2

I have set my endorsement policy as "AND ('Org1MSP.peer','OrgMainMSP.peer')" that means I need certificates of both the organizations to perform transactions successfully.

Transaction Performed as below:

peer chaincode invoke -o orderer0.org.com:7050 --tls --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/org.com/orderers/orderer0.org.com/msp/tlscacerts/tlsca.org.com-cert.pem -n accessControl --peerAddresses peer0.org-main.com:7051 --tlsRootCertFiles /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org-main.com/peers/peer0.org-main.com/tls/ca.crt --peerAddresses peer0.org1.com:10051 --tlsRootCertFiles /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.com/peers/peer0.org1.com/tls/ca.crt -c '{"Args":[]}'

It worked all fine. Successfully committed a new block and can be seen on the couchdb as well. But when I send the transaction removing one of the certificate as can be seen below:

"peer chaincode invoke -o orderer0.org.com:7050 --tls --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/org.com/orderers/orderer0.org.com/msp/tlscacerts/tlsca.org.com-cert.pem -n accessControl --peerAddresses peer0.org-main.com:7051 --tlsRootCertFiles /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org-main.com/peers/peer0.org-main.com/tls/ca.crt -c '{"Args":[]}' "

New block is committed with a transaction but marked as invalid by the committer with following error message on the logs

peer0.org-main.com | 2020-03-20 07:59:30.868 UTC [vscc] Validate -> ERRO 094 VSCC error: stateBasedValidator.Validate failed, err validation of endorsement policy for chaincode accessControl in tx 7:0 failed: signature set did not satisfy policy

peer0.org-main.com | 2020-03-20 07:59:30.868 UTC [valimpl] preprocessProtoBlock -> WARN 097 Channel [myc]: Block [7] Transaction index [0] TxId [01246b27c11f94124aee3c4ac84a011be51a26aaa50fc28f1d6f5f5a8860c079] marked as invalid by committer. Reason code [ENDORSEMENT_POLICY_FAILURE]

peer0.org-main.com | 2020-03-20 07:59:31.156 UTC [kvledger] CommitWithPvtData -> INFO 098 [myc] Committed block [7] with 1 transaction(s) in 287ms (state_validation=0ms block_and_pvtdata_commit=220ms state_commit=17ms) commitHash=[9d52225ddbc8f6f98edd37388cbcf369fea22666b9ec1cff1a91debdebc2d2a1]

And when I again submit the transaction passing both the certificates, It throws an error as

Error: could not assemble transaction: ProposalResponsePayloads do not match - proposal response: version:1 response status:200 payload:... >

The problem here is that if I mistakenly call invoke function passing only one certificate of an organization (endorsement policy failure) then I am not able to further transactions.

1 Answer 1

3
  1. Transaction signed according the endorsement policy.

That's OK. Block committed and state updated.

  1. Transaction signatures do not match the endorsement policy.

That's OK. Your client better doesn't try to commit that transaction, but if it does, a new block is committed with an invalid transaction and state is not updated.

  1. ProposalResponsePayloads do not match.

Now the problem is different. I don't think it has relationship with previous transaction. The signatures are the expected ones, but you are composing a transaction with 2 transaction proposals that do not match. Their response or writeset is not the same. Be sure that you are not using external calls, random numbers, timestamps (other than the ones for the transaction or block) or similar values in your chaincode that might not match in both endorsements. Of course, transaction is invalidated, but a new block is committed.

2
  • Thank you @kekomal. It solved the problem. I had used random number for generating unique ids from chaincode. So there was a problem in it. About the timestamp, cannot we use the GetTxTimestamp() function provided by shim package? Or will it have same problem as above? Jul 29, 2020 at 4:56
  • 2
    You can use that specific timestamp. Take into account that it is the transaction timestamp (not the current one). That timestamp is extracted from the transaction, so it will be the same on all peers. For unique IDs in the state, when cannot be derived from some other unique fields, I usually use something like "MYMODELNAME_" + GetTxID() (unless you create more than one document for the same model/type in the same transaction).
    – kekomal
    Jul 29, 2020 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.