hyperledger/fabric · error

Error unmarshalling to SignaturePolicy: %s

Error message

Error unmarshalling to SignaturePolicy: %s

What it means

provider.NewPolicy expects the stored policy bytes to be a protobuf-encoded cb.SignaturePolicyEnvelope. proto.Unmarshal failure triggers this wrapped error, so the bytes are not a valid SignaturePolicyEnvelope.

Source

Thrown at common/cauthdsl/policy.go:35

	"google.golang.org/protobuf/proto"
)

type provider struct {
	deserializer msp.IdentityDeserializer
}

// NewPolicyProvider provides a policy generator for cauthdsl type policies
func NewPolicyProvider(deserializer msp.IdentityDeserializer) policies.Provider {
	return &provider{
		deserializer: deserializer,
	}
}

// NewPolicy creates a new policy based on the policy bytes
func (pr *provider) NewPolicy(data []byte) (policies.Policy, proto.Message, error) {
	sigPolicy := &cb.SignaturePolicyEnvelope{}
	if err := proto.Unmarshal(data, sigPolicy); err != nil {
		return nil, nil, fmt.Errorf("Error unmarshalling to SignaturePolicy: %s", err)
	}

	if sigPolicy.Version != 0 {
		return nil, nil, fmt.Errorf("This evaluator only understands messages of version 0, but version was %d", sigPolicy.Version)
	}

	compiled, err := compile(sigPolicy.Rule, sigPolicy.Identities)
	if err != nil {
		return nil, nil, err
	}

	return &policy{
		evaluator:               compiled,
		deserializer:            pr.deserializer,
		signaturePolicyEnvelope: sigPolicy,
	}, sigPolicy, nil
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Verify the bytes are a proto.Marshal output of cb.SignaturePolicyEnvelope, not another policy type (e.g. ImplicitMetaPolicy)
2. Inspect the raw bytes with proto.UnmarshalText or a decoder to identify the actual message type
3. Regenerate/redistribute the channel configuration containing the policy

Example fix

// before
provider.NewPolicy([]byte(" Administrators: majority")) // meta-syntax, not a proto envelope
// after
env := &cb.SignaturePolicyEnvelope{Version: 0, Rule: ..., Identities: ...}
provider.NewPolicy(protoutil.MarshalOrPanic(env))

probe := &cb.SignaturePolicyEnvelope{}
if err := proto.Unmarshal(data, probe); err != nil {
    return fmt.Errorf("bytes are not a SignaturePolicyEnvelope: %w", err)
}

policy, _, err := provider.NewPolicy(data)
if err != nil && strings.Contains(err.Error(), "Error unmarshalling to SignaturePolicy") {
    log.Printf("stored policy bytes are not a SignaturePolicyEnvelope, raw=%x", data)
}

When it happens

Trigger: NewManagerImpl registers a policy whose on-chain/config bytes cannot be unmarshalled into cb.SignaturePolicyEnvelope — wrong protobuf type, truncated data, or non-proto bytes stored under the policy key.

Common situations: A policy bytes blob written as implicit-meta or another format but registered with the signature-policy provider; corrupt channel config block; mismatched proto registration after changing the pb.go packages in use.

Related errors

• failed to unmarshal ApplicationPolicy bytes
• could not unmarshal signature policy envelope
• failed to unmarshal ApplicationPolicy bytes
• could not unmarshal OrganizationUnit from principal
• error unmarshalling

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/59f23f3a7b43f367. Report an issue: GitHub.