cannot specify both "--signature-policy" and "--channel-conf

Error message

cannot specify both "--signature-policy" and "--channel-config-policy"

What it means

getApplicationPolicy builds an ApplicationPolicy from user-supplied policy flags and refuses to proceed when both a signature policy (--signature-policy) and a channel config policy (--channel-config-policy) are specified, since a single policy reference must be unambiguous. The library throws this plain error to force the user to choose exactly one policy style.

Source

Thrown at internal/peer/chaincode/common.go:250

		}

		ccarray = append(ccarray, cc)
	}

	ccp := &pb.CollectionConfigPackage{Config: ccarray}
	ccpBytes, err := proto.Marshal(ccp)
	return ccp, ccpBytes, err
}

func getApplicationPolicy(signaturePolicy, channelConfigPolicy string) (*pb.ApplicationPolicy, error) {
	if signaturePolicy == "" && channelConfigPolicy == "" {
		// no policy, no problem
		return nil, nil
	}

	if signaturePolicy != "" && channelConfigPolicy != "" {
		// mo policies, mo problems
		return nil, errors.New(`cannot specify both "--signature-policy" and "--channel-config-policy"`)
	}

	var applicationPolicy *pb.ApplicationPolicy
	if signaturePolicy != "" {
		signaturePolicyEnvelope, err := policydsl.FromString(signaturePolicy)
		if err != nil {
			return nil, errors.Errorf("invalid signature policy: %s", signaturePolicy)
		}

		applicationPolicy = &pb.ApplicationPolicy{
			Type: &pb.ApplicationPolicy_SignaturePolicy{
				SignaturePolicy: signaturePolicyEnvelope,
			},
		}
	}

	if channelConfigPolicy != "" {
		applicationPolicy = &pb.ApplicationPolicy{

View on GitHub (pinned to 2736b63f8f)

Solutions

Remove either the --signature-policy or the --channel-config-policy flag; keep only one
If you need a signature policy, delete the --channel-config-policy flag (and vice versa)
Review the constructed command in your script/CI to ensure only one policy flag is populated

Example fix

// before
peer chaincode approveformyorg -C mychannel --signature-policy "OR('Org1MSP.member')" --channel-config-policy /Channel/Application/Endorsement
// after
peer chaincode approveformyorg -C mychannel --signature-policy "OR('Org1MSP.member')"

Defensive patterns

Strategy: validation

Validate before calling

func validatePolicyFlags(signaturePolicy, channelConfigPolicy string) error {
	if signaturePolicy != "" && channelConfigPolicy != "" {
		return errors.New("specify only one of --signature-policy or --channel-config-policy")
	}
	return nil
}

Type guard

func hasExclusivePolicy(sp, ccp string) bool { return (sp == "") != (ccp == "") || (sp == "" && ccp == "") }

Try / catch

if err := validatePolicyFlags(sigPolicy, chanPolicy); err != nil {
	return fmt.Errorf("usage fix: keep exactly one policy flag: %w", err)
}

Prevention

Build commands programmatically, setting only one policy field
Grep scripts for both flags co-occurring in one command
Document your team standard (signature-policy vs channel policy) and lint for it

When it happens

Trigger: Invoking peer CLI commands (e.g. approveformyorg) or building collection configs via getCollectionConfigFromBytes with both --signature-policy and --channel-config-policy flags set to non-empty values.

Common situations: Copy-pasting a command example that had --signature-policy and appending --channel-config-policy from another example; scripts accumulating flags across edits; users trying to 'combine' an implicit policy with an explicit one.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/311bb2020bde80fe. Report an issue: GitHub.