hyperledger/fabric · error

Invalid signed data during check policy on channel [%s] with

Error message

Invalid signed data during check policy on channel [%s] with policy [%s]

What it means

Returned by CheckPolicyBySignedData when the sd (SignedData slice) parameter is nil. Signed data pairs identities with message bytes and signatures; without it there is nothing to evaluate against the policy, so the call is rejected before contacting the policy manager.

Source

Thrown at core/policy/policy.go:167

	}

	// Verify the signature
	return id.Verify(signedProp.ProposalBytes, signedProp.Signature)
}

// CheckPolicyBySignedData checks that the passed signed data is valid with the respect to
// passed policy on the passed channel.
func (p *policyChecker) CheckPolicyBySignedData(channelID, policyName string, sd []*protoutil.SignedData) error {
	if channelID == "" {
		return errors.New("Invalid channel ID name during check policy on signed data. Name must be different from nil.")
	}

	if policyName == "" {
		return fmt.Errorf("Invalid policy name during check policy on signed data on channel [%s]. Name must be different from nil.", channelID)
	}

	if sd == nil {
		return fmt.Errorf("Invalid signed data during check policy on channel [%s] with policy [%s]", channelID, policyName)
	}

	// Get Policy
	policyManager := p.channelPolicyManagerGetter.Manager(channelID)
	if policyManager == nil {
		return fmt.Errorf("Failed to get policy manager for channel [%s]", channelID)
	}

	// Recall that get policy always returns a policy object
	policy, _ := policyManager.GetPolicy(policyName)

	// Evaluate the policy
	err := policy.EvaluateSignedData(sd)
	if err != nil {
		logger.Warnw("Failed evaluating policy on signed data", "error", err, "policyName", policyName, "identities", protoutil.LogMessageForSerializedIdentities(sd))
		return fmt.Errorf("Failed evaluating policy on signed data during check policy on channel [%s] with policy [%s]: [%s]", channelID, policyName, err)
	}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Ensure the proposal is fully created and signed: verify proposal bytes and signature are non-empty before calling.
2. Build the []*protoutil.SignedData correctly (identity, proposal bytes, signature) rather than passing nil.
3. Trace upstream serialization/signing code for silent nil returns and add explicit checks there.

Example fix

// before
err := checker.CheckPolicyBySignedData("mychannel", "CHANNEL_READERS", nil)
// after
sd := []*protoutil.SignedData{{Identity: creator, Data: proposalBytes, Signature: signature}}
if sd == nil { return errors.New("signed data is required") }
err := checker.CheckPolicyBySignedData("mychannel", "CHANNEL_READERS", sd)

if sd == nil || len(sd) == 0 {
    return errors.New("signed data must contain at least one SignedData entry with identity, data, and signature")
}
for _, d := range sd {
    if d.Signature == nil || len(d.Data) == 0 { return errors.New("incomplete SignedData entry") }
}

func isCompleteSignedData(sd []*protoutil.SignedData) bool {
    if len(sd) == 0 { return false }
    for _, d := range sd {
        if len(d.Identity) == 0 || len(d.Data) == 0 || len(d.Signature) == 0 { return false }
    }
    return true
}

When it happens

Trigger: Calling CheckPolicyBySignedData(channelID, policyName, nil), or via CheckPolicy when the proposal bytes/signature could not be assembled into SignedData (nil signature or proposal bytes upstream).

Common situations: A caller passes a partially constructed proposal where signature or proposal bytes are missing; a test harness forgets to populate SignedData; an SDK serialization step silently produced nil payloads.

Related errors

• Invalid channel ID name during check policy on signed data.
• Invalid policy name during check policy on signed data on ch
• %s is mandatory and cannot be empty
• enrollment certificate isn't a valid PEM block
• failed to decode PEM block from %s

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/eb793b7edd102f96. Report an issue: GitHub.