{"record":{"id":"b658df40afbd744c","repo":"hyperledger/fabric","slug":"failed-computing-key-of-signed-data","errorCode":null,"errorMessage":"failed computing key of signed data","messagePattern":"failed computing key of signed data","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"discovery/authcache.go","lineNumber":104,"sourceCode":"\tchannel      string\n\tac           *authCache\n\tlastSequence uint64\n\tentries      map[string]error\n}\n\nfunc (ac *authCache) newAccessCache(channel string) *accessCache {\n\treturn &accessCache{\n\t\tchannel: channel,\n\t\tac:      ac,\n\t\tentries: make(map[string]error),\n\t}\n}\n\nfunc (cache *accessCache) EligibleForService(data protoutil.SignedData) error {\n\tkey, err := signedDataToKey(data)\n\tif err != nil {\n\t\tlogger.Warningf(\"Failed computing key of signed data: +%v\", err)\n\t\treturn errors.Wrap(err, \"failed computing key of signed data\")\n\t}\n\tcurrSeq := cache.ac.acSupport.ConfigSequence(cache.channel)\n\tif cache.isValid(currSeq) {\n\t\tfoundInCache, isEligibleErr := cache.lookup(key)\n\t\tif foundInCache {\n\t\t\treturn isEligibleErr\n\t\t}\n\t} else {\n\t\tcache.configChange(currSeq)\n\t}\n\n\t// Make sure the cache doesn't overpopulate.\n\t// It might happen that it overgrows the maximum size due to concurrent\n\t// goroutines waiting on the lock above, but that's acceptable.\n\tcache.purgeEntriesIfNeeded()\n\n\t// Compute the eligibility of the client for the service\n\terr = cache.ac.acSupport.EligibleForService(cache.channel, data)","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/discovery/authcache.go#L86-L122","documentation":"EligibleForService in discovery/authcache.go:104 computes a cache key from the client's SignedData via signedDataToKey. If the SignedData cannot be marshaled to bytes (e.g. malformed identity bytes or signature), the key computation fails and this wrapped error is returned, so eligibility cannot be evaluated. The raw cause is logged at warning level before wrapping.","triggerScenarios":"A discovery client sends a signed request whose SignedData (Identity, Data, Signature fields) cannot be serialized to bytes by the asBytes/proto marshal path, causing signedDataToKey to fail.","commonSituations":"Client MSP/identity configured with empty or malformed certificate bytes; corrupted discovery request payloads; protobuf serialization failures on unusual identity types.","solutions":["Verify the client's identity (Creator certificate) is valid PEM/X.509 bytes and correctly loaded from the MSP","Check that the discovery request was correctly signed and that Signature/Data fields are non-empty and well-formed","Inspect the server log line 'Failed computing key of signed data' for the underlying (+%v) cause","Regenerate client credentials from a correctly configured MSP directory"],"exampleFix":"// before: identity loaded from wrong/empty path\ncert, _ := os.ReadFile(\"wrong-path/cert.pem\")\n\n// after: validate certificate bytes before sending discovery requests\ncert, err := os.ReadFile(\"msp/signcerts/cert.pem\")\nif err != nil || len(cert) == 0 {\n    return fmt.Errorf(\"empty or missing identity certificate\")\n}","handlingStrategy":"type-guard","validationCode":"if len(sd.Identity) == 0 || len(sd.Data) == 0 || len(sd.Signature) == 0 {\n    return errors.New(\"SignedData has empty Identity/Data/Signature fields\")\n}","typeGuard":"func validSignedData(sd protoutil.SignedData) bool {\n    return len(sd.Identity) > 0 && len(sd.Data) > 0 && len(sd.Signature) > 0\n}","tryCatchPattern":"resp, err := client.Send(ctx, req, auth)\nif err != nil && strings.Contains(err.Error(), \"failed computing key of signed data\") {\n    // fix identity material on the client side and re-sign\n}","preventionTips":["Load identity certificates from a valid MSP directory and validate PEM parsing before use","Log the wrapped cause at the server for the exact marshaling failure","Keep discovery request signing through protoutil-signed flows only"],"tags":["hyperledger-fabric","discovery-service","signed-data","serialization"],"backgroundTag":"signed-data-marshaling-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}