Invalid policy name during channelless check policy. Name mu

Error message

Invalid policy name during channelless check policy. Name must be different from nil.

What it means

CheckPolicyNoChannel validates a signed proposal against a named policy on the local MSP without a channel. The policyName must be a non-empty string; if it is empty (the message says 'nil' but the check is against the empty string), the call is rejected immediately with this static error.

Source

Thrown at core/policy/policy.go:109

	shdr, err := protoutil.UnmarshalSignatureHeader(header.SignatureHeader)
	if err != nil {
		return fmt.Errorf("Invalid Proposal's SignatureHeader during check policy on channel [%s] with policy [%s]: [%s]", channelID, policyName, err)
	}

	sd := []*protoutil.SignedData{{
		Data:      signedProp.ProposalBytes,
		Identity:  shdr.Creator,
		Signature: signedProp.Signature,
	}}

	return p.CheckPolicyBySignedData(channelID, policyName, sd)
}

// CheckPolicyNoChannel checks that the passed signed proposal is valid with the respect to
// passed policy on the local MSP.
func (p *policyChecker) CheckPolicyNoChannel(policyName string, signedProp *pb.SignedProposal) error {
	if policyName == "" {
		return errors.New("Invalid policy name during channelless check policy. Name must be different from nil.")
	}

	if signedProp == nil {
		return fmt.Errorf("Invalid signed proposal during channelless check policy with policy [%s]", policyName)
	}

	proposal, err := protoutil.UnmarshalProposal(signedProp.ProposalBytes)
	if err != nil {
		return fmt.Errorf("Failing extracting proposal during channelless check policy with policy [%s]: [%s]", policyName, err)
	}

	header, err := protoutil.UnmarshalHeader(proposal.Header)
	if err != nil {
		return fmt.Errorf("Failing extracting header during channelless check policy with policy [%s]: [%s]", policyName, err)
	}

	shdr, err := protoutil.UnmarshalSignatureHeader(header.SignatureHeader)
	if err != nil {

View on GitHub (pinned to 2736b63f8f)

Solutions

Supply a valid non-empty policy name (e.g. "Users", "Admins", or "/Channel/Application/Readers")
Fix the config/env sourcing so the policy name variable is populated before the call
Validate the policy name in the caller before invoking CheckPolicyNoChannel

Example fix

// before
policyName := os.Getenv("POLICY") // empty
err := pc.CheckPolicyNoChannel(policyName, signedProp)
// after
policyName := os.Getenv("POLICY")
if policyName == "" { return errors.New("policy name required") }
err := pc.CheckPolicyNoChannel(policyName, signedProp)

Defensive patterns

Strategy: validation

Validate before calling

if (policyName == null || policyName.isEmpty()) {
    throw new IllegalArgumentException("policyName required for channelless check");
}

Type guard

function hasPolicyName(name) { return typeof name === 'string' && name.trim().length > 0; }

Try / catch

err := checker.CheckPolicyNoChannel(policyName, signedProp)
if err != nil {
    if strings.Contains(err.Error(), "Invalid policy name during channelless check policy") {
        // configuration problem: correct the policy name source
    }
    return err
}

Prevention

Validate config values at startup
Provide defaults for policy names
Use constants for canonical policy names
Trim inputs before validation

When it happens

Trigger: Calling CheckPolicyNoChannel (directly or via CheckPolicy's channelless path) with policyName set to "" or an unset variable.

Common situations: Config where the policy name is read from a config/env var that is missing; callers confusing channel policy names with channelless policy names; a client omitting the policy name in an ACL-check request.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/9b9b2e3876f75d89. Report an issue: GitHub.