{"record":{"id":"c6de15fbcc1b4a3e","repo":"hyperledger/fabric","slug":"failure-opening-codepackage-gzip-stream-s-c6de15","errorCode":null,"errorMessage":"failure opening codepackage gzip stream: %s","messagePattern":"failure opening codepackage gzip stream: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/chaincode/platforms/node/platform.go","lineNumber":85,"sourceCode":"\t\t\treturn fmt.Errorf(\"path to chaincode does not exist: %s\", rawPath)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (p *Platform) ValidateCodePackage(code []byte) error {\n\t// FAB-2122: Scan the provided tarball to ensure it only contains source-code under\n\t// the src folder.\n\t//\n\t// It should be noted that we cannot catch every threat with these techniques.  Therefore,\n\t// the container itself needs to be the last line of defense and be configured to be\n\t// resilient in enforcing constraints. However, we should still do our best to keep as much\n\t// garbage out of the system as possible.\n\tre := regexp.MustCompile(`^(/)?(src|META-INF)/.*`)\n\tis := bytes.NewReader(code)\n\tgr, err := gzip.NewReader(is)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failure opening codepackage gzip stream: %s\", err)\n\t}\n\ttr := tar.NewReader(gr)\n\n\tfoundPackageJson := false\n\tfor {\n\t\theader, err := tr.Next()\n\t\tif err != nil {\n\t\t\t// We only get here if there are no more entries to scan\n\t\t\tbreak\n\t\t}\n\n\t\t// --------------------------------------------------------------------------------------\n\t\t// Check name for conforming path\n\t\t// --------------------------------------------------------------------------------------\n\t\tif !re.MatchString(header.Name) {\n\t\t\treturn fmt.Errorf(\"illegal file detected in payload: \\\"%s\\\"\", header.Name)\n\t\t}\n\t\tif header.Name == \"src/package.json\" {","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/chaincode/platforms/node/platform.go#L67-L103","documentation":"ValidateCodePackage for the Node platform expects the package to be a gzip-compressed tar. It wraps the submitted bytes in gzip.NewReader; non-gzip input fails immediately with this error carrying the underlying cause.","triggerScenarios":"Calling ValidateCodePackage with bytes that are not valid gzip: raw tar, zip archive, plain JS text, empty buffer, or a truncated/corrupt gzip stream.","commonSituations":"Passing a .tar instead of .tar.gz; a packaging tool that emitted uncompressed output; transfer corruption or bad base64 round-trip; partially uploaded package.","solutions":["Repackage the chaincode as gzip-compressed tar (tar -czf) and retry","Validate with `gzip -t package.tgz` before submitting","Regenerate the package to rule out truncation or empty output","Ensure the upload/encoding path preserves binary data intact"],"exampleFix":"// before\npayload, _ := os.ReadFile(\"package.tar\") // not gzipped\nerr := platform.ValidateCodePackage(payload)\n// after\npayload, _ := os.ReadFile(\"package.tar.gz\")\nerr := platform.ValidateCodePackage(payload)","handlingStrategy":"validation","validationCode":"if _, err := gzip.NewReader(bytes.NewReader(payload)); err != nil { return errors.New(\"not valid gzip\") }","typeGuard":null,"tryCatchPattern":"if err := platform.ValidateCodePackage(code); err != nil && strings.Contains(err.Error(), \"failure opening codepackage gzip stream\") {\n    // rebuild package as gzipped tar\n}","preventionTips":["Package with tar -czf","gzip -t before submit","Avoid text re-encoding of binaries"],"tags":["chaincode","node","gzip","packaging"],"backgroundTag":"invalid-archive-format","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}