{"record":{"id":"5f2e702504988cf5","repo":"hyperledger/fabric","slug":"error-adding-policies-to-orderer-group","errorCode":null,"errorMessage":"error adding policies to orderer group","messagePattern":"error adding policies to orderer group","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/configtxgen/encoder/encoder.go","lineNumber":195,"sourceCode":"\n\tchannelGroup.ModPolicy = channelconfig.AdminsPolicyKey\n\treturn channelGroup, nil\n}\n\n// NewOrdererGroup returns the orderer component of the channel configuration.  It defines parameters of the ordering service\n// about how large blocks should be, how frequently they should be emitted, etc. as well as the organizations of the ordering network.\n// It sets the mod_policy of all elements to \"Admins\".  This group is always present in any channel configuration.\nfunc NewOrdererGroup(conf *genesisconfig.Orderer, channelCapabilities map[string]bool) (*cb.ConfigGroup, error) {\n\tif conf.OrdererType == \"BFT\" && !channelCapabilities[\"V3_0\"] {\n\t\treturn nil, errors.Errorf(\"orderer type BFT must be used with V3_0 channel capability: %v\", channelCapabilities)\n\t}\n\tif len(conf.Addresses) > 0 && channelCapabilities[\"V3_0\"] {\n\t\treturn nil, errors.Errorf(\"global orderer endpoints exist, but can not be used with V3_0 capability: %v\", conf.Addresses)\n\t}\n\n\tordererGroup := protoutil.NewConfigGroup()\n\tif err := AddOrdererPolicies(ordererGroup, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {\n\t\treturn nil, errors.Wrapf(err, \"error adding policies to orderer group\")\n\t}\n\taddValue(ordererGroup, channelconfig.BatchSizeValue(\n\t\tconf.BatchSize.MaxMessageCount,\n\t\tconf.BatchSize.AbsoluteMaxBytes,\n\t\tconf.BatchSize.PreferredMaxBytes,\n\t), channelconfig.AdminsPolicyKey)\n\taddValue(ordererGroup, channelconfig.BatchTimeoutValue(conf.BatchTimeout.String()), channelconfig.AdminsPolicyKey)\n\taddValue(ordererGroup, channelconfig.ChannelRestrictionsValue(conf.MaxChannels), channelconfig.AdminsPolicyKey)\n\n\tif len(conf.Capabilities) > 0 {\n\t\taddValue(ordererGroup, channelconfig.CapabilitiesValue(conf.Capabilities), channelconfig.AdminsPolicyKey)\n\t}\n\n\tvar consensusMetadata []byte\n\tvar err error\n\n\tswitch conf.OrdererType {\n\tcase ConsensusTypeSolo:","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/internal/configtxgen/encoder/encoder.go#L177-L213","documentation":"NewOrdererGroup wraps failures from AddOrdererPolicies, which builds the policy set (e.g. the Admins policy) for the orderer config group. When policy construction fails — typically because a named policy is invalid or a referenced signature policy cannot be parsed — the encoder returns this wrapper message. The underlying cause is in the wrapped error.","triggerScenarios":"NewOrdererGroup is called with conf.Policies containing an orderer policy definition that AddOrdererPolicies fails to build, e.g. malformed implicitmeta or signature policies in configtx.yaml Orderer.Policies.","commonSituations":"Hand-edited configtx.yaml policy blocks: wrong indentation, invalid policy syntax (e.g. bad 'OR(...)' expressions), referencing undefined MSPs, or typos in policy names/keys.","solutions":["Read the wrapped cause appended after this message — it names which policy failed and why","Restore the standard policy block (Readers/Writers/Admins) from the Fabric sample configtx.yaml","Validate your YAML structure: each policy needs Reader/Writer/Rule syntax exactly as in the samples","Regenerate with configtxgen once the policy definitions are fixed"],"exampleFix":"# before\nPolicies:\n    Admins:\n        Type: Signature\n        Rule: \"BAD SYNTAX\"\n# after\nPolicies:\n    Admins:\n        Type: Signature\n        Rule: \"OR('OrdererMSP.admin')\"","handlingStrategy":"validation","validationCode":"func validateOrdererPolicies(conf *genesisconfig.Orderer) error {\n    for name, pol := range conf.Policies {\n        if pol.Rule == nil || pol.Rule.Type == 0 {\n            return fmt.Errorf(\"orderer policy %q has empty or invalid rule\", name)\n        }\n    }\n    return nil\n}","typeGuard":"func hasPolicy(policies map[string]*genesisconfig.Policy, key string) bool {\n    p, ok := policies[key]\n    return ok && p != nil && p.Rule != nil\n}","tryCatchPattern":"group, err := encoder.NewOrdererGroup(conf, caps)\nif err != nil {\n    var wrapped interface{ Unwrap() error }\n    if errors.As(err, &wrapped) { /* log the cause: names the failing policy */ }\n    return err\n}","preventionTips":["Start policy blocks from the sample configtx.yaml and edit minimally","Validate YAML syntax (yamllint) before running configtxgen","Always inspect the Unwrap()ed cause; this error is only a wrapper"],"tags":["config","hyperledger-fabric","policies"],"backgroundTag":"invalid-policy-definition","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}