hyperledger/fabric · error

signature policy is not an OR concatenation, NOutOf %d

Error message

signature policy is not an OR concatenation, NOutOf %d

What it means

validateSpOrConcat walked a collection's member-org signature policy and hit an NOutOf rule with N != 1. Collection membership policies must be pure OR concatenations so that member eligibility is deterministic and non-nested.

Source

Thrown at core/handlers/validation/builtin/v12/validation_logic.go:253

		}

		// make sure that the signature policy is meaningful (only consists of ORs)
		err := validateSpOrConcat(newCollection.MemberOrgsPolicy.GetSignaturePolicy().Rule)
		if err != nil {
			return errors.WithMessagef(err, "collection-name: %s -- error in member org policy", collectionName)
		}
	}
	return nil
}

// validateSpOrConcat checks if the supplied signature policy is just an OR-concatenation of identities.
func validateSpOrConcat(sp *common.SignaturePolicy) error {
	if sp.GetNOutOf() == nil {
		return nil
	}
	// check if N == 1 (OR concatenation)
	if sp.GetNOutOf().N != 1 {
		return errors.New(fmt.Sprintf("signature policy is not an OR concatenation, NOutOf %d", sp.GetNOutOf().N))
	}
	// recurse into all sub-rules
	for _, rule := range sp.GetNOutOf().Rules {
		err := validateSpOrConcat(rule)
		if err != nil {
			return err
		}
	}
	return nil
}

func checkForMissingCollections(newCollectionsMap map[string]*pb.StaticCollectionConfig, oldCollectionConfigs []*pb.CollectionConfig,
) error {
	var missingCollections []string

	// In the new collection config package, ensure that there is one entry per old collection. Any
	// number of new collections are allowed.
	for _, oldCollectionConfig := range oldCollectionConfigs {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Rewrite the collection's member policy as an OR of organization principals
2. Avoid N-of-M (AND/threshold) rules in collection member policies

When it happens

Trigger: Thrown at core/handlers/validation/builtin/v12/validation_logic.go:253 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/620b156241707373. Report an issue: GitHub.