hyperledger/fabric · error

block validation policy should be a signature policy: %v but

Error message

block validation policy should be a signature policy: %v but it is %v instead

What it means

SmartBFT's config verifier requires the channel's 'Orderer' group to define a 'BlockValidation' policy that exactly matches the expected signature policy computed for the current consenters. If the policy stored in config differs from the expected SignaturePolicyEnvelope (proto comparison fails), config update validation is rejected. This prevents a misconfigured or malicious config update from weakening block validation.

Source

Thrown at orderer/consensus/smartbft/configverifier.go:166

	}

	expectedConfigPol := &common.Policy{
		Type:  int32(common.Policy_SIGNATURE),
		Value: protoutil.MarshalOrPanic(sp),
	}

	if len(conf.ChannelGroup.Groups["Orderer"].Policies) == 0 {
		return fmt.Errorf("empty policies in 'Orderer' group")
	}

	if conf.ChannelGroup.Groups["Orderer"].Policies["BlockValidation"] == nil {
		return fmt.Errorf("block validation policy is not found in the policies of 'Orderer' group")
	}

	actualPolicy := conf.ChannelGroup.Groups["Orderer"].Policies["BlockValidation"].Policy

	if !proto.Equal(expectedConfigPol, actualPolicy) {
		return fmt.Errorf("block validation policy should be a signature policy: %v but it is %v instead", expectedConfigPol, actualPolicy)
	}

	consensusTypeConfigValue := conf.ChannelGroup.Groups["Orderer"].Values["ConsensusType"]

	if consensusTypeConfigValue == nil {
		return fmt.Errorf("missing consensus type property in config")
	}

	consensusTypeValue := &protosorderer.ConsensusType{}
	if err := proto.Unmarshal(consensusTypeConfigValue.Value, consensusTypeValue); err != nil {
		return fmt.Errorf("invalid consensus type property in config: %v", err)
	}

	configOptions := &smartbft.Options{}
	if err := proto.Unmarshal(consensusTypeValue.Metadata, configOptions); err != nil {
		return fmt.Errorf("invalid options encoded in consensus metadata: %v", err)
	}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Regenerate the BlockValidation policy using the canonical template (causal/default orderer config template) so it is an exact proto match of the expected signature policy
2. Inspect the two policies logged in the error and align field-by-field (principals, n_out_of, t_out_of) with the expected value
3. Re-create the config update with an up-to-date configtxgen / channel template version instead of hand-editing the policy
4. Verify the Orderer group in configtx.yaml does not override or delete the BlockValidation policy

Example fix

// before (config has an ImplicitMeta or altered signature policy under Orderer.Policies.BlockValidation)
"BlockValidation": {"Policy": {"Type": 1, "Value": <different sigpolicy>}}
// after
"BlockValidation": {"Policy": {"Type": 1, "Value": <expected SignaturePolicyEnvelope matching the current consenters, e.g. a majority n-out-of of the orderer MSP members>}}

expected, _ := proto.Marshal(expectedBlockValidationPolicy)
actualBytes := conf.ChannelGroup.Groups["Orderer"].Policies["BlockValidation"].GetPolicy()
if !proto.Equal(expectedBlockValidationPolicy, actualBytes) {
    return fmt.Errorf("BlockValidation policy mismatch: got %v, want %v", actualBytes, expectedBlockValidationPolicy)
}

When it happens

Trigger: verifyConfigUpdateMsg -> checkConsentersMatchPolicy runs on every proposed config update; it fires when the Orderer group's Policies["BlockValidation"].Policy is not proto.Equal to the expected signature policy derived from the consenters/policy template.

Common situations: Hand-edited or generated channel config where BlockValidation was replaced with an ImplicitMeta policy; channel creation tooling that omitted or altered the policy; migrating config from a chain that did not set this policy; merging config templates incorrectly.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• invalid BFT metadata configuration
• unexpected envelope type %s
• empty Config
• empty channel group
• no groups in channel group

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/3a7e752cc4794e8c. Report an issue: GitHub.