creator []byte) bool {\n    sid := &mspb.SerializedIdentity{}\n    if err := proto.Unmarshal(creator, sid); err != nil {\n        return false\n    }\n    return sid.Mspid != \"\" && len(sid.IdBytes) > 0\n}","tryCatchPattern":"err := policyMgr.CheckPolicy(policyName, signedProp)\nif err != nil && strings.Contains(err.Error(), \"Failed deserializing proposal creator\") {\n    // verify the signer belongs to an MSP trusted by the peer, re-enroll if needed\n}","preventionTips":["Only put mspb.SerializedIdentity bytes (not raw PEM) in SignatureHeader.Creator","Ensure the signer's org MSP is deployed on the peer (admin/members cacerts)","Keep certificates valid and re-enroll before expiry","Target peers in the same org/network as the signing identity"],"tags":["hyperledger-fabric","msp","identity"],"backgroundTag":"msp-identity-deserialization-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}