hyperledger/fabric · error

failed to unmarshal ApplicationPolicy bytes

Error message

failed to unmarshal ApplicationPolicy bytes

What it means

ApplicationPolicyEvaluator.Evaluate expects policyBytes to be a protobuf-marshalled peer.ApplicationPolicy message. If proto.Unmarshal fails, the bytes are corrupt or not an ApplicationPolicy — wrapped as 'failed to unmarshal ApplicationPolicy bytes'.

Source

Thrown at core/policy/application.go:152

	}

	return p.EvaluateSignedData(signatureSet)
}

func (a *ApplicationPolicyEvaluator) evaluateChannelConfigPolicyReference(channelConfigPolicyReference string, signatureSet []*protoutil.SignedData) error {
	p, err := a.channelPolicyReferenceProvider.NewPolicy(channelConfigPolicyReference)
	if err != nil {
		return errors.WithMessage(err, "could not create evaluator for channel reference policy")
	}

	return p.EvaluateSignedData(signatureSet)
}

func (a *ApplicationPolicyEvaluator) Evaluate(policyBytes []byte, signatureSet []*protoutil.SignedData) error {
	p := &peer.ApplicationPolicy{}
	err := proto.Unmarshal(policyBytes, p)
	if err != nil {
		return errors.Wrap(err, "failed to unmarshal ApplicationPolicy bytes")
	}

	switch policy := p.Type.(type) {
	case *peer.ApplicationPolicy_SignaturePolicy:
		return a.evaluateSignaturePolicy(policy.SignaturePolicy, signatureSet)
	case *peer.ApplicationPolicy_ChannelConfigPolicyReference:
		return a.evaluateChannelConfigPolicyReference(policy.ChannelConfigPolicyReference, signatureSet)
	default:
		return errors.Errorf("unsupported policy type %T", policy)
	}
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Ensure the bytes were produced by proto.Marshal on a peer.ApplicationPolicy (use protoutil helpers) before calling Evaluate
2. If you have a legacy signature policy envelope, wrap it: ApplicationPolicy{Type: &ApplicationPolicy_SignaturePolicy{SignaturePolicy: envelope}} rather than passing raw bytes
3. Re-generate or re-store the policy bytes with the current Fabric protobuf definitions
4. Hex-dump/decode the bytes with `protoc --decode` to confirm the wire format

Example fix

// before
policyEnvelope, _ := cauthdsl.MarshaledPolicy(...)  // wrong wire type
err := evaluator.Evaluate(policyEnvelope, sigData)
// after
appPolicy, _ := proto.Marshal(&peer.ApplicationPolicy{Type: &peer.ApplicationPolicy_SignaturePolicy{
    SignaturePolicy: signaturePolicyEnvelope}})
err := evaluator.Evaluate(appPolicy, sigData)

func isApplicationPolicyBytes(b []byte) error {
    var p peer.ApplicationPolicy
    if err := proto.Unmarshal(b, &p); err != nil {
        return fmt.Errorf("bytes are not a valid ApplicationPolicy: %w", err)
    }
    if p.Type == nil {
        return errors.New("ApplicationPolicy has no Type set")
    }
    return nil
}

func tryUnmarshalApplicationPolicy(b []byte) (*peer.ApplicationPolicy, bool) {
    p := &peer.ApplicationPolicy{}
    if err := proto.Unmarshal(b, p); err != nil || p.Type == nil {
        return nil, false
    }
    return p, true
}

if err := evaluator.Evaluate(policyBytes, sigData); err != nil {
    if strings.Contains(err.Error(), "failed to unmarshal ApplicationPolicy bytes") {
        // re-serialize with proto.Marshal(&peer.ApplicationPolicy{...}) and retry
    }
    return err
}

When it happens

Trigger: Passing raw policy bytes of the wrong type (e.g., a legacy cauthdsl signature-policy envelope, JSON, or a truncated/marshalled-with-different-schema buffer) into Evaluate.

Common situations: Mixing old-style endorsement policy envelopes with the newer ApplicationPolicy format after a Fabric upgrade, chaincode storing policy bytes serialized by a different proto version, corrupted policy bytes persisted in chaincode state or collection config.

Understand the failure class

Background: "cannot parse invalid wire-format data", "cannot unmarshal", "failed unmarshalling": protobuf unmarshal errors explained — this error's family across 10 libraries.

Related errors

• Error unmarshalling to SignaturePolicy: %s
• failed to deserialize values
• error converting envelope to config update: %s
• failed to unmarshal response for transaction %s
• failed to unmarshal ApplicationPolicy bytes

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/7c4d179e9d4ae622. Report an issue: GitHub.