hyperledger/fabric · error

Empty signature

Error message

Empty signature

What it means

Guard in SignedGossipMessage.Verify: the envelope has no signature bytes, so the Verifier cannot check authenticity. This fires when an envelope was built without running the signer or the signature was stripped.

Source

Thrown at gossip/protoext/signing.go:136

		Payload:        payload,
		Signature:      sig,
		SecretEnvelope: secretEnvelope,
	}
	m.Envelope = e
	return e, nil
}

// Verify verifies a signed GossipMessage with a given Verifier.
// Returns nil on success, error on failure.
func (m *SignedGossipMessage) Verify(peerIdentity []byte, verify Verifier) error {
	if m.Envelope == nil {
		return errors.New("Missing envelope")
	}
	if len(m.Envelope.Payload) == 0 {
		return errors.New("Empty payload")
	}
	if len(m.Envelope.Signature) == 0 {
		return errors.New("Empty signature")
	}
	payloadSigVerificationErr := verify(peerIdentity, m.Envelope.Signature, m.Envelope.Payload)
	if payloadSigVerificationErr != nil {
		return payloadSigVerificationErr
	}
	if m.Envelope.SecretEnvelope != nil {
		payload := m.Envelope.SecretEnvelope.Payload
		sig := m.Envelope.SecretEnvelope.Signature
		if len(payload) == 0 {
			return errors.New("Empty payload")
		}
		if len(sig) == 0 {
			return errors.New("Empty signature")
		}
		return verify(peerIdentity, sig, payload)
	}
	return nil
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Verify that the sender signed the payload (Sign produces both payload and signature in the envelope)
2. Distinguish legitimate unsigned local messages (use NoopSign context) from remote messages, which must always carry a signature
3. Drop the message and log the peer/channel so the source of unsigned envelopes can be investigated

When it happens

Trigger: Thrown at gossip/protoext/signing.go:136 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/c6ab86ea17f16667. Report an issue: GitHub.