{"record":{"id":"c6ab86ea17f16667","repo":"hyperledger/fabric","slug":"empty-signature","errorCode":null,"errorMessage":"Empty signature","messagePattern":"Empty signature","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"gossip/protoext/signing.go","lineNumber":136,"sourceCode":"\t\tPayload:        payload,\n\t\tSignature:      sig,\n\t\tSecretEnvelope: secretEnvelope,\n\t}\n\tm.Envelope = e\n\treturn e, nil\n}\n\n// Verify verifies a signed GossipMessage with a given Verifier.\n// Returns nil on success, error on failure.\nfunc (m *SignedGossipMessage) Verify(peerIdentity []byte, verify Verifier) error {\n\tif m.Envelope == nil {\n\t\treturn errors.New(\"Missing envelope\")\n\t}\n\tif len(m.Envelope.Payload) == 0 {\n\t\treturn errors.New(\"Empty payload\")\n\t}\n\tif len(m.Envelope.Signature) == 0 {\n\t\treturn errors.New(\"Empty signature\")\n\t}\n\tpayloadSigVerificationErr := verify(peerIdentity, m.Envelope.Signature, m.Envelope.Payload)\n\tif payloadSigVerificationErr != nil {\n\t\treturn payloadSigVerificationErr\n\t}\n\tif m.Envelope.SecretEnvelope != nil {\n\t\tpayload := m.Envelope.SecretEnvelope.Payload\n\t\tsig := m.Envelope.SecretEnvelope.Signature\n\t\tif len(payload) == 0 {\n\t\t\treturn errors.New(\"Empty payload\")\n\t\t}\n\t\tif len(sig) == 0 {\n\t\t\treturn errors.New(\"Empty signature\")\n\t\t}\n\t\treturn verify(peerIdentity, sig, payload)\n\t}\n\treturn nil\n}","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/gossip/protoext/signing.go#L118-L154","documentation":"Guard in SignedGossipMessage.Verify: the envelope has no signature bytes, so the Verifier cannot check authenticity. This fires when an envelope was built without running the signer or the signature was stripped.","triggerScenarios":"Thrown at gossip/protoext/signing.go:136 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify that the sender signed the payload (Sign produces both payload and signature in the envelope)","Distinguish legitimate unsigned local messages (use NoopSign context) from remote messages, which must always carry a signature","Drop the message and log the peer/channel so the source of unsigned envelopes can be investigated"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}