hyperledger/fabric · error

invalid signature policy: %s

Error message

invalid signature policy: %s

What it means

When --signature-policy is provided, createPolicyBytes parses it with policydsl.FromString into a SignaturePolicyEnvelope. If the policy string is not valid policy DSL, the error is returned as "invalid signature policy: <input>". It means the policy text failed to parse, not that the policy was denied.

Source

Thrown at internal/peer/lifecycle/chaincode/common.go:88

	}, nil
}

func createPolicyBytes(signaturePolicy, channelConfigPolicy string) ([]byte, error) {
	if signaturePolicy == "" && channelConfigPolicy == "" {
		// no policy, no problem
		return nil, nil
	}

	if signaturePolicy != "" && channelConfigPolicy != "" {
		// mo policies, mo problems
		return nil, errors.New("cannot specify both \"--signature-policy\" and \"--channel-config-policy\"")
	}

	var applicationPolicy *pb.ApplicationPolicy
	if signaturePolicy != "" {
		signaturePolicyEnvelope, err := policydsl.FromString(signaturePolicy)
		if err != nil {
			return nil, errors.Errorf("invalid signature policy: %s", signaturePolicy)
		}

		applicationPolicy = &pb.ApplicationPolicy{
			Type: &pb.ApplicationPolicy_SignaturePolicy{
				SignaturePolicy: signaturePolicyEnvelope,
			},
		}
	}

	if channelConfigPolicy != "" {
		applicationPolicy = &pb.ApplicationPolicy{
			Type: &pb.ApplicationPolicy_ChannelConfigPolicyReference{
				ChannelConfigPolicyReference: channelConfigPolicy,
			},
		}
	}

	policyBytes := protoutil.MarshalOrPanic(applicationPolicy)

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Check the policy string syntax: e.g. "OR('Org1MSP.peer','Org2MSP.peer')" or "AND('Org1MSP.member','Org2MSP.member')"
2. Quote the whole policy in the shell so single quotes survive: --signature-policy "OR('Org1MSP.peer','Org2MSP.peer')"
3. Verify MSP names exactly match the network's MSP IDs

Example fix

// before
--signature-policy "OR('Org1.peer', Org2.peer)"
// after
--signature-policy "OR('Org1MSP.peer','Org2MSP.peer')"

if _, err := policydsl.FromString(sigPolicy); err != nil {
    return fmt.Errorf("policy %q is not valid policy DSL: %v", sigPolicy, err)
}

if err := cmd.Execute(); err != nil {
    if strings.Contains(err.Error(), "invalid signature policy") {
        // fix the --signature-policy syntax and rerun
    }
}

When it happens

Trigger: createPolicyBytes receives a non-empty --signature-policy value that policydsl.FromString cannot parse (bad syntax, unknown principal, unbalanced quotes/parens).

Common situations: Typos like OR('Org1.peer') with wrong principal naming (must be 'Org1.peer' or MSP.ROLE forms), missing quotes around OR(...) in shell, Windows escaping issues.

Related errors

• Invalid policy name during check policy on signed data on ch
• cannot specify both "--signature-policy" and "--channel-conf
• %s is mandatory and cannot be empty
• enrollment certificate isn't a valid PEM block
• failed to decode PEM block from %s

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/57d5970a6aca46f7. Report an issue: GitHub.