{"record":{"id":"bc2688a7f6057c07","repo":"hyperledger/fabric","slug":"failed-creating-a-comparable-principal-set-for-sta","errorCode":null,"errorMessage":"failed creating a comparable principal set for state based endorsement","messagePattern":"failed creating a comparable principal set for state based endorsement","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"discovery/endorsement/endorsement.go","lineNumber":234,"sourceCode":"}\n\nfunc computeStateBasedPrincipalSets(chaincodes []*peer.ChaincodeCall, logger *flogging.FabricLogger) (inquire.ComparablePrincipalSets, error) {\n\tvar stateBasedCPS []inquire.ComparablePrincipalSets\n\tfor _, chaincode := range chaincodes {\n\t\tif len(chaincode.KeyPolicies) == 0 {\n\t\t\tcontinue\n\t\t}\n\n\t\tlogger.Debugf(\"Chaincode call to %s is satisfied by %d state based policies of %v\",\n\t\t\tchaincode.Name, len(chaincode.KeyPolicies), chaincode.KeyPolicies)\n\n\t\tfor _, stateBasedPolicy := range chaincode.KeyPolicies {\n\t\t\tvar cmpsets inquire.ComparablePrincipalSets\n\t\t\tstateBasedPolicy := inquire.NewInquireableSignaturePolicy(stateBasedPolicy)\n\t\t\tfor _, ps := range stateBasedPolicy.SatisfiedBy() {\n\t\t\t\tcps := inquire.NewComparablePrincipalSet(ps)\n\t\t\t\tif cps == nil {\n\t\t\t\t\treturn nil, errors.New(\"failed creating a comparable principal set for state based endorsement\")\n\t\t\t\t}\n\t\t\t\tcmpsets = append(cmpsets, cps)\n\t\t\t}\n\t\t\tif len(cmpsets) == 0 {\n\t\t\t\treturn nil, errors.New(\"state based endorsement policy cannot be satisfied\")\n\t\t\t}\n\t\t\tstateBasedCPS = append(stateBasedCPS, cmpsets)\n\t\t}\n\t}\n\n\tif len(stateBasedCPS) > 0 {\n\t\tstateBasedPrincipalSet, err := mergePrincipalSets(stateBasedCPS)\n\t\tif err != nil {\n\t\t\treturn nil, errors.WithStack(err)\n\t\t}\n\n\t\tlogger.Debugf(\"Merging state based policies: %v --> %v\", stateBasedCPS, stateBasedPrincipalSet)\n","sourceCodeStart":216,"sourceCodeEnd":252,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/discovery/endorsement/endorsement.go#L216-L252","documentation":"Thrown by computeStateBasedPrincipalSets in Fabric's discovery endorsement analyzer when NewComparablePrincipalSet returns nil while converting a principal set derived from a state-based (key-level) endorsement policy. This means the key-level signature policy produced a principal that cannot be represented as a comparable principal set (typically an unsupported principal type like an implied/structured principal or malformed MSP role). The discovery service cannot compute which peers satisfy the state-based endorsement policy, so PeersForEndorsement fails for that ChaincodeInterest.","triggerScenarios":"A ChaincodeInterest includes a chaincode whose KeyPolicies (state-based endorsement policies) yield a principal set that NewComparablePrincipalSet cannot convert to non-nil; the policy's principals use unsupported types (e.g. non-MSPRole/non-MSPPrincipal variants) after being inquired via SatisfiedBy().","commonSituations":"Key-level endorsement policies set via SetPrivateDataValidationParameter/SetStateValidationParameter with unusual or corrupted policy protos; policies created by tooling that emits principal types Fabric's inquire package does not handle; Fabric version upgrades introducing new principal types not yet supported by discovery.","solutions":["Inspect the key-level endorsement policy protobuf for the failing key and check its MSPPrincipal types; rewrite it using standard MSPRole/OU principals","Regenerate the state-based endorsement policy with peer CLI / SDK using standard principal specs (e.g. Org1MSP.member)","Update Fabric to a version whose inquire.NewComparablePrincipalSet supports the principal type used","Remove the state-based endorsement policy (clear validation parameter) so the namespace policy applies instead"],"exampleFix":"// before (policy with exotic principal)\nkeyEndorsementPolicy := policyFromPrincipals([]string{\"PeerOfRoleOrg\"}) // unsupported type\n// after\nkeyEndorsementPolicy := policybuilder.NewPolicy(policybuilder.SignedByMspMember(\"Org1MSP\"))\nerr := ledger.SetPrivateDataValidationParameter(\"ns\", \"coll\", \"key\", keyEndorsementPolicy)","handlingStrategy":"validation","validationCode":"for _, cc := range interest.Chaincodes {\n  for _, kp := range cc.KeyPolicies {\n    for _, ps := range inquire.NewInquireableSignaturePolicy(kp).SatisfiedBy() {\n      if inquire.NewComparablePrincipalSet(ps) == nil {\n        return fmt.Errorf(\"unsupported principal in state-based policy for %s\", cc.Name)\n      }\n    }\n  }\n}","typeGuard":"func hasConvertiblePrincipals(policy *common.SignaturePolicyEnvelope) bool {\n  for _, ps := range inquire.NewInquireableSignaturePolicy(policy).SatisfiedBy() {\n    if inquire.NewComparablePrincipalSet(ps) == nil { return false }\n  }\n  return true\n}","tryCatchPattern":"result, err := client.PeersForEndorsement(ctx, interest)\nif err != nil && strings.Contains(err.Error(), \"failed creating a comparable principal set for state based endorsement\") {\n  // fall back to querying without key policies or fix the key-level policy\n}","preventionTips":["Only attach key-level endorsement policies built from standard MSPRole/OU principals","Test state-based policies with a dry-run inquiry before setting validation parameters","Keep Fabric peer and SDK on versions that support all principal types you use"],"tags":["fabric","discovery","endorsement-policy","state-based-endorsement"],"backgroundTag":"endorsement-policy-unsatisfiable","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}