{"record":{"id":"5e6c52bea9d14f97","repo":"hyperledger/fabric","slug":"error-validating-deltaset","errorCode":null,"errorMessage":"error validating DeltaSet","messagePattern":"error validating DeltaSet","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/configtx/update.go","lineNumber":151,"sourceCode":"\t}\n\terr = vi.verifyReadSet(readSet)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"error validating ReadSet\")\n\t}\n\n\twriteSet, err := mapConfig(configUpdate.WriteSet, vi.namespace)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"error mapping WriteSet\")\n\t}\n\n\tdeltaSet := computeDeltaSet(readSet, writeSet)\n\tsignedData, err := protoutil.ConfigUpdateEnvelopeAsSignedData(configUpdateEnv)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif err = vi.verifyDeltaSet(deltaSet, signedData); err != nil {\n\t\treturn nil, errors.Wrapf(err, \"error validating DeltaSet\")\n\t}\n\n\tfullProposedConfig := vi.computeUpdateResult(deltaSet)\n\tif err := verifyFullProposedConfig(writeSet, fullProposedConfig); err != nil {\n\t\treturn nil, errors.Wrapf(err, \"full config did not verify\")\n\t}\n\n\treturn fullProposedConfig, nil\n}\n\nfunc (vi *ValidatorImpl) policyForItem(item comparable) (policies.Policy, bool) {\n\tmanager := vi.pm\n\n\tmodPolicy := item.modPolicy()\n\tlogger.Debugf(\"Getting policy for item %s with mod_policy %s\", item.key, modPolicy)\n\n\t// If the mod_policy path is relative, get the right manager for the context\n\t// If the item has a zero length path, it is the root group, use the base policy manager","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/common/configtx/update.go#L133-L169","documentation":"verifyDeltaSet failed on the computed delta of the update; this wraps either error 150 (missing mod policy) or 151 (policy not satisfied). The set of actual changes implied by the ReadSet/WriteSet could not be authorized under the channel's modification policies with the supplied signatures.","triggerScenarios":"Calling proposeConfigUpdate/Validate where computeDeltaSet yields changes whose mod_policies are missing from the config or not satisfied by the envelope's signatures.","commonSituations":"Same root causes as missing-policy and policy-not-satisfied: unsigned or under-signed updates, stale MSP certs, updates touching items whose mod_policy was removed; also attempting changes that require a higher-level policy (e.g. channel Admins) while only supplying org-level signatures.","solutions":["Read the wrapped inner error: if it's a missing policy fix the config's mod_policy references; if unsatisfied, collect the right signatures.","Sign the update with identities satisfying each changed key's mod_policy (usually org/channel Admins) via `peer channel signconfigtx`.","Refresh signing certificates after MSP rotation before signing.","Reduce the update to only intended keys — accidental diffs pull in items whose policies you cannot satisfy."],"exampleFix":"// before: env submitted with only the proposer's signature\n// after: collect all required admin signatures before submit\nfor _, signer := range requiredAdminSigners {\n    env, _ = utils.SignEnvelope(env, signer.MSPID, signer.Signer)\n}","handlingStrategy":"try-catch","validationCode":"// Pre-flight: list every changed key and its mod_policy so signatures can be pre-collected\nfunc pendingPolicies(update *cb.ConfigUpdate) []string {\n    var needed []string\n    // compute delta and collect mod_policy of each added/updated/removed item\n    return needed\n}","typeGuard":null,"tryCatchPattern":"if _, err := validator.ProposeConfigUpdate(env, seq); err != nil {\n    if strings.Contains(err.Error(), \"error validating DeltaSet\") {\n        // inspect wrapped cause: missing policy -> fix config; unsatisfied -> add signatures\n    }\n    return err\n}","preventionTips":["Compute the update's delta and its required mod_policies before collecting signatures.","Sign in order: org admins first, then channel/orderer admins for higher-level items.","Verify MSP certs are current for all signers.","Minimize the diff so only keys whose policies you can satisfy change."],"tags":["hyperledger-fabric","configtx","deltaset","policy","signature"],"backgroundTag":"policy-not-satisfied","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}