failed creating a comparable principal set for state based e

Error message

failed creating a comparable principal set for state based endorsement

What it means

Thrown by computeStateBasedPrincipalSets in Fabric's discovery endorsement analyzer when NewComparablePrincipalSet returns nil while converting a principal set derived from a state-based (key-level) endorsement policy. This means the key-level signature policy produced a principal that cannot be represented as a comparable principal set (typically an unsupported principal type like an implied/structured principal or malformed MSP role). The discovery service cannot compute which peers satisfy the state-based endorsement policy, so PeersForEndorsement fails for that ChaincodeInterest.

Source

Thrown at discovery/endorsement/endorsement.go:234

}

func computeStateBasedPrincipalSets(chaincodes []*peer.ChaincodeCall, logger *flogging.FabricLogger) (inquire.ComparablePrincipalSets, error) {
	var stateBasedCPS []inquire.ComparablePrincipalSets
	for _, chaincode := range chaincodes {
		if len(chaincode.KeyPolicies) == 0 {
			continue
		}

		logger.Debugf("Chaincode call to %s is satisfied by %d state based policies of %v",
			chaincode.Name, len(chaincode.KeyPolicies), chaincode.KeyPolicies)

		for _, stateBasedPolicy := range chaincode.KeyPolicies {
			var cmpsets inquire.ComparablePrincipalSets
			stateBasedPolicy := inquire.NewInquireableSignaturePolicy(stateBasedPolicy)
			for _, ps := range stateBasedPolicy.SatisfiedBy() {
				cps := inquire.NewComparablePrincipalSet(ps)
				if cps == nil {
					return nil, errors.New("failed creating a comparable principal set for state based endorsement")
				}
				cmpsets = append(cmpsets, cps)
			}
			if len(cmpsets) == 0 {
				return nil, errors.New("state based endorsement policy cannot be satisfied")
			}
			stateBasedCPS = append(stateBasedCPS, cmpsets)
		}
	}

	if len(stateBasedCPS) > 0 {
		stateBasedPrincipalSet, err := mergePrincipalSets(stateBasedCPS)
		if err != nil {
			return nil, errors.WithStack(err)
		}

		logger.Debugf("Merging state based policies: %v --> %v", stateBasedCPS, stateBasedPrincipalSet)

View on GitHub (pinned to 2736b63f8f)

Solutions

Inspect the key-level endorsement policy protobuf for the failing key and check its MSPPrincipal types; rewrite it using standard MSPRole/OU principals
Regenerate the state-based endorsement policy with peer CLI / SDK using standard principal specs (e.g. Org1MSP.member)
Update Fabric to a version whose inquire.NewComparablePrincipalSet supports the principal type used
Remove the state-based endorsement policy (clear validation parameter) so the namespace policy applies instead

Example fix

// before (policy with exotic principal)
keyEndorsementPolicy := policyFromPrincipals([]string{"PeerOfRoleOrg"}) // unsupported type
// after
keyEndorsementPolicy := policybuilder.NewPolicy(policybuilder.SignedByMspMember("Org1MSP"))
err := ledger.SetPrivateDataValidationParameter("ns", "coll", "key", keyEndorsementPolicy)

Defensive patterns

Strategy: validation

Validate before calling

for _, cc := range interest.Chaincodes {
  for _, kp := range cc.KeyPolicies {
    for _, ps := range inquire.NewInquireableSignaturePolicy(kp).SatisfiedBy() {
      if inquire.NewComparablePrincipalSet(ps) == nil {
        return fmt.Errorf("unsupported principal in state-based policy for %s", cc.Name)
      }
    }
  }
}

Type guard

func hasConvertiblePrincipals(policy *common.SignaturePolicyEnvelope) bool {
  for _, ps := range inquire.NewInquireableSignaturePolicy(policy).SatisfiedBy() {
    if inquire.NewComparablePrincipalSet(ps) == nil { return false }
  }
  return true
}

Try / catch

result, err := client.PeersForEndorsement(ctx, interest)
if err != nil && strings.Contains(err.Error(), "failed creating a comparable principal set for state based endorsement") {
  // fall back to querying without key policies or fix the key-level policy
}

Prevention

Only attach key-level endorsement policies built from standard MSPRole/OU principals
Test state-based policies with a dry-run inquiry before setting validation parameters
Keep Fabric peer and SDK on versions that support all principal types you use

When it happens

Trigger: A ChaincodeInterest includes a chaincode whose KeyPolicies (state-based endorsement policies) yield a principal set that NewComparablePrincipalSet cannot convert to non-nil; the policy's principals use unsupported types (e.g. non-MSPRole/non-MSPPrincipal variants) after being inquired via SatisfiedBy().

Common situations: Key-level endorsement policies set via SetPrivateDataValidationParameter/SetStateValidationParameter with unusual or corrupted policy protos; policies created by tooling that emits principal types Fabric's inquire package does not handle; Fabric version upgrades introducing new principal types not yet supported by discovery.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/bc2688a7f6057c07. Report an issue: GitHub.