HyperLedger Fabric v1.1 adding organizations to existing channels

Question

Following is given as part of hyperldedger fabric documentation for v1.1:

Switching between organizations to sign a config transaction (or to do anything else) is not reflective of a real-world Fabric operation. A single container would never be mounted with an entire network’s crypto material. Rather, the config update would need to be securely passed out-of-band to an Org2 Admin for inspection and approval.

Say we have 4 organizations Org1,Org2,Org3 and Org4 and we are in the process of creating Org5.

Let Org1 and Org2 belong to same cli whereas Org3 be in Org3cli and Org4 be in Org4cli

Let us say all initial steps to launch org5 into network has been done.

On coming to peer channel signconfigtx I first sign from cli using peers of Org1 and Org2.But I need one more signature as majority says 3.

I go to Org3cli as sign on behalf of org3 but since peer channel signconfigtx method is local cli (Containing Org1 and Org2) doesn't come to know about it.(result is not send to the orderer).

So given in a real world scenario that a single cli isn't expected to handle all configuration,How do u handle interaction between 2 different cli ?

Answer 1

As you have correctly interpreted, the documentation is telling you that setting up a multi-org network using a single control point which has access to the crypto material for multiple organizations is not reflective of how things work in the real world. We do this in the samples to make it easy to bootstrap a multi-org sandbox network.

In the real world, you would need to pass the serialized configuration (update) transaction out of band to all of the organizations who need to sign it based on the channel policy. Fabric currently does not provide any tools for handling the out of band communication ... this is left up to the members of the network to decide.

There are vendors out there that are providing governance and lifecycle management tools for Fabric as part of their offerings, but there are currently no Fabric-specific tools available in open source for this.