{"record":{"id":"d5b177413ef547f0","repo":"hyperledger/fabric","slug":"invalid-proposal-s-signatureheader-during-check-po","errorCode":null,"errorMessage":"Invalid Proposal's SignatureHeader during check policy [%s]: [%s]","messagePattern":"Invalid Proposal's SignatureHeader during check policy \\[(.+?)\\]: \\[(.+?)\\]","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/aclmgmt/resourceprovider.go","lineNumber":117,"sourceCode":"\n\t// we will implement other identifiers. In the end we just need a SignedData\n\tvar sd []*protoutil.SignedData\n\tswitch idinfo := idinfo.(type) {\n\tcase *pb.SignedProposal:\n\t\tsignedProp := idinfo\n\t\tproposal, err := protoutil.UnmarshalProposal(signedProp.ProposalBytes)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Failing extracting proposal during check policy with policy [%s]: [%s]\", polName, err)\n\t\t}\n\n\t\theader, err := protoutil.UnmarshalHeader(proposal.Header)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Failing extracting header during check policy [%s]: [%s]\", polName, err)\n\t\t}\n\n\t\tshdr, err := protoutil.UnmarshalSignatureHeader(header.SignatureHeader)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Invalid Proposal's SignatureHeader during check policy [%s]: [%s]\", polName, err)\n\t\t}\n\n\t\tsd = []*protoutil.SignedData{{\n\t\t\tData:      signedProp.ProposalBytes,\n\t\t\tIdentity:  shdr.Creator,\n\t\t\tSignature: signedProp.Signature,\n\t\t}}\n\n\tcase *common.Envelope:\n\t\tvar err error\n\t\tsd, err = protoutil.EnvelopeAsSignedData(idinfo)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\tcase *protoutil.SignedData:\n\t\tsd = []*protoutil.SignedData{idinfo}\n","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/aclmgmt/resourceprovider.go#L99-L135","documentation":"This error is returned by the ACL resource provider's CheckACL when the SignatureHeader bytes carried in a signed proposal cannot be unmarshaled into a valid common.SignatureHeader protobuf. It means the proposal's header is malformed or truncated before policy evaluation can even extract creator identity and nonce. The underlying unmarshal error is embedded in the message.","triggerScenarios":"Calling CheckACL with a SignedProposal whose Proposal.Header.SignatureHeader field is nil, empty, or corrupted bytes; a client (SDK or custom code) that constructed the proposal header incorrectly or re-serialized it wrongly.","commonSituations":"Custom client SDKs assembling proposals by hand; a channel/handler that stripped or replaced header fields; version mismatch between client proto serialization and peer proto definitions; corrupted proposal bytes in transit.","solutions":["Inspect the embedded unmarshal error to confirm the SignatureHeader bytes are invalid.","Regenerate the proposal with a properly serialized common.Header whose SignatureHeader field contains valid creator and nonce bytes.","Verify the client SDK and peer use compatible protobuf definitions of SignatureHeader (creator SerializedIdentity + nonce).","Log the base64 of header.SignatureHeader at the client and decode it offline with protoc to check its structure."],"exampleFix":"// before: manually assembled header with empty SignatureHeader\nhdr.SignatureHeader = []byte{}\n// after: build a proper SignatureHeader\nshdr := &common.SignatureHeader{Creator: serializedIdentityBytes, Nonce: nonce}\nshdrBytes, _ := protoutil.Marshal(shdr)\nhdr.SignatureHeader = shdrBytes","handlingStrategy":"validation","validationCode":"shdr := &common.SignatureHeader{}\nif err := proto.Unmarshal(header.SignatureHeader, shdr); err != nil || len(shdr.Creator) == 0 || len(shdr.Nonce) == 0 {\n    // do not call CheckACL; rebuild the proposal header\n}","typeGuard":"func hasValidSignatureHeader(hdr *common.Header) bool {\n    if hdr == nil || len(hdr.SignatureHeader) == 0 { return false }\n    var sh common.SignatureHeader\n    return proto.Unmarshal(hdr.SignatureHeader, &sh) == nil && len(sh.Creator) > 0\n}","tryCatchPattern":"if err := aclProvider.CheckACL(resName, channelID, signedProp); err != nil {\n    if strings.Contains(err.Error(), \"Invalid Proposal's SignatureHeader\") {\n        // rebuild proposal with a correctly marshaled SignatureHeader and retry once\n    }\n}","preventionTips":["Always build proposals with a supported SDK's proposal factory instead of hand-marshaling headers","Validate the proposal locally (unmarshal SignatureHeader) before signing/sending","Keep client protobuf definitions in sync with the peer's Fabric version"],"tags":["hyperledger-fabric","acl","protobuf","malformed-proposal"],"backgroundTag":"invalid-header-signature","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}