hyperledger/fabric · error

mod_policy not set

Error message

mod_policy not set

What it means

validateModPolicy rejects any config element whose mod_policy field is empty. mod_policy names the policy that governs modification of that element, and a config element without one cannot be validated or updated.

Source

Thrown at common/configtx/update.go:51

func computeDeltaSet(readSet, writeSet map[string]comparable) map[string]comparable {
	result := make(map[string]comparable)
	for key, value := range writeSet {
		readVal, ok := readSet[key]

		if ok && readVal.version() == value.version() {
			continue
		}

		// If the key in the readset is a different version, we include it
		// Error checking on the sanity of the update is done against the config
		result[key] = value
	}
	return result
}

func validateModPolicy(modPolicy string) error {
	if modPolicy == "" {
		return errors.Errorf("mod_policy not set")
	}

	trimmed := modPolicy
	if modPolicy[0] == '/' {
		trimmed = modPolicy[1:]
	}

	for i, pathElement := range strings.Split(trimmed, pathSeparator) {
		err := validateConfigID(pathElement)
		if err != nil {
			return errors.Wrapf(err, "path element at %d is invalid", i)
		}
	}
	return nil
}

func (vi *ValidatorImpl) verifyDeltaSet(deltaSet map[string]comparable, signedData []*protoutil.SignedData) error {
	if len(deltaSet) == 0 {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Set ModPolicy on the config element, e.g. 'Admins' or '/Channel/Application/Admins'.
2. Regenerate the config with configtxgen or a current SDK that populates mod_policy.
3. Check the tool/script that assembles the ConfigUpdate for missing ModPolicy assignments.

Example fix

// before
&cb.ConfigValue{Value: bytes, Version: 1}
// after
&cb.ConfigValue{Value: bytes, Version: 1, ModPolicy: "Admins"}

func requireModPolicy(el interface{ GetModPolicy() string }) error {
  if el.GetModPolicy() == "" { return errors.New("element missing ModPolicy") }
  return nil
}

func hasModPolicy(el *cb.ConfigValue) bool { return el != nil && el.GetModPolicy() != "" }

err := validator.ProposeUpdate(env)
if err != nil && strings.Contains(err.Error(), "mod_policy not set") {
  return fmt.Errorf("update rejected: set ModPolicy on all changed elements: %w", err)
}

When it happens

Trigger: A delta-set entry (or a nested config element validated via the anonymous caller) has an empty mod_policy string.

Common situations: Constructing ConfigValue/ConfigGroup/ConfigPolicy programmatically and forgetting to set ModPolicy; config produced by older tooling that omitted mod_policy.

Related errors

• path element at %d is invalid
• invalid mod_policy for element %s
• Attempted to set the batch size max message count to an inva
• Attempted to set the batch size absolute max bytes to an inv
• Attempted to set the batch size preferred max bytes to an in

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/58f39a8ffb2f107e. Report an issue: GitHub.