hyperledger/fabric · error

failure opening codepackage gzip stream: %s

Error message

failure opening codepackage gzip stream: %s

What it means

ValidateCodePackage for the Node platform expects the package to be a gzip-compressed tar. It wraps the submitted bytes in gzip.NewReader; non-gzip input fails immediately with this error carrying the underlying cause.

Source

Thrown at core/chaincode/platforms/node/platform.go:85

			return fmt.Errorf("path to chaincode does not exist: %s", rawPath)
		}
	}
	return nil
}

func (p *Platform) ValidateCodePackage(code []byte) error {
	// FAB-2122: Scan the provided tarball to ensure it only contains source-code under
	// the src folder.
	//
	// It should be noted that we cannot catch every threat with these techniques.  Therefore,
	// the container itself needs to be the last line of defense and be configured to be
	// resilient in enforcing constraints. However, we should still do our best to keep as much
	// garbage out of the system as possible.
	re := regexp.MustCompile(`^(/)?(src|META-INF)/.*`)
	is := bytes.NewReader(code)
	gr, err := gzip.NewReader(is)
	if err != nil {
		return fmt.Errorf("failure opening codepackage gzip stream: %s", err)
	}
	tr := tar.NewReader(gr)

	foundPackageJson := false
	for {
		header, err := tr.Next()
		if err != nil {
			// We only get here if there are no more entries to scan
			break
		}

		// --------------------------------------------------------------------------------------
		// Check name for conforming path
		// --------------------------------------------------------------------------------------
		if !re.MatchString(header.Name) {
			return fmt.Errorf("illegal file detected in payload: \"%s\"", header.Name)
		}
		if header.Name == "src/package.json" {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Repackage the chaincode as gzip-compressed tar (tar -czf) and retry
2. Validate with `gzip -t package.tgz` before submitting
3. Regenerate the package to rule out truncation or empty output
4. Ensure the upload/encoding path preserves binary data intact

Example fix

// before
payload, _ := os.ReadFile("package.tar") // not gzipped
err := platform.ValidateCodePackage(payload)
// after
payload, _ := os.ReadFile("package.tar.gz")
err := platform.ValidateCodePackage(payload)

if _, err := gzip.NewReader(bytes.NewReader(payload)); err != nil { return errors.New("not valid gzip") }

if err := platform.ValidateCodePackage(code); err != nil && strings.Contains(err.Error(), "failure opening codepackage gzip stream") {
    // rebuild package as gzipped tar
}

When it happens

Trigger: Calling ValidateCodePackage with bytes that are not valid gzip: raw tar, zip archive, plain JS text, empty buffer, or a truncated/corrupt gzip stream.

Common situations: Passing a .tar instead of .tar.gz; a packaging tool that emitted uncompressed output; transfer corruption or bad base64 round-trip; partially uploaded package.

Related errors

• failure opening codepackage gzip stream: %s
• did not find a code package inside the package
• did not find any package metadata (missing %s)
• Error writing %s to tar: %s
• failed to create tar for chaincode

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/c6de15fbcc1b4a3e. Report an issue: GitHub.