hyperledger/fabric · error

invalid signature policy: %s

Error message

invalid signature policy: %s

What it means

When the --signature-policy flag is set, getApplicationPolicy parses it with policydsl.FromString into a SignaturePolicyEnvelope. If the policy string is not valid policy DSL (bad syntax, unknown MSP principal identifiers, malformed OR/AND expressions), the library wraps the failure as "invalid signature policy: <input>" with the offending string included.

Source

Thrown at internal/peer/chaincode/common.go:257

	return ccp, ccpBytes, err
}

func getApplicationPolicy(signaturePolicy, channelConfigPolicy string) (*pb.ApplicationPolicy, error) {
	if signaturePolicy == "" && channelConfigPolicy == "" {
		// no policy, no problem
		return nil, nil
	}

	if signaturePolicy != "" && channelConfigPolicy != "" {
		// mo policies, mo problems
		return nil, errors.New(`cannot specify both "--signature-policy" and "--channel-config-policy"`)
	}

	var applicationPolicy *pb.ApplicationPolicy
	if signaturePolicy != "" {
		signaturePolicyEnvelope, err := policydsl.FromString(signaturePolicy)
		if err != nil {
			return nil, errors.Errorf("invalid signature policy: %s", signaturePolicy)
		}

		applicationPolicy = &pb.ApplicationPolicy{
			Type: &pb.ApplicationPolicy_SignaturePolicy{
				SignaturePolicy: signaturePolicyEnvelope,
			},
		}
	}

	if channelConfigPolicy != "" {
		applicationPolicy = &pb.ApplicationPolicy{
			Type: &pb.ApplicationPolicy_ChannelConfigPolicyReference{
				ChannelConfigPolicyReference: channelConfigPolicy,
			},
		}
	}

	return applicationPolicy, nil

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Check the policy string against the policy DSL: valid forms include OUTOF, AND, OR with quoted principals like 'Org1MSP.member' or 'Org1MSP.peer'
2. Verify MSP IDs exist in your channel config (peer channel fetch config)
3. Quote the policy correctly for your shell (wrap the whole -p argument in double quotes, keep inner single quotes)
4. Validate incrementally: start with a known-good policy like "OR('Org1MSP.member')" and add complexity

Example fix

// before
--signature-policy AND(Org1MSP.peer, Org2MSP.peer)
// after
--signature-policy "AND('Org1MSP.peer','Org2MSP.peer')"

func validateSignaturePolicy(p string) error {
	if _, err := policydsl.FromString(p); err != nil {
		return fmt.Errorf("policy %q is not valid policy DSL: %v", p, err)
	}
	return nil
}

func isParseablePolicy(s string) bool { _, err := policydsl.FromString(s); return err == nil }

envelope, err := policydsl.FromString(sigPolicy)
if err != nil {
	return fmt.Errorf("check quotes, MSP IDs and DSL syntax in --signature-policy %q: %w", sigPolicy, err)
}

When it happens

Trigger: Calling the getCollectionConfigFromBytes/getApplicationPolicy flow with a --signature-policy value that policydsl.FromString rejects, e.g. "OR('Org1MSP.member'" (unbalanced quotes), "AND(Org1MSP.peer)" (missing quotes), or a nonexistent principal like 'Org9MSP.member'.

Common situations: Typos in MSP IDs, using lowercase principals ('org1msp.member' vs 'Org1MSP.member'), quoting issues when the shell strips single quotes, or copying policies from a network with different organization names.

Related errors

• policy with reference '%s' on channel '%s' is not convertibl
• cannot specify both "--signature-policy" and "--channel-conf
• identity index out of range, requested %v, but identities le
• Unknown type: %T:%v
• only applicable for private data

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/e6a4fdd71e22deb8. Report an issue: GitHub.