hyperledger/fabric · error

cannot read config update

Error message

cannot read config update

What it means

This wrapper is produced when ConfigEnvelopeFromBlock (called inside ConsensusMetadataFromConfigBlock) fails for any reason — nil block, envelope extraction failure, bad channel header, or wrong header type. The original cause is chained so the wrapped message shows the underlying failure.

Solutions

1. Read the wrapped inner error to identify the true cause (nil block / extract envelope / header type).
2. Re-fetch the config block from a healthy ordering node or snapshot and retry.
3. Validate the block before the call: non-nil, IsConfigBlock, and (if needed) header type HeaderType_CONFIG.
4. If corruption is recurring, check disk health of the ordering node's ledger directory.

Example fix

// before
meta, _, err := ConsensusMetadataFromConfigBlock(block) // opaque 'cannot read config update'

// after
if block == nil || !protoutil.IsConfigBlock(block) {
    return errors.New("invalid config block input")
}
meta, _, err := ConsensusMetadataFromConfigBlock(block)
if err != nil {
    logger.Errorf("config block %d failed: %s", block.Header.Number, err) // inner cause now visible
}

if block == nil || !protoutil.IsConfigBlock(block) {
    return errors.New("invalid config block input")
}

func parseableConfigBlock(block *common.Block) bool {
    if block == nil || !protoutil.IsConfigBlock(block) {
        return false
    }
    _, err := ConfigEnvelopeFromBlock(block)
    return err == nil
}

meta, _, err := ConsensusMetadataFromConfigBlock(block)
if err != nil {
    if strings.Contains(err.Error(), "cannot read config update") {
        return errors.Wrap(err, "config block unreadable; re-fetch from healthy orderer")
    }
    return err
}

When it happens

Trigger: Any inner failure of ConfigEnvelopeFromBlock: nil block slipped past checks, corrupted envelope at index 0, unparseable channel header, header type not HeaderType_CONFIG, or legacy ORDERER_TRANSACTION type.

Common situations: Corrupt ledger blocks; onboarding with a legacy system-channel block; non-config blocks reaching the parser when call-site validation is bypassed.

Related errors

• nil block or nil header
• not a config block
• bad config message
• bad message
• cannot extract channel header

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/0db46916a0c32c97. Report an issue: GitHub.

Appendix: source

Thrown at orderer/consensus/etcdraft/util.go:188

		return envelope, nil
	default:
		return nil, errors.Errorf("unexpected header type: %v", channelHeader.GetType())
	}
}

// ConsensusMetadataFromConfigBlock reads consensus metadata updates from the configuration block
func ConsensusMetadataFromConfigBlock(block *common.Block) (*etcdraft.ConfigMetadata, *orderer.ConsensusType, error) {
	if block == nil {
		return nil, nil, errors.New("nil block")
	}

	if !protoutil.IsConfigBlock(block) {
		return nil, nil, errors.New("not a config block")
	}

	configEnvelope, err := ConfigEnvelopeFromBlock(block)
	if err != nil {
		return nil, nil, errors.Wrap(err, "cannot read config update")
	}

	payload, err := protoutil.UnmarshalPayload(configEnvelope.GetPayload())
	if err != nil {
		return nil, nil, errors.Wrap(err, "failed to extract payload from config envelope")
	}
	// get config update
	configUpdate, err := configtx.UnmarshalConfigUpdateFromPayload(payload)
	if err != nil {
		return nil, nil, errors.Wrap(err, "could not read config update")
	}

	return MetadataFromConfigUpdate(configUpdate)
}

// VerifyConfigMetadata validates Raft config metadata.
// Note: ignores certificates expiration.
func VerifyConfigMetadata(metadata *etcdraft.ConfigMetadata, verifyOpts x509.VerifyOptions) error {

View on GitHub (pinned to 2736b63f8f)