instantiation policy cannot be nil for a SignedCCDeploymentS

Error message

instantiation policy cannot be nil for a SignedCCDeploymentSpec

What it means

GetInstantiationPolicy returns this error when the supplied chaincode package is a SignedCDSPackage but its instantiation policy is nil. Every signed chaincode deployment spec must carry an instantiation policy (it controls who can instantiate the chaincode), so a missing policy is treated as a hard error rather than falling back to the default admin policy used for non-SignedCDSPackages.

Source

Thrown at core/scc/lscc/support.go:56

}

// GetChaincodesFromLocalStorage returns an array of all chaincode
// data that have previously been persisted to local storage
func (s *SupportImpl) GetChaincodesFromLocalStorage() (*pb.ChaincodeQueryResponse, error) {
	return ccprovider.GetInstalledChaincodes()
}

// GetInstantiationPolicy returns the instantiation policy for the
// supplied chaincode (or the channel's default if none was specified)
func (s *SupportImpl) GetInstantiationPolicy(channel string, ccpack ccprovider.CCPackage) ([]byte, error) {
	var ip []byte
	var err error
	// if ccpack is a SignedCDSPackage, return its IP, otherwise use a default IP
	sccpack, isSccpack := ccpack.(*ccprovider.SignedCDSPackage)
	if isSccpack {
		ip = sccpack.GetInstantiationPolicy()
		if ip == nil {
			return nil, errors.Errorf("instantiation policy cannot be nil for a SignedCCDeploymentSpec")
		}
	} else {
		// the default instantiation policy allows any of the channel MSP admins
		// to be able to instantiate
		mspids := s.GetMSPIDs(channel)

		p := policydsl.SignedByAnyAdmin(mspids)
		ip, err = protoutil.Marshal(p)
		if err != nil {
			return nil, errors.Errorf("error marshalling default instantiation policy")
		}
	}
	return ip, nil
}

// CheckInstantiationPolicy checks whether the supplied signed proposal
// complies with the supplied instantiation policy
func (s *SupportImpl) CheckInstantiationPolicy(signedProp *pb.SignedProposal, chainName string, instantiationPolicy []byte) error {

View on GitHub (pinned to 2736b63f8f)

Solutions

Provide a valid instantiation policy in the SignedCCDeploymentSpec (e.g., a signedBy policy on the channel's admin MSP) and re-sign the deployment spec.
Re-generate the signed deployment spec with your SDK, ensuring instantiationPolicy is marshaled (not nil/empty) before signing.
If the policy failed to deserialize, rebuild the package with a supported Fabric SDK/CLI version consistent with the peer's protobuf definitions.
Alternatively, use a plain (non-signed) ChaincodeDeploymentSpec path, which falls back to the default channel-admin instantiation policy.

Example fix

// before
signedDep := &pb.SignedChaincodeDeploymentSpec{ ChaincodeDeploymentSpec: cds } // no instantiation policy
// after
ip, _ := cautils.GetInstantiationPolicy(channel, mspID, cds)
sig, _ := cautils.GetSignature(...) 
signedDep := &pb.SignedChaincodeDeploymentSpec{ ChaincodeDeploymentSpec: cds, InstantiationPolicy: ip, OwnerEndorsements: sig }

Defensive patterns

Strategy: validation

Validate before calling

// validate the signed spec before submitting the instantiate proposal
if signedDep.InstantiationPolicy == nil || len(signedDep.InstantiationPolicy) == 0 {
    return errors.New("SignedCCDeploymentSpec must carry a non-empty instantiation policy")
}

Type guard

func hasInstantiationPolicy(s *pb.SignedChaincodeDeploymentSpec) bool {
    return s != nil && len(s.InstantiationPolicy) > 0
}

Try / catch

// Go: detect the policy error and instruct the caller to re-sign the spec
if err := instantiateChaincode(...); err != nil {
    if strings.Contains(err.Error(), "instantiation policy cannot be nil") {
        return fmt.Errorf("rebuild the SignedCCDeploymentSpec with an instantiation policy: %w", err)
    }
    return err
}

Prevention

Always populate InstantiationPolicy when constructing SignedChaincodeDeploymentSpec (SDK helpers can generate a default admin policy).
Validate the signed spec client-side (policy non-nil, signature matches) before sending the proposal.
Keep SDK versions aligned with the peer's Fabric version to avoid dropped policy fields.
Prefer current lifecycle (_lifecycle) which removes signed-spec instantiation policies entirely.

When it happens

Trigger: Calling GetInstantiationPolicy (during LSCC's executeInstantiateOrUpgrade path) with a ccpack that is a *ccprovider.SignedCDSPackage whose GetInstantiationPolicy() yields nil — i.e., a SignedCCDeploymentSpec submitted without an instantiation policy, or a package whose policy failed to parse into the expected format.

Common situations: Building a SignedCCDeploymentSpec manually via SDK/CLI and omitting the escc/vscc/instantiationPolicy fields; signing a deployment spec with a corrupted or dropped instantiation policy; Fabric SDK versions that don't populate instantiationPolicy on signed proposals.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/36642b0c67d844d7. Report an issue: GitHub.