{"record":{"id":"c914fde117a1a448","repo":"hyperledger/fabric","slug":"permission-denied-c914fd","errorCode":null,"errorMessage":"permission denied","messagePattern":"permission denied","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/common/msgprocessor/sigfilter.go","lineNumber":77,"sourceCode":"\t}\n\n\t// In maintenance mode, we typically require the signature of /Channel/Orderer/Writers.\n\t// This will filter out configuration changes that are not related to consensus-type migration\n\t// (e.g on /Channel/Application), and will block Deliver requests from peers (which are normally /Channel/Readers).\n\tpolicyName := sf.normalPolicyName\n\tif ordererConf.ConsensusState() == orderer.ConsensusType_STATE_MAINTENANCE {\n\t\tpolicyName = sf.maintenancePolicyName\n\t}\n\n\tpolicy, ok := sf.support.PolicyManager().GetPolicy(policyName)\n\tif !ok {\n\t\treturn fmt.Errorf(\"could not find policy %s\", policyName)\n\t}\n\n\terr = policy.EvaluateSignedData(signedData)\n\tif err != nil {\n\t\tlogger.Warnw(\"SigFilter evaluation failed\", \"error\", err.Error(), \"ConsensusState\", ordererConf.ConsensusState(), \"policyName\", policyName, \"signingIdentity\", protoutil.LogMessageForSerializedIdentities(signedData))\n\t\treturn errors.Wrap(errors.WithStack(ErrPermissionDenied), err.Error())\n\t}\n\treturn nil\n}\n","sourceCodeStart":59,"sourceCodeEnd":81,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/common/msgprocessor/sigfilter.go#L59-L81","documentation":"SigFilter.Apply policy evaluation result: the message's signatures did not satisfy the channel policy (normally Writers; in maintenance mode the orderer Writers policy). The submitter is not authorized to send this message to the channel — this is an authorization failure, not a malformed message.","triggerScenarios":"Thrown at orderer/common/msgprocessor/sigfilter.go:77 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Submit the message from an identity that satisfies the channel's Writers policy","Update the channel policy to authorize the submitter's organization"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}