hyperledger/fabric · error

invalid signature policy rule '%s'

Error message

invalid signature policy rule '%s'

What it means

Wrapped error in AddPolicies: the SignaturePolicyType policy's Rule string could not be parsed by policydsl.FromString. The user-supplied rule in the config profile (e.g. in configtx.yaml) is not a valid signature policy DSL expression such as "AND('Org1.peer', 'Org2.peer')"; the wrapped error describes the parse failure.

Source

Thrown at internal/configtxgen/encoder/encoder.go:115

	for policyName, policy := range policyMap {
		switch policy.Type {
		case ImplicitMetaPolicyType:
			imp, err := policies.ImplicitMetaFromString(policy.Rule)
			if err != nil {
				return errors.Wrapf(err, "invalid implicit meta policy rule '%s'", policy.Rule)
			}
			cg.Policies[policyName] = &cb.ConfigPolicy{
				ModPolicy: modPolicy,
				Policy: &cb.Policy{
					Type:  int32(cb.Policy_IMPLICIT_META),
					Value: protoutil.MarshalOrPanic(imp),
				},
			}
		case SignaturePolicyType:
			sp, err := policydsl.FromString(policy.Rule)
			if err != nil {
				return errors.Wrapf(err, "invalid signature policy rule '%s'", policy.Rule)
			}
			cg.Policies[policyName] = &cb.ConfigPolicy{
				ModPolicy: modPolicy,
				Policy: &cb.Policy{
					Type:  int32(cb.Policy_SIGNATURE),
					Value: protoutil.MarshalOrPanic(sp),
				},
			}
		default:
			return errors.Errorf("unknown policy type: %s", policy.Type)
		}
	}
	return nil
}

// NewChannelGroup defines the root of the channel configuration.  It defines basic operating principles like the hashing
// algorithm used for the blocks, as well as the location of the ordering service.  It will recursively call into the
// NewOrdererGroup, NewConsortiumsGroup, and NewApplicationGroup depending on whether these sub-elements are set in the

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Fix the policy.Rule string in the profile to use valid signature policy DSL syntax, e.g. AND('Org1MSP.peer', 'Org2MSP.peer') or OR(...)
2. Quote MSP principals with single quotes and use only AND/OR/OutOf/NOf operators as documented by policydsl
3. Run configtxgen after editing configtx.yaml; the wrapped parse error names the offending character or token

When it happens

Trigger: Thrown at internal/configtxgen/encoder/encoder.go:115 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/aebf802ff3f1edfa. Report an issue: GitHub.