{"record":{"id":"f4540bdad7feab47","repo":"hyperledger/fabric","slug":"failed-evaluating-policy-on-signed-data-during-che","errorCode":null,"errorMessage":"failed evaluating policy on signed data during check policy [%s]: [%s]","messagePattern":"failed evaluating policy on signed data during check policy \\[(.+?)\\]: \\[(.+?)\\]","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/aclmgmt/resourceprovider.go","lineNumber":142,"sourceCode":"\t\t}}\n\n\tcase *common.Envelope:\n\t\tvar err error\n\t\tsd, err = protoutil.EnvelopeAsSignedData(idinfo)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\tcase *protoutil.SignedData:\n\t\tsd = []*protoutil.SignedData{idinfo}\n\n\tdefault:\n\t\treturn InvalidIdInfo(polName)\n\t}\n\n\terr := rp.pEvaluator.Evaluate(polName, sd)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed evaluating policy on signed data during check policy [%s]: [%s]\", polName, err)\n\t}\n\n\treturn nil\n}\n\n// -------- resource provider - entry point API used by aclmgmtimpl for doing resource based ACL ----------\n\n// resource getter gets channelconfig.Resources given channel ID\ntype ResourceGetter func(channelID string) channelconfig.Resources\n\n// resource provider that uses the resource configuration information to provide ACL support\ntype resourceProvider struct {\n\t// resource getter\n\tresGetter ResourceGetter\n\n\t// default provider to be used for undefined resources\n\tdefaultProvider defaultACLProvider\n}","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/aclmgmt/resourceprovider.go#L124-L160","documentation":"CheckACL built the SignedData from the proposal (data, creator identity, signature) and handed it to the policy evaluator (rp.pEvaluator.Evaluate), which failed. This means the signature over the proposal bytes does not verify under the given identity for the referenced policy, or the policy evaluation itself errored.","triggerScenarios":"CheckACL invoked with a SignedProposal whose Signature does not match the ProposalBytes signed by the creator identity in the SignatureHeader; the requested polName maps to a policy that rejects or cannot be evaluated for the supplied signed data.","commonSituations":"Client signing the wrong proposal bytes (e.g. signing a re-serialized copy rather than the original bytes); proposer mutating proposal bytes after signing; wrong MSP identity used to sign; chaincode ACL configuration pointing at a policy that fails for the caller's role.","solutions":["Check the wrapped error from pEvaluator.Evaluate to distinguish signature mismatch from policy-not-found.","Ensure the client signs exactly the marshaled ProposalBytes with the private key matching the creator SerializedIdentity.","Verify the invoking client's MSP membership/role satisfies the ACL policy (e.g. Admins vs Members).","Re-check channel ACL configuration (policy names in configtx.yaml) for the resource being accessed."],"exampleFix":"// before: signing a re-serialized proposal\nsig, _ := signer.Sign(newProposalBytes)\n// after: sign the exact bytes that are sent\nsignedProp.ProposalBytes = proposalBytes\nsig, _ := signer.Sign(proposalBytes)\nsignedProp.Signature = sig","handlingStrategy":"try-catch","validationCode":"// verify locally that the signature over ProposalBytes is made by the creator identity before submitting\nif err := sigVerifier.Verify(signedProp.Creator, signedProp.ProposalBytes, signedProp.Signature); err != nil {\n    // re-sign with the matching MSP identity\n}","typeGuard":"func matchesIdentity(sig, data, identity []byte) bool {\n    return identityVerifier(identity, data, sig) == nil\n}","tryCatchPattern":"if err := aclProvider.CheckACL(resName, channelID, signedProp); err != nil {\n    if strings.Contains(err.Error(), \"failed evaluating policy\") {\n        // surface the inner Evaluate error; check identity roles and re-sign proposal\n    }\n}","preventionTips":["Sign the exact ProposalBytes that will be transmitted — never re-serialize after signing","Confirm the signer's MSP satisfies the channel ACL policy for the resource","Keep ACL policy names in configtx.yaml consistent with what the code checks"],"tags":["hyperledger-fabric","acl","policy-evaluation","signature-verification"],"backgroundTag":"policy-evaluation-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}