ENDORSEMENT_POLICY_FAILURE while invoking chain code using even if the transaction object contains enough endorsements

Question

I have a network on hyperledger fabric 1.4.4 with 5 organizations A , B, C , D , E. I created a channel with these 5 orgs and installed my chaincode on org A and org B because only they are apart of the endorsement policy.

This is the endorsement policy :

{"identities":[{"role":{"name":"member","mspId":"AMSP"}},{"role":{"name":"member","mspId":"BMSP"}},{"role":{"name":"member","mspId":"CMSP"}},{"role":{"name":"member","mspId":"DMSP"}},{"role":{"name":"member","mspId":"EMSP"}}],"policy":{"2-of":[{"signed-by":0},{"signed-by":1}]}}

I am using a gateway with the below configuration to invoke the chain code

        const walletPath = path.join('wallet' );
        const wallet = new FileSystemWallet(walletPath);

        let connectionOptions = {
            identity: userName,
            wallet: wallet,
            discovery: { enabled:true, asLocalhost: true },
            eventHandlerOptions: {
                commitTimeout: 100,
                strategy: DefaultEventHandlerStrategies.NETWORK_SCOPE_ALLFORTX
            }
        };
        logger.debug('Connecting to Fabric gateway');
        await gateway.connect(clientConnectionProfileJson, connectionOptions);
        const network = await gateway.getNetwork(channelName);
        const contract = await network.getContract(chaincodeName , contractName);
        const transaction =  contract.createTransaction(functionName);
        await transaction.submit(<arguments>);

This is the error which I a getting , at the client level

2021-02-17T05:28:13.063Z - warn: [TransactionEventHandler]: _strategyFail: strategy fail for transaction "9be4da8b1d52ddde804d6c7c08d134ef4b6ac2043cbe0258b5b4c921424c9f04": TransactionError: Peer a-org-peer1.a-org.com:7051 has rejected transaction "9be4da8b1d52ddde804d6c7c08d134ef4b6ac2043cbe0258b5b4c921424c9f04" with code "ENDORSEMENT_POLICY_FAILURE"

This is what I see in all the peer logs

2021-02-17 05:28:12.313 UTC [vscc] Validate -> ERRO 0db VSCC error: stateBasedValidator.Validate failed, err validation of endorsement policy for chaincode {chaincodeName} in tx 26:0 failed: signature set did not satisfy policy

After some research , I found that this is a failure that is occurring when the org peer is trying to commit the transaction to the ledger , and finds that the signature set did not satisfy the policy.

I have gone ahead and looked at the transaction object using the getTransactionByID method. I see that there are two endorsers MSP with the correct sign certificates , these certificates belong to the one of the peers of A and B orgs. So the discovery service correctly identified the peers and even the peers have endorsed the transaction , but not sure why the transaction is not getting committed.

What am I missing here ?
How can I verify if the signatures are correct ?

To explicitly say to the gateway that the request should go to specific endorsing peers , I have used the below code.

        const walletPath = path.join('wallet' );
        const wallet = new FileSystemWallet(walletPath);

        let connectionOptions = {
            identity: userName,
            wallet: wallet,
            discovery: { enabled: true , asLocalhost: true },
            eventHandlerOptions: {
                commitTimeout: 100,
                strategy: DefaultEventHandlerStrategies.NETWORK_SCOPE_ALLFORTX
            }
        };
        logger.debug('Connecting to Fabric gateway');
        await gateway.connect(clientConnectionProfileJson, connectionOptions);
        const network = await gateway.getNetwork(channelName);
        const channel = network.getChannel();
        let endorsingPeers = [];
        endorsingPeers.push(channel.getChannelPeer('a-org-peer1.a-org.com'));
        endorsingPeers.push(channel.getChannelPeer('b-org-peer1.b-org.com'));

        // Get addressability to org.cargoesnetwork.ebilloflading contract
        // Use chaincodeName that is used for installing
        const contract = await network.getContract(chaincodeName , contractName);
        const transaction =   contract.createTransaction(functionName).setEndorsingPeers(endorsingPeers);
        await transaction.submit(<arguments>);

No luck , the transaction still fails with the same endorsement policy failure. I verified the transaction object if the endorser sign certs are correctly present. They are present , but still got the same error.

Out of curiosity , I changed the endorsement policy to only one org from two orgs , every thing worked as expected. The issue exists only when the policy contains more than one endorsing organisations.

Please help in debugging this issue.

score 2 · Accepted Answer · answered Feb 17 '21 at 10:12

An ENDORSEMENT_POLICY_FAILURE can occur for a number of reasons. The first being you don't have enough signatures which is what you have said you have already checked. Another reason is that not all the signatures match to the proposal that was sent.

In the 1.4 gateway apis the proposals are received and not compared to see if they all match before a proposal is sent to the orderer. The SDK will send all the signatures and one of the proposals that was received back. The signatures are created over the each peer's individual proposal response.

If those proposals don't match (which would mean that your chaincode is not deterministic) then one of those signatures will be ok, but the other one won't because it won't match the proposal that was sent to the orderer.

I would check that your chaincode is deterministic because it's possible that each peer is generating different responses. An example of non-deterministic chaincode for example is where it creates a new date and stores that in the world state. Each peer would create a slightly different date value resulting in differing responses.

ENDORSEMENT_POLICY_FAILURE while invoking chain code using even if the transaction object contains enough endorsements

1 Answers1