hyperledger/fabric · error

GetSignatureHeaderFromBytes failed, err %s

Error message

GetSignatureHeaderFromBytes failed, err %s

What it means

EnvelopeAsSignedData unmarshals Payload.Header.SignatureHeader into a common.SignatureHeader to obtain the creator identity. If those bytes fail proto unmarshaling, the envelope is structurally corrupt and this wrapped error reports the underlying unmarshal failure.

Source

Thrown at protoutil/signeddata.go:79

func EnvelopeAsSignedData(env *common.Envelope) ([]*SignedData, error) {
	if env == nil {
		return nil, errors.New("No signatures for nil Envelope")
	}

	payload := &common.Payload{}
	err := proto.Unmarshal(env.Payload, payload)
	if err != nil {
		return nil, err
	}

	if payload.Header == nil /* || payload.Header.SignatureHeader == nil */ {
		return nil, errors.New("Missing Header")
	}

	shdr := &common.SignatureHeader{}
	err = proto.Unmarshal(payload.Header.SignatureHeader, shdr)
	if err != nil {
		return nil, fmt.Errorf("GetSignatureHeaderFromBytes failed, err %s", err)
	}

	return []*SignedData{{
		Data:      env.Payload,
		Identity:  shdr.Creator,
		Signature: env.Signature,
	}}, nil
}

// LogMessageForSerializedIdentity returns a string with serialized identity information,
// or a string indicating why the serialized identity information cannot be returned.
// Any errors are intentionally returned in the return strings so that the function can be used in single-line log messages with minimal clutter.
func LogMessageForSerializedIdentity(serializedIdentity []byte) string {
	id := &msp.SerializedIdentity{}
	err := proto.Unmarshal(serializedIdentity, id)
	if err != nil {
		return fmt.Sprintf("Could not unmarshal serialized identity: %s", err)
	}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Regenerate the envelope with a properly marshaled SignatureHeader (protoutil.MakeSignatureHeader + MakePayloadHeader).
2. Verify the bytes assigned to SignatureHeader are the canonical serialization of a common.SignatureHeader (creator + nonce).
3. Check for corruption in transit/storage — re-fetch the block or envelope from the source.
4. If a custom client constructs headers, round-trip test: unmarshal what you marshal before signing.

Example fix

// before
payload.Header = &common.Header{SignatureHeader: rawRandomBytes}

// after
shdr := &common.SignatureHeader{Creator: creator, Nonce: nonce}
if payload.Header == nil {
    payload.Header = &common.Header{}
}
payload.Header.SignatureHeader = protoutil.MarshalOrPanic(shdr)

shdr := &common.SignatureHeader{}
if err := proto.Unmarshal(payload.Header.SignatureHeader, shdr); err != nil {
    return fmt.Errorf("invalid signature header bytes: %w", err)
}
if len(shdr.Creator) == 0 || len(shdr.Nonce) == 0 {
    return errors.New("signature header needs creator and nonce")
}

func parseSignatureHeader(b []byte) (*common.SignatureHeader, bool) {
    sh := &common.SignatureHeader{}
    if proto.Unmarshal(b, sh) != nil || sh == nil {
        return nil, false
    }
    return sh, true
}

sd, err := protoutil.EnvelopeAsSignedData(env)
if err != nil {
    if strings.HasPrefix(err.Error(), "GetSignatureHeaderFromBytes failed") {
        return fmt.Errorf("corrupt envelope rejected: %w", err)
    }
    return err
}

When it happens

Trigger: An envelope whose Payload.Header.SignatureHeader bytes are not a valid protobuf SignatureHeader — random bytes placed in the field, bytes from a different message type, or truncation/corruption in transit or storage.

Common situations: Hand-crafted envelopes in tests with ad-hoc header bytes; blockstore corruption; version-mismatched clients writing incompatible header encodings; proxy/middleware mutating payload bytes.

Understand the failure class

Background: "cannot parse invalid wire-format data", "cannot unmarshal", "failed unmarshalling": protobuf unmarshal errors explained — this error's family across 10 libraries.

Related errors

• error unmarshalling
• error encoding output
• error unmarshalling original config
• error unmarshalling updated config
• config must contain a channel group

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/dcec7808241ac23b. Report an issue: GitHub.