{"record":{"id":"c358587dbe8f861a","repo":"hyperledger/fabric","slug":"identity-is-nil","errorCode":null,"errorMessage":"identity is nil","messagePattern":"identity is nil","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"gossip/identity/identity.go","lineNumber":108,"sourceCode":"\t\tselect {\n\t\tcase <-is.stopChan:\n\t\t\treturn\n\t\tcase <-time.After(usageTh / 10):\n\t\t\tis.SuspectPeers(func(_ api.PeerIdentityType) bool {\n\t\t\t\treturn false\n\t\t\t})\n\t\t}\n\t}\n}\n\n// put associates an identity to its given pkiID, and returns an error\n// in case the given pkiID doesn't match the identity\nfunc (is *identityMapperImpl) Put(pkiID common.PKIidType, identity api.PeerIdentityType) error {\n\tif pkiID == nil {\n\t\treturn errors.New(\"PKIID is nil\")\n\t}\n\tif identity == nil {\n\t\treturn errors.New(\"identity is nil\")\n\t}\n\n\texpirationDate, err := is.mcs.Expiration(identity)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"failed classifying identity\")\n\t}\n\n\tif err := is.mcs.ValidateIdentity(identity); err != nil {\n\t\treturn err\n\t}\n\n\tid := is.mcs.GetPKIidOfCert(identity)\n\tif !bytes.Equal(pkiID, id) {\n\t\treturn errors.New(\"identity doesn't match the computed pkiID\")\n\t}\n\n\tis.Lock()\n\tdefer is.Unlock()","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/gossip/identity/identity.go#L90-L126","documentation":"Returned by identityMapperImpl.Put when the identity argument is nil (the pkiID was already checked). The mapper refuses to register a nil peer identity, since neither expiration checks nor pkiID binding could proceed.","triggerScenarios":"Calling Put with identity = nil — e.g. the caller received a nil identity from a lookup (GetIdentityInfoByPkiID etc.) and passed it through, or constructed api.PeerIdentityType(nil).","commonSituations":"Membership handlers forwarding message identities that failed to deserialize; tests passing nil identities; a peer message carrying a certificate that was never resolved to a concrete identity.","solutions":["Check identity != nil (or len(identity) > 0) before calling Put","Fix the upstream identity resolution so real peer identities (certificates) are passed in","Drop/ignore messages that arrive with a nil identity rather than registering them"],"exampleFix":"// before\nerr := mapper.Put(pkiID, identity) // identity may be nil\n\n// after\nif identity == nil {\n    return errors.New(\"cannot put nil identity\")\n}\nerr := mapper.Put(pkiID, identity)","handlingStrategy":"type-guard","validationCode":"if identity == nil {\n    return errors.New(\"refusing to put nil identity\")\n}\nerr := mapper.Put(pkiID, identity)","typeGuard":"func hasIdentity(id api.PeerIdentityType) bool { return id != nil && len(id) > 0 }","tryCatchPattern":"if err := mapper.Put(pkiID, identity); err != nil && err.Error() == \"identity is nil\" {\n    logger.Warning(\"nil identity ignored\")\n    return\n}","preventionTips":["Resolve identities fully before registering them in the mapper","Never pass through nil results from identity lookups","Log and drop messages whose identity fields failed to deserialize"],"tags":["gossip","hyperledger-fabric","identity"],"backgroundTag":"nil-identifier","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}