{"record":{"id":"49193c9cde6fef54","repo":"hyperledger/fabric","slug":"invalid-peer-identity-it-must-be-different-from-n","errorCode":null,"errorMessage":"Invalid Peer Identity. It must be different from nil.","messagePattern":"Invalid Peer Identity\\. It must be different from nil\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/peer/gossip/mcs.go","lineNumber":252,"sourceCode":"\t\t// The signature is validated directly\n\t\treturn identity.Verify(message, signature)\n\t}\n\n\t// At this stage, the signature must be validated\n\t// against the reader policy of the channel\n\t// identified by chainID\n\n\treturn s.VerifyByChannel(chainID, peerIdentity, signature, message)\n}\n\n// VerifyByChannel checks that signature is a valid signature of message\n// under a peer's verification key, but also in the context of a specific channel.\n// If the verification succeeded, Verify returns nil meaning no error occurred.\n// If peerIdentity is nil, then the verification fails.\nfunc (s *MSPMessageCryptoService) VerifyByChannel(chainID common.ChannelID, peerIdentity api.PeerIdentityType, signature, message []byte) error {\n\t// Validate arguments\n\tif len(peerIdentity) == 0 {\n\t\treturn errors.New(\"Invalid Peer Identity. It must be different from nil.\")\n\t}\n\n\t// Get the policy manager for channel chainID\n\tcpm := s.channelPolicyManagerGetter.Manager(string(chainID))\n\tif cpm == nil {\n\t\treturn fmt.Errorf(\"Could not acquire policy manager for channel %s\", string(chainID))\n\t}\n\tmcsLogger.Debugf(\"Got policy manager for channel [%s]\", string(chainID))\n\n\t// Get channel reader policy\n\tpolicy, flag := cpm.GetPolicy(policies.ChannelApplicationReaders)\n\tmcsLogger.Debugf(\"Got reader policy for channel [%s] with flag [%t]\", string(chainID), flag)\n\n\treturn policy.EvaluateSignedData(\n\t\t[]*protoutil.SignedData{{\n\t\t\tData:      message,\n\t\t\tIdentity:  peerIdentity,\n\t\t\tSignature: signature,","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/internal/peer/gossip/mcs.go#L234-L270","documentation":"VerifyByChannel requires a non-empty peer identity to verify a signature under a channel context, but was given an empty (len 0) api.PeerIdentityType. Since an empty identity cannot be deserialized or mapped to an MSP identity, the call fails immediately with this error.","triggerScenarios":"Calling VerifyByChannel(chainID, peerIdentity, signature, message) where peerIdentity is an empty or nil []byte — typically an empty PeerIdentityType from a gossip message sender whose identity was not attached.","commonSituations":"Gossip messages received from peers that did not include credentials; security/identity disabled on one side but enabled on the other, leaving identity fields empty; membership store returning empty identity bytes for an unknown or evicted peer; bugs in custom SecurityAdvisor/identity extractors.","solutions":["Verify the sending peer's gossip security config matches the receiver's (both TLS/identity enabled).","Check the message carries a valid PeerIdentityType before calling VerifyByChannel; drop messages without credentials.","Refresh membership view — the peer identity may be stale/empty for an evicted peer.","Ensure the SecurityAdvisor/identity provider on the receiving side correctly extracts identities from network members.","Check MSP configuration on the peer so peer identities can be resolved."],"exampleFix":"// before\nerr := cryptoService.VerifyByChannel(chainID, msg.PeerIdentity, msg.Signature, msg.Payload)\n// after\nif len(msg.PeerIdentity) == 0 {\n    return fmt.Errorf(\"message from %s has no peer identity; dropping\", msg.Sender)\n}\nerr := cryptoService.VerifyByChannel(chainID, msg.PeerIdentity, msg.Signature, msg.Payload)","handlingStrategy":"validation","validationCode":"if len(peerIdentity) == 0 {\n    return fmt.Errorf(\"cannot verify channel message: peer identity is empty\")\n}","typeGuard":"func hasPeerIdentity(id api.PeerIdentityType) bool {\n    return len(id) > 0\n}","tryCatchPattern":"if err := cryptoService.VerifyByChannel(chainID, peerIdentity, sig, msg); err != nil {\n    if strings.Contains(err.Error(), \"Invalid Peer Identity\") {\n        log.Warnf(\"message carries empty identity; sender security config mismatch? dropping\")\n        return errDrop\n    }\n    return err\n}","preventionTips":["Keep gossip security (identity exposure) enabled symmetrically on all peers","Check identity presence on inbound gossip messages before verification","Refresh membership entries that hold empty identities","Audit custom SecurityAdvisor implementations for empty returns"],"tags":["hyperledger-fabric","gossip","msp","peer-identity","validation"],"backgroundTag":"empty-peer-identity","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}