failed evaluating policy on signed data during check policy

Error message

failed evaluating policy on signed data during check policy [%s]: [%s]

What it means

CheckACL built the SignedData from the proposal (data, creator identity, signature) and handed it to the policy evaluator (rp.pEvaluator.Evaluate), which failed. This means the signature over the proposal bytes does not verify under the given identity for the referenced policy, or the policy evaluation itself errored.

Source

Thrown at core/aclmgmt/resourceprovider.go:142

		}}

	case *common.Envelope:
		var err error
		sd, err = protoutil.EnvelopeAsSignedData(idinfo)
		if err != nil {
			return err
		}

	case *protoutil.SignedData:
		sd = []*protoutil.SignedData{idinfo}

	default:
		return InvalidIdInfo(polName)
	}

	err := rp.pEvaluator.Evaluate(polName, sd)
	if err != nil {
		return fmt.Errorf("failed evaluating policy on signed data during check policy [%s]: [%s]", polName, err)
	}

	return nil
}

// -------- resource provider - entry point API used by aclmgmtimpl for doing resource based ACL ----------

// resource getter gets channelconfig.Resources given channel ID
type ResourceGetter func(channelID string) channelconfig.Resources

// resource provider that uses the resource configuration information to provide ACL support
type resourceProvider struct {
	// resource getter
	resGetter ResourceGetter

	// default provider to be used for undefined resources
	defaultProvider defaultACLProvider
}

View on GitHub (pinned to 2736b63f8f)

Solutions

Check the wrapped error from pEvaluator.Evaluate to distinguish signature mismatch from policy-not-found.
Ensure the client signs exactly the marshaled ProposalBytes with the private key matching the creator SerializedIdentity.
Verify the invoking client's MSP membership/role satisfies the ACL policy (e.g. Admins vs Members).
Re-check channel ACL configuration (policy names in configtx.yaml) for the resource being accessed.

Example fix

// before: signing a re-serialized proposal
sig, _ := signer.Sign(newProposalBytes)
// after: sign the exact bytes that are sent
signedProp.ProposalBytes = proposalBytes
sig, _ := signer.Sign(proposalBytes)
signedProp.Signature = sig

Defensive patterns

Strategy: try-catch

Validate before calling

// verify locally that the signature over ProposalBytes is made by the creator identity before submitting
if err := sigVerifier.Verify(signedProp.Creator, signedProp.ProposalBytes, signedProp.Signature); err != nil {
    // re-sign with the matching MSP identity
}

Type guard

func matchesIdentity(sig, data, identity []byte) bool {
    return identityVerifier(identity, data, sig) == nil
}

Try / catch

if err := aclProvider.CheckACL(resName, channelID, signedProp); err != nil {
    if strings.Contains(err.Error(), "failed evaluating policy") {
        // surface the inner Evaluate error; check identity roles and re-sign proposal
    }
}

Prevention

Sign the exact ProposalBytes that will be transmitted — never re-serialize after signing
Confirm the signer's MSP satisfies the channel ACL policy for the resource
Keep ACL policy names in configtx.yaml consistent with what the code checks

When it happens

Trigger: CheckACL invoked with a SignedProposal whose Signature does not match the ProposalBytes signed by the creator identity in the SignatureHeader; the requested polName maps to a policy that rejects or cannot be evaluated for the supplied signed data.

Common situations: Client signing the wrong proposal bytes (e.g. signing a re-serialized copy rather than the original bytes); proposer mutating proposal bytes after signing; wrong MSP identity used to sign; chaincode ACL configuration pointing at a policy that fails for the caller's role.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/f4540bdad7feab47. Report an issue: GitHub.