{"record":{"id":"e6a4fdd71e22deb8","repo":"hyperledger/fabric","slug":"invalid-signature-policy-s","errorCode":null,"errorMessage":"invalid signature policy: %s","messagePattern":"invalid signature policy: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/peer/chaincode/common.go","lineNumber":257,"sourceCode":"\treturn ccp, ccpBytes, err\n}\n\nfunc getApplicationPolicy(signaturePolicy, channelConfigPolicy string) (*pb.ApplicationPolicy, error) {\n\tif signaturePolicy == \"\" && channelConfigPolicy == \"\" {\n\t\t// no policy, no problem\n\t\treturn nil, nil\n\t}\n\n\tif signaturePolicy != \"\" && channelConfigPolicy != \"\" {\n\t\t// mo policies, mo problems\n\t\treturn nil, errors.New(`cannot specify both \"--signature-policy\" and \"--channel-config-policy\"`)\n\t}\n\n\tvar applicationPolicy *pb.ApplicationPolicy\n\tif signaturePolicy != \"\" {\n\t\tsignaturePolicyEnvelope, err := policydsl.FromString(signaturePolicy)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Errorf(\"invalid signature policy: %s\", signaturePolicy)\n\t\t}\n\n\t\tapplicationPolicy = &pb.ApplicationPolicy{\n\t\t\tType: &pb.ApplicationPolicy_SignaturePolicy{\n\t\t\t\tSignaturePolicy: signaturePolicyEnvelope,\n\t\t\t},\n\t\t}\n\t}\n\n\tif channelConfigPolicy != \"\" {\n\t\tapplicationPolicy = &pb.ApplicationPolicy{\n\t\t\tType: &pb.ApplicationPolicy_ChannelConfigPolicyReference{\n\t\t\t\tChannelConfigPolicyReference: channelConfigPolicy,\n\t\t\t},\n\t\t}\n\t}\n\n\treturn applicationPolicy, nil","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/internal/peer/chaincode/common.go#L239-L275","documentation":"When the --signature-policy flag is set, getApplicationPolicy parses it with policydsl.FromString into a SignaturePolicyEnvelope. If the policy string is not valid policy DSL (bad syntax, unknown MSP principal identifiers, malformed OR/AND expressions), the library wraps the failure as \"invalid signature policy: <input>\" with the offending string included.","triggerScenarios":"Calling the getCollectionConfigFromBytes/getApplicationPolicy flow with a --signature-policy value that policydsl.FromString rejects, e.g. \"OR('Org1MSP.member'\" (unbalanced quotes), \"AND(Org1MSP.peer)\" (missing quotes), or a nonexistent principal like 'Org9MSP.member'.","commonSituations":"Typos in MSP IDs, using lowercase principals ('org1msp.member' vs 'Org1MSP.member'), quoting issues when the shell strips single quotes, or copying policies from a network with different organization names.","solutions":["Check the policy string against the policy DSL: valid forms include OUTOF, AND, OR with quoted principals like 'Org1MSP.member' or 'Org1MSP.peer'","Verify MSP IDs exist in your channel config (peer channel fetch config)","Quote the policy correctly for your shell (wrap the whole -p argument in double quotes, keep inner single quotes)","Validate incrementally: start with a known-good policy like \"OR('Org1MSP.member')\" and add complexity"],"exampleFix":"// before\n--signature-policy AND(Org1MSP.peer, Org2MSP.peer)\n// after\n--signature-policy \"AND('Org1MSP.peer','Org2MSP.peer')\"","handlingStrategy":"validation","validationCode":"func validateSignaturePolicy(p string) error {\n\tif _, err := policydsl.FromString(p); err != nil {\n\t\treturn fmt.Errorf(\"policy %q is not valid policy DSL: %v\", p, err)\n\t}\n\treturn nil\n}","typeGuard":"func isParseablePolicy(s string) bool { _, err := policydsl.FromString(s); return err == nil }","tryCatchPattern":"envelope, err := policydsl.FromString(sigPolicy)\nif err != nil {\n\treturn fmt.Errorf(\"check quotes, MSP IDs and DSL syntax in --signature-policy %q: %w\", sigPolicy, err)\n}","preventionTips":["Always double-quote the whole -p/--signature-policy argument in shell","Verify MSP IDs against your channel config before writing policies","Test the policy in a dev network first; keep canonical examples per endorsement style"],"tags":["policy","signature-policy","chaincode","fabric"],"backgroundTag":"invalid-policy-syntax","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}