hyperledger/fabric · error

PKIID is nil

Error message

PKIID is nil

What it means

identityMapperImpl.Put registers an identity keyed by its PKI-ID. It rejects a nil pkiID outright because the whole map is keyed on PKI-IDs; storing under a nil key would corrupt identity lookups and later cryptographic checks.

Source

Thrown at gossip/identity/identity.go:105

func (is *identityMapperImpl) periodicalPurgeUnusedIdentities() {
	usageTh := GetIdentityUsageThreshold()
	for {
		select {
		case <-is.stopChan:
			return
		case <-time.After(usageTh / 10):
			is.SuspectPeers(func(_ api.PeerIdentityType) bool {
				return false
			})
		}
	}
}

// put associates an identity to its given pkiID, and returns an error
// in case the given pkiID doesn't match the identity
func (is *identityMapperImpl) Put(pkiID common.PKIidType, identity api.PeerIdentityType) error {
	if pkiID == nil {
		return errors.New("PKIID is nil")
	}
	if identity == nil {
		return errors.New("identity is nil")
	}

	expirationDate, err := is.mcs.Expiration(identity)
	if err != nil {
		return errors.Wrap(err, "failed classifying identity")
	}

	if err := is.mcs.ValidateIdentity(identity); err != nil {
		return err
	}

	id := is.mcs.GetPKIidOfCert(identity)
	if !bytes.Equal(pkiID, id) {
		return errors.New("identity doesn't match the computed pkiID")
	}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Ensure the PKI-ID is extracted correctly (mcs.GetPKIidOfCert(identity)) before calling Put and is non-empty
2. Reject/drop upstream messages whose pki-id field is empty instead of forwarding them to the identity store
3. Add a caller-side check len(pkiID) > 0 before invoking Put

Example fix

// before
mapper.Put(msg.Nonce, identity) // pkiID may be nil

// after
pkiID := mapper.mcs.GetPKIidOfCert(identity)
if len(pkiID) == 0 {
    return errors.New("empty pkiID")
}
mapper.Put(pkiID, identity)

if len(pkiID) == 0 {
    return errors.New("refusing to put identity with nil/empty pkiID")
}
err := mapper.Put(pkiID, identity)

func validPkiID(p common.PKIidType) bool { return len(p) > 0 }

if err := mapper.Put(pkiID, identity); err != nil && err.Error() == "PKIID is nil" {
    logger.Warning("dropping identity with nil pkiID")
    return
}

When it happens

Trigger: Calling Put (from NewIdentityMapper's store population or application code) with pkiID = nil, typically when the caller obtained the PKI-ID from a malformed message or empty identity field.

Common situations: Processing gossip messages with missing/zeroed pki-id fields; tests stubbing identity mapper inputs; deserialization failures that leave PKIidType as an empty/nil byte slice.

Related errors

• identity is nil
• identity doesn't match the computed pkiID
• failed unmarshaling identity %s
• Could not serialize the signing identity: %s
• block from orderer could not be re-marshaled: proto: Marshal

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/2a0acbc525ec11bf. Report an issue: GitHub.