hyperledger/fabric · error

Unknown type: %T:%v

Error message

Unknown type: %T:%v

What it means

Policy evaluation hit an identity type in the signed data that the compiled signature-policy evaluator has no case for — an unrecognized msp.Identity implementation was presented, so it cannot be matched against any principal.

Source

Thrown at common/cauthdsl/cauthdsl.go:90

				}
				if cauthdslLogger.IsEnabledFor(zapcore.DebugLevel) {
					// Unlike most places, this is a huge print statement, and worth checking log level before create garbage
					cauthdslLogger.Debugf("%p processing identity %d - %v", signedData, i, sd.GetIdentifier())
				}
				err := sd.SatisfiesPrincipal(signedByID)
				if err != nil {
					cauthdslLogger.Debugf("%p identity %d does not satisfy principal: %s", signedData, i, err)
					continue
				}
				cauthdslLogger.Debugf("%p principal evaluation succeeds for identity %d", signedData, i)
				used[i] = true
				return true
			}
			cauthdslLogger.Debugf("%p principal evaluation fails", signedData)
			return false
		}, nil
	default:
		return nil, fmt.Errorf("Unknown type: %T:%v", t, t)
	}
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Confirm the policy was produced by a compatible Fabric version whose SignaturePolicy variants this evaluator supports
2. Check the rule oneof is explicitly set (SignedBy or NOutOf) before serialization
3. Upgrade the evaluator/library to a version that knows the new rule type

Example fix

// before
rule := &cb.SignaturePolicy{} // Type oneof unset
// after
rule := &cb.SignaturePolicy{Type: &cb.SignaturePolicy_SignedBy{SignedBy: 0}}

if env.Rule == nil || env.Rule.Type == nil {
    return errors.New("SignaturePolicy oneof Type must be set (SignedBy or NOutOf)")
}

func isKnownRuleType(r *cb.SignaturePolicy) bool {
    switch r.GetType().(type) {
    case *cb.SignaturePolicy_SignedBy, *cb.SignaturePolicy_NOutOf_:
        return true
    }
    return false
}

compiled, err := compile(env.Rule, env.Identities)
if err != nil {
    if strings.Contains(err.Error(), "Unknown type") {
        return fmt.Errorf("policy uses an unsupported rule variant: %w", err)
    }
    return err
}

When it happens

Trigger: Evaluating a SignaturePolicy proto whose oneof Type is nil or set to a variant the cauthdsl compiler does not implement (e.g. a future/unknown variant produced by a different Fabric version), typically reached via provider.NewPolicy -> compile.

Common situations: Binary incompatibility where a policy was written by a newer Fabric runtime with additional rule types; proto payload where the oneof field was never set; fuzzed or tampered policy bytes that still unmarshal cleanly.

Related errors

• identity index out of range, requested %v, but identities le
• policy with reference '%s' on channel '%s' is not convertibl
• invalid signature policy: %s
• Empty policy element
• Error unmarshalling to SignaturePolicy: %s

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/9dc3b4a00b3b1d50. Report an issue: GitHub.