hyperledger/fabric · error

failed fetching signing identity: %v

Error message

failed fetching signing identity: %v

What it means

The pluggable endorsement framework's DefaultEndorsement (core/handlers/endorsement/plugin) fetches the signing identity for the incoming signed proposal via SigningIdentityForRequest. If that lookup fails it returns 'failed fetching signing identity: %v'. This means no local signing identity can be resolved for the proposal's creator/channel context.

Source

Thrown at core/handlers/endorsement/plugin/plugin.go:44

// New returns an endorsement plugin that behaves as the default endorsement system chaincode
func (*DefaultEndorsementFactory) New() endorsement.Plugin {
	return &DefaultEndorsement{}
}

// DefaultEndorsement is an endorsement plugin that behaves as the default endorsement system chaincode
type DefaultEndorsement struct {
	identities.SigningIdentityFetcher
}

// Endorse signs the given payload(ProposalResponsePayload bytes), and optionally mutates it.
// Returns:
// The Endorsement: A signature over the payload, and an identity that is used to verify the signature
// The payload that was given as input (could be modified within this function)
// Or error on failure
func (e *DefaultEndorsement) Endorse(prpBytes []byte, sp *peer.SignedProposal) (*peer.Endorsement, []byte, error) {
	signer, err := e.SigningIdentityForRequest(sp)
	if err != nil {
		return nil, nil, fmt.Errorf("failed fetching signing identity: %v", err)
	}
	// serialize the signing identity
	identityBytes, err := signer.Serialize()
	if err != nil {
		return nil, nil, fmt.Errorf("could not serialize the signing identity: %v", err)
	}

	// sign the concatenation of the proposal response and the serialized endorser identity with this endorser's key
	signature, err := signer.Sign(append(prpBytes, identityBytes...))
	if err != nil {
		return nil, nil, fmt.Errorf("could not sign the proposal response payload: %v", err)
	}
	endorsement := &peer.Endorsement{Signature: signature, Endorser: identityBytes}
	return endorsement, prpBytes, nil
}

// Init injects dependencies into the instance of the Plugin
func (e *DefaultEndorsement) Init(dependencies ...endorsement.Dependency) error {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Confirm the plugin's Init was called with a SigningIdentityFetcher before Endorse
2. Verify the proposal creator's certificate is issued by an MSP the peer knows (channel/local MSP config)
3. Check the wrapped error to distinguish missing-fetcher vs unknown-identity and re-register or re-provision accordingly
4. For tests, inject a mock SigningIdentityFetcher returning a valid SigningIdentity

Example fix

// before: plugin used without dependency injection
plugin := &plugin.DefaultEndorsement{}
endorsement, _, _ := plugin.Endorse(prp, sp) // failed fetching signing identity
// after
plugin := &plugin.DefaultEndorsement{}
err := plugin.Init([]interface{}{mockSigningIdentityFetcher{}})
if err != nil { return err }
endorsement, _, err := plugin.Endorse(prp, sp)

plugin := &plugin.DefaultEndorsement{}
if err := plugin.Init([]interface{}{signerFetcher}); err != nil {
    return fmt.Errorf("endorsement plugin not initialized: %w", err)
}

func readyToEndorse(p *plugin.DefaultEndorsement, f mgmt.SigningIdentityFetcher) bool {
    return f != nil && p.Init([]interface{}{f}) == nil
}

endorsement, prp, err := pl.Endorse(prpBytes, sp)
if err != nil {
    if strings.Contains(err.Error(), "failed fetching signing identity") {
        // re-init plugin or check proposal creator MSP
        return nil, fmt.Errorf("identity resolution failed: %w", err)
    }
    return nil, err
}

When it happens

Trigger: Endorse (called by EndorseWithPlugin or TestEndorsementPlugin) receives a SignedProposal whose creator/identity cannot be mapped to a signing identity, or the SigningIdentityFetcher dependency was never injected, or the channel MSP does not recognize the proposal creator.

Common situations: Plugin used before Init populated the fetcher; proposal signed with an identity from an MSP unknown to the peer; client cert expired or revoked so the deserializer cannot build the signer; testing the plugin without registering the fetcher dependency.

Related errors

• could not serialize the signing identity: %v
• error converting policy with reference '%s' on channel '%s'
• collection-name: %s -- collection member '%s' is not part of
• collection-name: %s -- contains an identity that is not part
• could not serialize the signing identity

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/0ed0a7ad58ec9cbb. Report an issue: GitHub.