[FAB-4328] Fix orderer genesis defaults

There are a few incorrect things about the default configuration
produced for the ordering system channel by the configtxgen tool.

The consortiums definitions and channel creation policy cannot be
modified after creation, and the ordering system channel includes an
Applications section by default which is inappropriate.

This CR fixes both these issues.

Change-Id: Ie6a934198fafbb37065d703edc0bc8fc9208b9ca
Signed-off-by: Jason Yellick <jyellick@us.ibm.com>

common/configtx/template.go

@@ -104,7 +104,9 @@ func copyGroup(source *cb.ConfigGroup, target *cb.ConfigGroup) error {
 	for key, group := range source.Groups {
 		_, ok := target.Groups[key]
 		if !ok {
-			target.Groups[key] = cb.NewConfigGroup()
+			newGroup := cb.NewConfigGroup()
+			newGroup.ModPolicy = group.ModPolicy
+			target.Groups[key] = newGroup
 		}
 
 		err := copyGroup(group, target.Groups[key])
@@ -151,7 +153,7 @@ type modPolicySettingTemplate struct {
 }
 
 // NewModPolicySettingTemplate wraps another template and sets the ModPolicy of
-// every ConfigGroup/ConfigValue/ConfigPolicy to modPolicy
+// every ConfigGroup/ConfigValue/ConfigPolicy without a modPolicy to modPolicy
 func NewModPolicySettingTemplate(modPolicy string, template Template) Template {
 	return &modPolicySettingTemplate{
 		modPolicy: modPolicy,
@@ -160,13 +162,21 @@ func NewModPolicySettingTemplate(modPolicy string, template Template) Template {
 }
 
 func setGroupModPolicies(modPolicy string, group *cb.ConfigGroup) {
-	group.ModPolicy = modPolicy
+	if group.ModPolicy == "" {
+		group.ModPolicy = modPolicy
+	}
 
 	for _, value := range group.Values {
+		if value.ModPolicy != "" {
+			continue
+		}
 		value.ModPolicy = modPolicy
 	}
 
 	for _, policy := range group.Policies {
+		if policy.ModPolicy != "" {
+			continue
+		}
 		policy.ModPolicy = modPolicy
 	}
 

common/configtx/template_test.go

@@ -77,15 +77,23 @@ func TestCompositeTemplate(t *testing.T) {
 }
 
 func TestModPolicySettingTemplate(t *testing.T) {
+	existingModPolicy := "bar"
+
 	subGroup := "group"
+	subGroupExistingModPolicy := "otherGroup"
 	input := cb.NewConfigGroup()
 	input.Groups[subGroup] = cb.NewConfigGroup()
+	input.Groups[subGroupExistingModPolicy] = &cb.ConfigGroup{ModPolicy: existingModPolicy}
 
 	policyName := "policy"
 	valueName := "value"
+	policyExistingModPolicy := "otherPolicy"
+	valueExistingModPolicy := "otherValue"
 	for _, group := range []*cb.ConfigGroup{input, input.Groups[subGroup]} {
 		group.Values[valueName] = &cb.ConfigValue{}
 		group.Policies[policyName] = &cb.ConfigPolicy{}
+		group.Values[valueExistingModPolicy] = &cb.ConfigValue{ModPolicy: existingModPolicy}
+		group.Policies[policyExistingModPolicy] = &cb.ConfigPolicy{ModPolicy: existingModPolicy}
 	}
 
 	modPolicyName := "foo"
@@ -98,9 +106,14 @@ func TestModPolicySettingTemplate(t *testing.T) {
 	assert.Equal(t, modPolicyName, configUpdate.WriteSet.ModPolicy)
 	assert.Equal(t, modPolicyName, configUpdate.WriteSet.Values[valueName].ModPolicy)
 	assert.Equal(t, modPolicyName, configUpdate.WriteSet.Policies[policyName].ModPolicy)
+	assert.Equal(t, existingModPolicy, configUpdate.WriteSet.Values[valueExistingModPolicy].ModPolicy)
+	assert.Equal(t, existingModPolicy, configUpdate.WriteSet.Policies[policyExistingModPolicy].ModPolicy)
 	assert.Equal(t, modPolicyName, configUpdate.WriteSet.Groups[subGroup].ModPolicy)
 	assert.Equal(t, modPolicyName, configUpdate.WriteSet.Groups[subGroup].Values[valueName].ModPolicy)
 	assert.Equal(t, modPolicyName, configUpdate.WriteSet.Groups[subGroup].Policies[policyName].ModPolicy)
+	assert.Equal(t, existingModPolicy, configUpdate.WriteSet.Groups[subGroup].Values[valueExistingModPolicy].ModPolicy)
+	assert.Equal(t, existingModPolicy, configUpdate.WriteSet.Groups[subGroup].Policies[policyExistingModPolicy].ModPolicy)
+	assert.Equal(t, existingModPolicy, configUpdate.WriteSet.Groups[subGroupExistingModPolicy].ModPolicy)
 }
 
 func TestNewChainTemplate(t *testing.T) {

common/configtx/tool/configtxgen/main.go

@@ -67,6 +67,10 @@ func doOutputChannelCreateTx(conf *genesisconfig.Profile, channelID string, outp
 		return fmt.Errorf("Error getting signing identity: %s", err)
 	}
 
+	if conf.Application == nil {
+		return fmt.Errorf("Cannot define a new channel with no application section")
+	}
+
 	// XXX we ignore the non-application org names here, once the tool supports configuration updates
 	// we should come up with a cleaner way to handle this, but leaving as is for the moment to not break
 	// backwards compatibility
@@ -92,6 +96,10 @@ func doOutputAnchorPeersUpdate(conf *genesisconfig.Profile, channelID string, ou
 		return fmt.Errorf("Must specify an organization to update the anchor peer for")
 	}
 
+	if conf.Application == nil {
+		return fmt.Errorf("Cannot update anchor peers without an application section")
+	}
+
 	var org *genesisconfig.Organization
 	for _, iorg := range conf.Application.Organizations {
 		if iorg.Name == asOrg {

common/configtx/tool/configtxgen/main_test.go

@@ -17,6 +17,7 @@ limitations under the License.
 package main
 
 import (
+	"flag"
 	"io/ioutil"
 	"os"
 	"testing"
@@ -65,7 +66,7 @@ func TestInspectConfigTx(t *testing.T) {
 	configTxDest := tmpDir + string(os.PathSeparator) + "configtx"
 
 	factory.InitFactories(nil)
-	config := genesisconfig.Load(genesisconfig.SampleInsecureProfile)
+	config := genesisconfig.Load(genesisconfig.SampleSingleMSPChannelProfile)
 
 	assert.NoError(t, doOutputChannelCreateTx(config, "foo", configTxDest), "Good outputChannelCreateTx generation request")
 	assert.NoError(t, doInspectChannelCreateTx(configTxDest), "Good configtx inspection request")
@@ -75,30 +76,50 @@ func TestGenerateAnchorPeersUpdate(t *testing.T) {
 	configTxDest := tmpDir + string(os.PathSeparator) + "anchorPeerUpdate"
 
 	factory.InitFactories(nil)
-	config := genesisconfig.Load(genesisconfig.SampleSingleMSPSoloProfile)
+	config := genesisconfig.Load(genesisconfig.SampleSingleMSPChannelProfile)
 
 	assert.NoError(t, doOutputAnchorPeersUpdate(config, "foo", configTxDest, genesisconfig.SampleOrgName), "Good anchorPeerUpdate request")
 }
 
-func TestFlags(t *testing.T) {
-	blockDest := tmpDir + string(os.PathSeparator) + "block"
+func TestConfigTxFlags(t *testing.T) {
 	configTxDest := tmpDir + string(os.PathSeparator) + "configtx"
+	configTxDestAnchorPeers := tmpDir + string(os.PathSeparator) + "configtxAnchorPeers"
 	oldArgs := os.Args
-	defer func() { os.Args = oldArgs }()
+	defer func() {
+		os.Args = oldArgs
+		flag.CommandLine = flag.NewFlagSet(os.Args[0], flag.ExitOnError)
+	}()
 	os.Args = []string{
 		"cmd",
-		"-outputBlock=" + blockDest,
 		"-outputCreateChannelTx=" + configTxDest,
-		"-profile=" + genesisconfig.SampleSingleMSPSoloProfile,
-		"-inspectBlock=" + blockDest,
+		"-profile=" + genesisconfig.SampleSingleMSPChannelProfile,
 		"-inspectChannelCreateTx=" + configTxDest,
-		"-outputAnchorPeersUpdate=" + configTxDest,
+		"-outputAnchorPeersUpdate=" + configTxDestAnchorPeers,
 		"-asOrg=" + genesisconfig.SampleOrgName,
 	}
 	main()
 
+	_, err := os.Stat(configTxDest)
+	assert.NoError(t, err, "Configtx file is written successfully")
+	_, err = os.Stat(configTxDestAnchorPeers)
+	assert.NoError(t, err, "Configtx anchor peers file is written successfully")
+}
+
+func TestBlockFlags(t *testing.T) {
+	blockDest := tmpDir + string(os.PathSeparator) + "block"
+	oldArgs := os.Args
+	defer func() {
+		os.Args = oldArgs
+		flag.CommandLine = flag.NewFlagSet(os.Args[0], flag.ExitOnError)
+	}()
+	os.Args = []string{
+		"cmd",
+		"-profile=" + genesisconfig.SampleSingleMSPSoloProfile,
+		"-outputBlock=" + blockDest,
+		"-inspectBlock=" + blockDest,
+	}
+	main()
+
 	_, err := os.Stat(blockDest)
 	assert.NoError(t, err, "Block file is written successfully")
-	_, err = os.Stat(configTxDest)
-	assert.NoError(t, err, "Configtx file is written successfully")
 }

common/configtx/tool/localconfig/config.go

@@ -59,6 +59,8 @@ const (
 	SampleInsecureProfile = "SampleInsecureSolo"
 	// SampleSingleMSPSoloProfile references the sample profile which includes only the sample MSP and uses solo for ordering.
 	SampleSingleMSPSoloProfile = "SampleSingleMSPSolo"
+	// SampleSingleMSPChannelProfile references the sample profile which includes only the sample MSP and is used to create a channel
+	SampleSingleMSPChannelProfile = "SampleSingleMSPChannel"
 
 	// SampleConsortiumName is the sample consortium from the sample configtx.yaml
 	SampleConsortiumName = "SampleConsortium"

common/configtx/tool/provisional/provisional.go

@@ -72,6 +72,9 @@ const (
 
 	// BlockValidationPolicyKey TODO
 	BlockValidationPolicyKey = "BlockValidation"
+
+	// OrdererAdminsPolicy is the absolute path to the orderer admins policy
+	OrdererAdminsPolicy = "/Channel/Orderer/Admins"
 )
 
 type bootstrapper struct {
@@ -97,9 +100,12 @@ func New(conf *genesisconfig.Profile) Generator {
 	}
 
 	if conf.Orderer != nil {
+		// Orderer addresses
+		oa := config.TemplateOrdererAddresses(conf.Orderer.Addresses)
+		oa.Values[config.OrdererAddressesKey].ModPolicy = OrdererAdminsPolicy
+
 		bs.ordererGroups = []*cb.ConfigGroup{
-			// Orderer addresses
-			config.TemplateOrdererAddresses(conf.Orderer.Addresses),
+			oa,
 
 			// Orderer Config Types
 			config.TemplateConsensusType(conf.Orderer.OrdererType),
@@ -172,15 +178,19 @@ func New(conf *genesisconfig.Profile) Generator {
 	}
 
 	if conf.Consortiums != nil {
-		bs.consortiumsGroups = append(bs.consortiumsGroups, config.TemplateConsortiumsGroup())
+		tcg := config.TemplateConsortiumsGroup()
+		tcg.Groups[config.ConsortiumsGroupKey].ModPolicy = OrdererAdminsPolicy
+		bs.consortiumsGroups = append(bs.consortiumsGroups, tcg)
+
 		for consortiumName, consortium := range conf.Consortiums {
-			bs.consortiumsGroups = append(
-				bs.consortiumsGroups,
-				config.TemplateConsortiumChannelCreationPolicy(consortiumName, policies.ImplicitMetaPolicyWithSubPolicy(
-					configvaluesmsp.AdminsPolicyKey,
-					cb.ImplicitMetaPolicy_ANY,
-				).Policy),
-			)
+			cg := config.TemplateConsortiumChannelCreationPolicy(consortiumName, policies.ImplicitMetaPolicyWithSubPolicy(
+				configvaluesmsp.AdminsPolicyKey,
+				cb.ImplicitMetaPolicy_ANY,
+			).Policy)
+
+			cg.Groups[config.ConsortiumsGroupKey].Groups[consortiumName].ModPolicy = OrdererAdminsPolicy
+			cg.Groups[config.ConsortiumsGroupKey].Groups[consortiumName].Values[config.ChannelCreationPolicyKey].ModPolicy = OrdererAdminsPolicy
+			bs.consortiumsGroups = append(bs.consortiumsGroups, cg)
 
 			for _, org := range consortium.Organizations {
 				mspConfig, err := msp.GetVerifyingMspConfig(org.MSPDir, org.BCCSP, org.ID)

examples/cluster/config/configtx.yaml

@@ -19,10 +19,6 @@ Profiles:
         <<: *OrdererDefaults
         Organizations:
           - *OrdererOrg
-      Application:
-        <<: *ApplicationDefaults
-        Organizations:
-          - *Org1
       Consortiums:
         SampleConsortium:
           Organizations:

sampleconfig/configtx.yaml

@@ -23,8 +23,6 @@ Profiles:
     SampleInsecureSolo:
         Orderer:
             <<: *OrdererDefaults
-        Application:
-            <<: *ApplicationDefaults
         Consortiums:
             SampleConsortium:
                 Organizations:
@@ -35,8 +33,6 @@ Profiles:
         Orderer:
             <<: *OrdererDefaults
             OrdererType: kafka
-        Application:
-            <<: *ApplicationDefaults
         Consortiums:
             SampleConsortium:
                 Organizations:
@@ -49,10 +45,6 @@ Profiles:
             <<: *OrdererDefaults
             Organizations:
                 - *SampleOrg
-        Application:
-            <<: *ApplicationDefaults
-            Organizations:
-                - *SampleOrg
         Consortiums:
             SampleConsortium:
                 Organizations:

test/feature/configs/configtx.yaml

@@ -23,8 +23,6 @@ Profiles:
     SampleInsecureSolo:
         Orderer:
             <<: *OrdererDefaults
-        Application:
-            <<: *ApplicationDefaults
         Consortiums:
             SampleConsortium:
                 Organizations:
@@ -35,8 +33,6 @@ Profiles:
         Orderer:
             <<: *OrdererDefaults
             OrdererType: kafka
-        Application:
-            <<: *ApplicationDefaults
         Consortiums:
             SampleConsortium:
                 Organizations:
@@ -49,10 +45,6 @@ Profiles:
             <<: *OrdererDefaults
             Organizations:
                 - *SampleOrg
-        Application:
-            <<: *ApplicationDefaults
-            Organizations:
-                - *SampleOrg
         Consortiums:
             SampleConsortium:
                 Organizations: