{"record":{"id":"59dda01c4fe338cf","repo":"hyperledger/fabric","slug":"failed-signing-request","errorCode":null,"errorMessage":"failed signing Request","messagePattern":"failed signing Request","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"discovery/client/client.go","lineNumber":169,"sourceCode":"}\n\nfunc (req *Request) addQueryMapping(queryType protoext.QueryType, key string) {\n\treq.queryMapping[queryType][key] = req.lastIndex\n\treq.lastIndex++\n}\n\n// Send sends the request and returns the response, or error on failure\nfunc (c *Client) Send(ctx context.Context, req *Request, auth *discovery.AuthInfo) (Response, error) {\n\treqToBeSent := proto.Clone(req.Request).(*discovery.Request)\n\treqToBeSent.Authentication = auth\n\tpayload, err := proto.Marshal(reqToBeSent)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed marshaling Request to bytes\")\n\t}\n\n\tsig, err := c.signRequest(payload)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed signing Request\")\n\t}\n\n\tconn, err := c.createConnection()\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed connecting to discovery service\")\n\t}\n\n\tcl := discovery.NewDiscoveryClient(conn)\n\tresp, err := cl.Discover(ctx, &discovery.SignedRequest{\n\t\tPayload:   payload,\n\t\tSignature: sig,\n\t})\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"discovery service refused our Request\")\n\t}\n\tif n := len(resp.Results); n != req.lastIndex {\n\t\treturn nil, errors.Errorf(\"Sent %d queries but received %d responses back\", req.lastIndex, n)\n\t}","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/discovery/client/client.go#L151-L187","documentation":"Client.Send in discovery/client/client.go:169 signs the marshaled request payload with the configured Signer (c.signRequest). If signing fails (the signer returns an error), the failure is wrapped with 'failed signing Request'. Without a valid signature the discovery service would reject the request anyway.","triggerScenarios":"Send is called with a Signer that errors — e.g. the signing identity's private key is missing, locked, or the signer function was not configured (nil/misbehaving signer, like in TestUnableToSign).","commonSituations":"MSP directory missing the keystore/private key; HSM unavailable or PIN wrong; signer configured with the wrong identity for the target channel's TLS/auth context.","solutions":["Verify the signer identity's private key exists and is readable (msp/keystore) and the certificate matches it","If using an HSM, check PKCS#11 configuration, PIN, and that the HSM is reachable","Ensure the Client was created with a valid, non-nil Signer via discovery.NewClient(..., signer, ...) that returns (sig, nil)","Test the signer standalone: call signer([]byte(\"test\")) and confirm it succeeds before invoking Send"],"exampleFix":"// before: signer that swallows key-load errors and returns nil, err\nsigner := func(msg []byte) ([]byte, error) { return key.Sign(msg) }\n\n// after: fail fast with a validated signer\nkey, err := loadPrivateKey(\"msp/keystore/key.pem\")\nif err != nil { return fmt.Errorf(\"cannot load signing key: %w\", err) }\nsigner := func(msg []byte) ([]byte, error) { return key.Sign(msg) }","handlingStrategy":"validation","validationCode":"sig, err := signer([]byte(\"probe\"))\nif err != nil || len(sig) == 0 {\n    return fmt.Errorf(\"signer unavailable: %w\", err)\n}","typeGuard":"func signerHealthy(s discovery.Signer) bool {\n    sig, err := s([]byte(\"probe\"))\n    return err == nil && len(sig) > 0\n}","tryCatchPattern":"resp, err := client.Send(ctx, req, auth)\nif err != nil && strings.Contains(err.Error(), \"failed signing Request\") {\n    return fmt.Errorf(\"check keystore/HSM and identity material: %w\", err)\n}","preventionTips":["Verify msp/keystore private key presence and certificate/key match before starting","Test HSM (PKCS#11) connectivity at startup","Probe the signer with a dummy message once at client construction"],"tags":["hyperledger-fabric","discovery-client","signing","identity"],"backgroundTag":"request-signing-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}