hyperledger/fabric · error

Invalid Proposal's SignatureHeader during check policy [%s]:

Error message

Invalid Proposal's SignatureHeader during check policy [%s]: [%s]

What it means

This error is returned by the ACL resource provider's CheckACL when the SignatureHeader bytes carried in a signed proposal cannot be unmarshaled into a valid common.SignatureHeader protobuf. It means the proposal's header is malformed or truncated before policy evaluation can even extract creator identity and nonce. The underlying unmarshal error is embedded in the message.

Source

Thrown at core/aclmgmt/resourceprovider.go:117

	// we will implement other identifiers. In the end we just need a SignedData
	var sd []*protoutil.SignedData
	switch idinfo := idinfo.(type) {
	case *pb.SignedProposal:
		signedProp := idinfo
		proposal, err := protoutil.UnmarshalProposal(signedProp.ProposalBytes)
		if err != nil {
			return fmt.Errorf("Failing extracting proposal during check policy with policy [%s]: [%s]", polName, err)
		}

		header, err := protoutil.UnmarshalHeader(proposal.Header)
		if err != nil {
			return fmt.Errorf("Failing extracting header during check policy [%s]: [%s]", polName, err)
		}

		shdr, err := protoutil.UnmarshalSignatureHeader(header.SignatureHeader)
		if err != nil {
			return fmt.Errorf("Invalid Proposal's SignatureHeader during check policy [%s]: [%s]", polName, err)
		}

		sd = []*protoutil.SignedData{{
			Data:      signedProp.ProposalBytes,
			Identity:  shdr.Creator,
			Signature: signedProp.Signature,
		}}

	case *common.Envelope:
		var err error
		sd, err = protoutil.EnvelopeAsSignedData(idinfo)
		if err != nil {
			return err
		}

	case *protoutil.SignedData:
		sd = []*protoutil.SignedData{idinfo}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Inspect the embedded unmarshal error to confirm the SignatureHeader bytes are invalid.
2. Regenerate the proposal with a properly serialized common.Header whose SignatureHeader field contains valid creator and nonce bytes.
3. Verify the client SDK and peer use compatible protobuf definitions of SignatureHeader (creator SerializedIdentity + nonce).
4. Log the base64 of header.SignatureHeader at the client and decode it offline with protoc to check its structure.

Example fix

// before: manually assembled header with empty SignatureHeader
hdr.SignatureHeader = []byte{}
// after: build a proper SignatureHeader
shdr := &common.SignatureHeader{Creator: serializedIdentityBytes, Nonce: nonce}
shdrBytes, _ := protoutil.Marshal(shdr)
hdr.SignatureHeader = shdrBytes

shdr := &common.SignatureHeader{}
if err := proto.Unmarshal(header.SignatureHeader, shdr); err != nil || len(shdr.Creator) == 0 || len(shdr.Nonce) == 0 {
    // do not call CheckACL; rebuild the proposal header
}

func hasValidSignatureHeader(hdr *common.Header) bool {
    if hdr == nil || len(hdr.SignatureHeader) == 0 { return false }
    var sh common.SignatureHeader
    return proto.Unmarshal(hdr.SignatureHeader, &sh) == nil && len(sh.Creator) > 0
}

if err := aclProvider.CheckACL(resName, channelID, signedProp); err != nil {
    if strings.Contains(err.Error(), "Invalid Proposal's SignatureHeader") {
        // rebuild proposal with a correctly marshaled SignatureHeader and retry once
    }
}

When it happens

Trigger: Calling CheckACL with a SignedProposal whose Proposal.Header.SignatureHeader field is nil, empty, or corrupted bytes; a client (SDK or custom code) that constructed the proposal header incorrectly or re-serialized it wrongly.

Common situations: Custom client SDKs assembling proposals by hand; a channel/handler that stripped or replaced header fields; version mismatch between client proto serialization and peer proto definitions; corrupted proposal bytes in transit.

Related errors

• malformed org definition for org: %s
• error encode input
• message of type %s unknown
• error marshaling: proto: Marshal called with nil
• error marshaling

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/d5b177413ef547f0. Report an issue: GitHub.