{"record":{"id":"620b156241707373","repo":"hyperledger/fabric","slug":"signature-policy-is-not-an-or-concatenation-nouto-620b15","errorCode":null,"errorMessage":"signature policy is not an OR concatenation, NOutOf %d","messagePattern":"signature policy is not an OR concatenation, NOutOf (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/handlers/validation/builtin/v12/validation_logic.go","lineNumber":253,"sourceCode":"\t\t}\n\n\t\t// make sure that the signature policy is meaningful (only consists of ORs)\n\t\terr := validateSpOrConcat(newCollection.MemberOrgsPolicy.GetSignaturePolicy().Rule)\n\t\tif err != nil {\n\t\t\treturn errors.WithMessagef(err, \"collection-name: %s -- error in member org policy\", collectionName)\n\t\t}\n\t}\n\treturn nil\n}\n\n// validateSpOrConcat checks if the supplied signature policy is just an OR-concatenation of identities.\nfunc validateSpOrConcat(sp *common.SignaturePolicy) error {\n\tif sp.GetNOutOf() == nil {\n\t\treturn nil\n\t}\n\t// check if N == 1 (OR concatenation)\n\tif sp.GetNOutOf().N != 1 {\n\t\treturn errors.New(fmt.Sprintf(\"signature policy is not an OR concatenation, NOutOf %d\", sp.GetNOutOf().N))\n\t}\n\t// recurse into all sub-rules\n\tfor _, rule := range sp.GetNOutOf().Rules {\n\t\terr := validateSpOrConcat(rule)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc checkForMissingCollections(newCollectionsMap map[string]*pb.StaticCollectionConfig, oldCollectionConfigs []*pb.CollectionConfig,\n) error {\n\tvar missingCollections []string\n\n\t// In the new collection config package, ensure that there is one entry per old collection. Any\n\t// number of new collections are allowed.\n\tfor _, oldCollectionConfig := range oldCollectionConfigs {","sourceCodeStart":235,"sourceCodeEnd":271,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/handlers/validation/builtin/v12/validation_logic.go#L235-L271","documentation":"validateSpOrConcat walked a collection's member-org signature policy and hit an NOutOf rule with N != 1. Collection membership policies must be pure OR concatenations so that member eligibility is deterministic and non-nested.","triggerScenarios":"Thrown at core/handlers/validation/builtin/v12/validation_logic.go:253 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Rewrite the collection's member policy as an OR of organization principals","Avoid N-of-M (AND/threshold) rules in collection member policies"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}