hyperledger / hyperledger/fabric-ca

[Bug] Inability to custom configure BCCSP SW KeyStore path

Open
#515 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
453
Forks
714
Avg merge
7h 23m
Merged PRs (30d)
3

Description

## Summary

Configuring a custom keystore path under `bccsp.sw.filekeystore.keystore` in `fabric-ca-server-config.yaml` is currently ignored during `fabric-ca-server` startup. Keys continue to be generated in the default `msp/keystore` directory.

Through codebase analysis, two underlying causes were identified:
1. A field mapping mismatch between Viper (`mapstructure`) unmarshaling and `FileKeystoreOpts.KeyStorePath`.

---

## Issue 1: Config Key Mismatch for `bccsp.sw.filekeystore.keystore`

### Description
In `fabric-ca-server-config.yaml`, the default template provides:
```yaml
bccsp:
default: SW
sw:
hash: SHA2
security: 256
filekeystore:
keystore: msp/keystore
```

##Root Cause
fabric-ca-server uses viper.Unmarshal (mapstructure) to parse configuration files into Go structs (lib/util.go: UnmarshalConfig).
The FileKeystoreOpts struct in fabric-lib-go (bccsp/factory/swfactory.go) is defined as:
```go
type FileKeystoreOpts struct {
KeyStorePath string `yaml:"KeyStore"`
}
```

Since mapstructure defaults to matching struct field names (case-insensitive: keystorepath), it fails to match keystore: from the YAML file. Consequently, KeyStorePath remains empty ("").
During BCCSP initialization (util/configurebccsp.go), if KeyStorePath == "", it forces the path back to the hardcoded default:
```go
} else if opts.SW.FileKeystore.KeyStorePath == "" {
opts.SW.FileKeystore.KeyStorePath = path.Join("msp", "keystore")
}
```

Proposed Solutions for Issue 1
Option A: Add mapstructure:"keystore,omitempty" / mapstructure:"keystorepath,omitempty" tags to FileKeystoreOpts in fabric-lib-go.
Option B: Configure mapstructure.DecoderConfig{TagName: "yaml"} when invoking viper.Unmarshal in fabric-ca.
Option C: Update the fabric-ca-server-config.yaml default template key to keystorepath.

Contributor guide

Open the contributing guide

Research direction

Start with UnmarshalConfig in lib/util.go and compare the YAML key with FileKeystoreOpts in fabric-lib-go's bccsp/factory/swfactory.go. Then inspect the empty-path fallback in util/configurebccsp.go and determine which proposed mapping approach fits the project. Done means a custom bccsp.sw.filekeystore.keystore value is honored instead of falling back to msp/keystore.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.