hyperledger/fabric · error

collection policy config is nil

Error message

collection policy config is nil

What it means

getPolicy in privdata/util.go builds a concrete policies.Policy from a CollectionPolicyConfig envelope. This error fires when the config passed in is nil — there is no policy definition at all, so no policy can be created. The comment notes some callers (e.g., MembershipProvider.AsMemberOf) may discard the error and fall back to a RejectAll policy.

Source

Thrown at core/common/privdata/util.go:24

package privdata

import (
	mspp "github.com/hyperledger/fabric-protos-go-apiv2/msp"
	"github.com/hyperledger/fabric-protos-go-apiv2/peer"
	"github.com/hyperledger/fabric/common/cauthdsl"
	"github.com/hyperledger/fabric/common/policies"
	"github.com/hyperledger/fabric/msp"
	"github.com/pkg/errors"
	"google.golang.org/protobuf/proto"
)

// getPolicy creates a new policy from the policy envelope. It will return an error if the envelope has invalid policy config.
// Some caller (e.g., MembershipProvider.AsMemberOf) may drop the error and treat it as a RejectAll policy.
// In the future, we must revisit the callers if this method will return different types of errors.
func getPolicy(collectionPolicyConfig *peer.CollectionPolicyConfig, deserializer msp.IdentityDeserializer) (policies.Policy, error) {
	if collectionPolicyConfig == nil {
		return nil, errors.New("collection policy config is nil")
	}
	accessPolicyEnvelope := collectionPolicyConfig.GetSignaturePolicy()
	if accessPolicyEnvelope == nil {
		return nil, errors.New("collection config access policy is nil")
	}
	// create access policy from the envelope

	pp := cauthdsl.EnvelopeBasedPolicyProvider{Deserializer: deserializer}
	accessPolicy, err := pp.NewPolicy(accessPolicyEnvelope)
	if err != nil {
		return nil, errors.WithMessage(err, "failed constructing policy object out of collection policy config")
	}

	return accessPolicy, nil
}

// getMemberOrgs returns a map containing member orgs from a list of MSPPrincipals,
// it will skip identities it fails to process

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Ensure the collection's memberOrgsPolicy is populated before Setup/setupAccessPolicy is invoked
2. Validate the collection config package at approval/commit time so malformed configs are rejected early
3. If you are the caller, handle the returned error rather than treating it as RejectAll when policy presence is required

Example fix

// before
policy, err := getPolicy(nil, deserializer) // errors: collection policy config is nil

// after
if collectionPolicyConfig == nil {
  return errors.New("collection has no member orgs policy")
}
policy, err := getPolicy(collectionPolicyConfig, deserializer)

if collectionPolicyConfig == nil {
  return nil, errors.New("cannot derive policy: collection policy config is nil")
}

func policyConfigPresent(c *peer.CollectionPolicyConfig) bool {
  return c != nil
}

policy, err := getPolicy(cfg, deserializer)
if err != nil {
  if strings.Contains(err.Error(), "policy config is nil") {
    return nil, fmt.Errorf("collection misconfigured (no member orgs policy): %w", err)
  }
  return nil, err
}

When it happens

Trigger: setupAccessPolicy invoking getPolicy with a nil CollectionPolicyConfig (collection defined without member orgs policy), or direct/test callers passing nil.

Common situations: Collections config missing the memberOrgsPolicy section, programmatic construction of StaticCollectionConfig that leaves MemberOrgsPolicy unset, membership checks against collections whose policy failed to load.

Related errors

• collection config access policy is nil
• Nil config passed to collection setup
• Collection config policy is nil
• Collection config access policy is nil
• Invalid signed proposal during check policy on channel [%s]

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/c8bbd7707a74cec9. Report an issue: GitHub.