hyperledger/fabric · error

failed computing key of signed data

Error message

failed computing key of signed data

What it means

EligibleForService in discovery/authcache.go:104 computes a cache key from the client's SignedData via signedDataToKey. If the SignedData cannot be marshaled to bytes (e.g. malformed identity bytes or signature), the key computation fails and this wrapped error is returned, so eligibility cannot be evaluated. The raw cause is logged at warning level before wrapping.

Source

Thrown at discovery/authcache.go:104

	channel      string
	ac           *authCache
	lastSequence uint64
	entries      map[string]error
}

func (ac *authCache) newAccessCache(channel string) *accessCache {
	return &accessCache{
		channel: channel,
		ac:      ac,
		entries: make(map[string]error),
	}
}

func (cache *accessCache) EligibleForService(data protoutil.SignedData) error {
	key, err := signedDataToKey(data)
	if err != nil {
		logger.Warningf("Failed computing key of signed data: +%v", err)
		return errors.Wrap(err, "failed computing key of signed data")
	}
	currSeq := cache.ac.acSupport.ConfigSequence(cache.channel)
	if cache.isValid(currSeq) {
		foundInCache, isEligibleErr := cache.lookup(key)
		if foundInCache {
			return isEligibleErr
		}
	} else {
		cache.configChange(currSeq)
	}

	// Make sure the cache doesn't overpopulate.
	// It might happen that it overgrows the maximum size due to concurrent
	// goroutines waiting on the lock above, but that's acceptable.
	cache.purgeEntriesIfNeeded()

	// Compute the eligibility of the client for the service
	err = cache.ac.acSupport.EligibleForService(cache.channel, data)

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Verify the client's identity (Creator certificate) is valid PEM/X.509 bytes and correctly loaded from the MSP
2. Check that the discovery request was correctly signed and that Signature/Data fields are non-empty and well-formed
3. Inspect the server log line 'Failed computing key of signed data' for the underlying (+%v) cause
4. Regenerate client credentials from a correctly configured MSP directory

Example fix

// before: identity loaded from wrong/empty path
cert, _ := os.ReadFile("wrong-path/cert.pem")

// after: validate certificate bytes before sending discovery requests
cert, err := os.ReadFile("msp/signcerts/cert.pem")
if err != nil || len(cert) == 0 {
    return fmt.Errorf("empty or missing identity certificate")
}

if len(sd.Identity) == 0 || len(sd.Data) == 0 || len(sd.Signature) == 0 {
    return errors.New("SignedData has empty Identity/Data/Signature fields")
}

func validSignedData(sd protoutil.SignedData) bool {
    return len(sd.Identity) > 0 && len(sd.Data) > 0 && len(sd.Signature) > 0
}

resp, err := client.Send(ctx, req, auth)
if err != nil && strings.Contains(err.Error(), "failed computing key of signed data") {
    // fix identity material on the client side and re-sign
}

When it happens

Trigger: A discovery client sends a signed request whose SignedData (Identity, Data, Signature fields) cannot be serialized to bytes by the asBytes/proto marshal path, causing signedDataToKey to fail.

Common situations: Client MSP/identity configured with empty or malformed certificate bytes; corrupted discovery request payloads; protobuf serialization failures on unusual identity types.

Related errors

• failed marshaling signed data
• error marshaling
• error decoding the block number
• error decoding the data hash
• error decoding the previous hash

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/b658df40afbd744c. Report an issue: GitHub.