hyperledger/fabric · error

policy %s wasn't found

Error message

policy %s wasn't found

What it means

VerifyBlockSignature fetches the channel's BlockValidation policy from the (possibly freshly initialized) PolicyManager and evaluates the signed data against it. If the policy is absent, signature verification cannot proceed and this formatted error names the missing policy path.

Source

Thrown at orderer/common/cluster/util.go:498

// VerifyBlockSignature verifies the signed data associated to a block, optionally with the given config envelope.
func (bv *BlockValidationPolicyVerifier) VerifyBlockSignature(sd []*protoutil.SignedData, envelope *common.ConfigEnvelope) error {
	policyMgr := bv.PolicyMgr
	// If the envelope passed isn't nil, we should use a different policy manager.
	if envelope != nil {
		bundle, err := channelconfig.NewBundle(bv.Channel, envelope.Config, bv.BCCSP)
		if err != nil {
			buff := &bytes.Buffer{}
			protolator.DeepMarshalJSON(buff, envelope.Config)
			bv.Logger.Errorf("Failed creating a new bundle for channel %s, Config content is: %s", bv.Channel, buff.String())
			return err
		}
		bv.Logger.Infof("Initializing new PolicyManager for channel %s", bv.Channel)
		policyMgr = bundle.PolicyManager()
	}
	policy, exists := policyMgr.GetPolicy(policies.BlockValidation)
	if !exists {
		return errors.Errorf("policy %s wasn't found", policies.BlockValidation)
	}
	return policy.EvaluateSignedData(sd)
}

//go:generate mockery --dir . --name BlockRetriever --case underscore --output ./mocks/

// BlockRetriever retrieves blocks
type BlockRetriever interface {
	// Block returns a block with the given number,
	// or nil if such a block doesn't exist.
	Block(number uint64) *common.Block
}

// LastConfigBlock returns the last config block relative to the given block.
func LastConfigBlock(block *common.Block, blockRetriever BlockRetriever) (*common.Block, error) {
	if block == nil {
		return nil, errors.New("nil block")
	}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Regenerate or update the channel config to include the Orderer BlockValidation policy (ImplicitMeta MAJORITY Writers is the standard).
2. Use configtxlator to inspect the current policies and confirm which are missing.
3. Submit a config update re-adding the missing policy definition.
4. Verify the channel is on a recent Fabric version where the policy is auto-generated by configtxgen.

Example fix

// configtx.yaml: add to Orderer group
// Policies:
//   BlockValidation:
//     Type: ImplicitMeta
//     Rule: "MAJORITY Writers"

// Confirm the policy exists before evaluating signatures
pm := bundle.PolicyManager()
if _, exists := pm.GetPolicy(policies.BlockValidation); !exists {
    return errors.New("channel lacks BlockValidation policy")
}

When it happens

Trigger: Calling VerifyBlockSignature on a channel whose config bundle has no policy registered under policies.BlockValidation (/Channel/Orderer/BlockValidation), typically when the channel config lacks the standard policies subtree.

Common situations: Channels created from custom/legacy genesis blocks without Policies defined in the Orderer group, or after config updates that accidentally removed the BlockValidation policy.

Related errors

• signature set did not satisfy policy
• could not retrieve policy for reference '%s' on channel '%s'
• failed to unmarshal ApplicationPolicy bytes
• policy with reference '%s' on channel '%s' is not convertibl
• error converting policy with reference '%s' on channel '%s'

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/39f9e3e780814310. Report an issue: GitHub.