hyperledger/fabric · error

must provide an instantiation policy

Error message

must provide an instantiation policy

What it means

OwnerCreateSignedCCDepSpec requires an endorsement (instantiation) policy expressed as a *common.SignaturePolicyEnvelope. When instPolicy is nil there is no policy to embed in the signed package, so the call fails immediately. The library deliberately does not choose a default policy.

Source

Thrown at core/common/ccpackage/ccpackage.go:167

		}

		if endorsementExists {
			endorsements[n] = cip.OwnerEndorsements[0]
		}
	}

	return createSignedCCDepSpec(baseCip.ChaincodeDeploymentSpec, baseCip.InstantiationPolicy, endorsements)
}

// OwnerCreateSignedCCDepSpec creates a package from a ChaincodeDeploymentSpec and
// optionally endorses it
func OwnerCreateSignedCCDepSpec(cds *peer.ChaincodeDeploymentSpec, instPolicy *common.SignaturePolicyEnvelope, owner identity.SignerSerializer) (*common.Envelope, error) {
	if cds == nil {
		return nil, errors.New("invalid chaincode deployment spec")
	}

	if instPolicy == nil {
		return nil, errors.New("must provide an instantiation policy")
	}

	cdsbytes := protoutil.MarshalOrPanic(cds)

	instpolicybytes := protoutil.MarshalOrPanic(instPolicy)

	var endorsements []*peer.Endorsement
	// it is not mandatory (at this protoutil level) to have a signature
	// this is especially convenient during dev/test
	// it may be necessary to enforce it via a policy at a higher level
	if owner != nil {
		// serialize the signing identity
		endorser, err := owner.Serialize()
		if err != nil {
			return nil, fmt.Errorf("Could not serialize the signing identity: %s", err)
		}

		// sign the concatenation of cds, instpolicy and the serialized endorser identity with this endorser's key

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Provide a SignaturePolicyEnvelope, e.g. cauthdsl.SignedByMspMember("Org1MSP") or policies.SignaturePolicyEnvelope built with cauthdsl helpers
2. Pass the same policy used at instantiation when re-signing packages
3. If a system chaincode default is acceptable upstream, ensure the caller layer sets it before reaching ccpackage

Example fix

// before
env, err := ccpackage.OwnerCreateSignedCCDepSpec(cds, nil, signer)
// after
instPolicy := cauthdsl.SignedByAnyMember([]string{"Org1MSP"})
env, err := ccpackage.OwnerCreateSignedCCDepSpec(cds, instPolicy, signer)

if instPolicy == nil {
    instPolicy = cauthdsl.SignedByAnyMember([]string{mspid})
}
env, err := ccpackage.OwnerCreateSignedCCDepSpec(cds, instPolicy, owner)

func hasInstPolicy(p *common.SignaturePolicyEnvelope) bool { return p != nil && p.Rule != nil }

env, err := ccpackage.OwnerCreateSignedCCDepSpec(cds, instPolicy, owner)
if err != nil {
    if strings.Contains(err.Error(), "instantiation policy") {
        return fmt.Errorf("provide -P policy or build one via cauthdsl: %w", err)
    }
    return err
}

When it happens

Trigger: Calling OwnerCreateSignedCCDepSpec(cds, nil, owner) — e.g. omitting the -P policy on `peer chaincode instantiate`, or programmatically building a SignedCDS without cauthdsl policies.

Common situations: Users invoking `peer chaincode instantiate` without -P (older Fabric versions required a policy); SDK code that builds the CDS envelope by hand and forgets SignaturePolicyEnvelope; migrating code that relied on a default policy.

Related errors

• could not get channel config for channel '%s'
• could not get application config for channel '%s'
• no such collection '%s'
• chaincode cache at sequence %d but current sequence is %d, c
• chaincode definition for '%s' at sequence %d on channel '%s'

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/7e149a355be96387. Report an issue: GitHub.