《区块链开发实战——Hyperledger Fabric》学习笔记
即用来生成证书文件的工具,搭建网络的第一步就是使用cryptogen模块和配置文件来生成整个fabric网络的组织架构与其对应的身份证书
运行 cryptogen --help得到:
usage: cryptogen [<flags>] <command> [<args> ...]
Utility for generating Hyperledger Fabric key material
Flags:
--help Show context-sensitive help (also try --help-long and
--help-man).
Commands:
help [<command>...]
Show help.
generate [<flags>]
Generate key material
showtemplate
Show the default configuration template
version
Show version information
extend [<flags>]
Extend existing network
运行 cryptogen showtemplate来显示默认配置模板(去掉了注释):
OrdererOrgs: # 定义orderer节点
- Name: Orderer # orderer节点的名称
Domain: example.com # orderer节点的根域名
Specs:
- Hostname: orderer # orderer节点的主机名
PeerOrgs:
- Name: Org1 # 组织1的名称
Domain: org1.example.com # 组织1的根域名
EnableNodeOUs: false # 如果设置为true,在msp下生成config.yaml文件
Template:
Count: 1 # 组织1中的节点数目
Users:
Count: 1 # 组织1中的用户数目
- Name: Org2
Domain: org2.example.com
EnableNodeOUs: false
Template:
Count: 1
Users:
Count: 1
根据模板稍加修改创建一个Fabric系统,具体信息如下:
属性名称 | 属性值 |
---|---|
系统根域名 | testcryptogen.com |
系统orderer节点名称 | Orderer |
组成名称 | peer节点数 | 用户数
—|---
Org1 | 2 | 3
Org2 | 2 | 2
则crypto-config.yaml文件内容为:
OrdererOrgs:
- Name: Orderer
Domain: testcryptogen.com
Specs:
- Hostname: orderer
PeerOrgs:
- Name: Org1
Domain: org1.testcryptogen.com
EnableNodeOUs: false
Template:
Count: 2
Users:
Count: 3
- Name: Org2
Domain: org2.testcryptogen.com
EnableNodeOUs: false
Template:
Count: 2
Users:
Count: 2
使用cryptogen 生成证书文件:
root@i:/opt/hyperledger/fabricconfig# cryptogen generate --config=/opt/hyperledger/fabricconfig/crypto-config.yaml --output /opt/hyperledger/fabricconfig/crypto-config
org1.testcryptogen.com
org2.testcryptogen.com
使用tree查看生成的具体文件:
root@i:/opt/hyperledger/fabricconfig/crypto-config# tree -L 6
.
├── ordererOrganizations
│ └── testcryptogen.com #根域名为testcryptogen.com的orderer节点的相关证书文件
│ ├── ca # CA服务器签名文件
│ │ ├── 9fe7756ab2b8dd329ddc689a022f06773af70b1006e0df126f f22416671ff866_sk
│ │ └── ca.testcryptogen.com-cert.pem
│ ├── msp
│ │ ├── admincerts # orderer 管理员的证书
│ │ │ └── Admin@testcryptogen.com-cert.pem
│ │ ├── cacerts # orderer 根域名服务器的签名证书
│ │ │ └── ca.testcryptogen.com-cert.pem
│ │ └── tlscacerts # TLS 连接用的身份证书
│ │ └── tlsca.testcryptogen.com-cert.pem
│ ├── orderers # orderer 节点需要的相关证书文件
│ │ └── orderer.testcryptogen.com
│ │ ├── msp # orderer 节点相关证书
│ │ │ ├── admincerts
│ │ │ ├── cacerts
│ │ │ ├── keystore
│ │ │ ├── signcerts
│ │ │ └── tlscacerts
│ │ └── tls # orderer 节点和其他节点 TLS 连接用的身份证书
│ │ ├── ca.crt
│ │ ├── server.crt
│ │ └── server.key
│ ├── tlsca
│ │ ├── 0d5fa27337f1ebcfd424c61f791f0c76d67a3c06889a1ab97a 1d7de16d21936a_sk
│ │ └── tlsca.testcryptogen.com-cert.pem
│ └── users # orderer 节点用户相关的证书
│ └── Admin@testcryptogen.com
│ ├── msp
│ │ ├── admincerts
│ │ ├── cacerts
│ │ ├── keystore
│ │ ├── signcerts
│ │ └── tlscacerts
│ └── tls
│ ├── ca.crt
│ ├── client.crt
│ └── client.key
└── peerOrganizations
├── org1.testcryptogen.com # 组织的相关证书文件
│ ├── ca # 组织根节点签名证书
│ │ ├── 0b272c0067147eb26fe0ef41366bd8e841d41062df6209b094 3dfaa4e67264f7_sk
│ │ └── ca.org1.testcryptogen.com-cert.pem
│ ├── msp
│ │ ├── admincerts # 组织管理员的证书
│ │ │ └── Admin@org1.testcryptogen.com-cert.pem
│ │ ├── cacerts # 组织的根证书
│ │ │ └── ca.org1.testcryptogen.com-cert.pem
│ │ └── tlscacerts # TLS 连接身份证书
│ │ └── tlsca.org1.testcryptogen.com-cert.pem
│ ├── peers
│ │ ├── peer0.org1.testcryptogen.com
│ │ │ ├── msp
│ │ │ │ ├── admincerts # 组织的管理证书, 只有这些证书才能进行创建通道等操作
│ │ │ │ ├── cacerts # 组织根证书
│ │ │ │ ├── keystore # 当前节点的私钥
│ │ │ │ ├── signcerts # 当前节点签名的数字证书
│ │ │ │ └── tlscacerts # TLS 连接的身份证书
│ │ │ └── tls
│ │ │ ├── ca.crt # 组织的根证书
│ │ │ ├── server.crt # 验证本节点签名的证书
│ │ │ └── server.key # 当前节点的私钥文件用来签名的
│ │ └── peer1.org1.testcryptogen.com
│ │ ├── msp
│ │ │ ├── admincerts
│ │ │ ├── cacerts
│ │ │ ├── keystore
│ │ │ ├── signcerts
│ │ │ └── tlscacerts
│ │ └── tls
│ │ ├── ca.crt
│ │ ├── server.crt
│ │ └── server.key
│ ├── tlsca
│ │ ├── fe340ca55a6bec7593be46883c9aca164a007fea19dc6a0745 9a3099dd4e132f_sk
│ │ └── tlsca.org1.testcryptogen.com-cert.pem
│ └── users
│ ├── Admin@org1.testcryptogen.com
│ │ ├── msp
│ │ │ ├── admincerts # 组织的根证书作为管理员身份的验证
│ │ │ ├── cacerts # 用户所属组织的根证书
│ │ │ ├── keystore # 用户私钥
│ │ │ ├── signcerts # 用户的签名证书
│ │ │ └── tlscacerts # TLS 连接通信证书, SDK客户端使用
│ │ └── tls
│ │ ├── ca.crt # 组织根证书
│ │ ├── client.crt # 管理员身份的证书
│ │ └── client.key # 管理员私钥
│ ├── User1@org1.testcryptogen.com
│ │ ├── msp
│ │ │ ├── admincerts
│ │ │ ├── cacerts
│ │ │ ├── keystore
│ │ │ ├── signcerts
│ │ │ └── tlscacerts
│ │ └── tls
│ │ ├── ca.crt
│ │ ├── client.crt
│ │ └── client.key
│ ├── User2@org1.testcryptogen.com
│ │ ├── msp
│ │ │ ├── admincerts
│ │ │ ├── cacerts
│ │ │ ├── keystore
│ │ │ ├── signcerts
│ │ │ └── tlscacerts
│ │ └── tls
│ │ ├── ca.crt
│ │ ├── client.crt
│ │ └── client.key
│ └── User3@org1.testcryptogen.com
│ ├── msp
│ │ ├── admincerts
│ │ ├── cacerts
│ │ ├── keystore
│ │ ├── signcerts
│ │ └── tlscacerts
│ └── tls
│ ├── ca.crt
│ ├── client.crt
│ └── client.key
└── org2.testcryptogen.com
├── ca
│ ├── ca.org2.testcryptogen.com-cert.pem
│ └── e7ba20f396a106784d9076b8d62d8d3e8627991dc84c6ba85f 31f382af9963ed_sk
├── msp
│ ├── admincerts
│ │ └── Admin@org2.testcryptogen.com-cert.pem
│ ├── cacerts
│ │ └── ca.org2.testcryptogen.com-cert.pem
│ └── tlscacerts
│ └── tlsca.org2.testcryptogen.com-cert.pem
├── peers
│ ├── peer0.org2.testcryptogen.com
│ │ ├── msp
│ │ │ ├── admincerts
│ │ │ ├── cacerts
│ │ │ ├── keystore
│ │ │ ├── signcerts
│ │ │ └── tlscacerts
│ │ └── tls
│ │ ├── ca.crt
│ │ ├── server.crt
│ │ └── server.key
│ └── peer1.org2.testcryptogen.com
│ ├── msp
│ │ ├── admincerts
│ │ ├── cacerts
│ │ ├── keystore
│ │ ├── signcerts
│ │ └── tlscacerts
│ └── tls
│ ├── ca.crt
│ ├── server.crt
│ └── server.key
├── tlsca
│ ├── f2121a5969a1bfc7e8f7a04c2dd31e44f74d412f88dce68094 a3bb904d87e593_sk
│ └── tlsca.org2.testcryptogen.com-cert.pem
└── users
├── Admin@org2.testcryptogen.com
│ ├── msp
│ │ ├── admincerts
│ │ ├── cacerts
│ │ ├── keystore
│ │ ├── signcerts
│ │ └── tlscacerts
│ └── tls
│ ├── ca.crt
│ ├── client.crt
│ └── client.key
├── User1@org2.testcryptogen.com
│ ├── msp
│ │ ├── admincerts
│ │ ├── cacerts
│ │ ├── keystore
│ │ ├── signcerts
│ │ └── tlscacerts
│ └── tls
│ ├── ca.crt
│ ├── client.crt
│ └── client.key
└── User2@org2.testcryptogen.com
├── msp
│ ├── admincerts
│ ├── cacerts
│ ├── keystore
│ ├── signcerts
│ └── tlscacerts
└── tls
├── ca.crt
├── client.crt
└── client.key
configtxgen模块用来生成orderer的初始化文件和channel的初始化文件
即一般在cryptogen生成整个网络和证书后,用configtxgen生成Fabric系统的创始块文件和账本(channel)的创始块文件
使用configtxgen --help查看帮助信息:
root@i:/opt/hyperledger# configtxgen --help
Usage of configtxgen:
-asOrg string
Performs the config generation as a particular organization (by name), only including values in the write set that org (likely) has privilege to set
-channelID string
The channel ID to use in the configtx
-configPath string
The path containing the configuration to use (if set)
-inspectBlock string
Prints the configuration contained in the block at the specified path
-inspectChannelCreateTx string
Prints the configuration contained in the transaction at the specified path
-outputAnchorPeersUpdate string
Creates an config update to update an anchor peer (works only with the default channel creation, and only for the first update)
-outputBlock string
The path to write the genesis block to (if set)
-outputCreateChannelTx string
The path to write a channel creation configtx to (if set)
-printOrg string
Prints the definition of an organization as JSON. (useful for adding an org to a channel manually)
-profile string
The profile from configtx.yaml to use for generation. (default "SampleInsecureSolo")
-version
Show version information
与cryptogen一样,configtxgen需要先写一个配置文件,样例如下:
Profiles:
# 以下部分定义了整个系统的配置信息
# 组织定义标识符,可自定义,命令中的-profile参数对应该标识符
TestTwoOrgsOrdererGenesis:
# orderer 配置属性,系统关键字不得更改
Orderer:
#引用下面名为OrdererDefaults的属性
<<: *OrdererDefaults
Organizations:
#引用下面的名为OrdererOrg的属性
- *OrdererOrg
# 定义了系统中包含的组织
Consortiums:
SampleConsortium:
#系统中包含的组织
Organizations:
- *Org1 #引用了下文定义配置
- *Org2
# 以下内容为channel的配置信息
# 通道定义标识符,可自定义
TestTwoOrgsChannel:
Consortium: SampleConsortium
Application:
<<: *ApplicationDefaults
Organizations:
- *Org1
- *Org2
# orderer节点相关信息
Organizations:
# orderer节点配置信息
- &OrdererOrg
# orderer节点名称
Name: OrdererOrg
# orderer节点编号
ID: OrdererMSP
# mps文件夹路径
MSPDir: msp
# Orderer节点中包含的组织,如果有多个组织可以配置多个
- &Org1
Name: Org1MSP # 组织名称
ID: Org1MSP # 组织编号
MSPDir: msp # 组织msp文件名
AnchorPeers: # 组织的访问域名和端口
- Host: peer0.org1.testcryptogen.com
Port: 7051
- &Org2
Name: Org2MSP
ID: Org2MSP
MSPDir: msp
AnchorPeers:
- Host: peer0.org2.testcryptogen.com
Port: 7051
# orderer节点的配置信息
Orderer: &OrdererDefaults
OrdererType: solo # orderer节点共识办法
Addresses:
- orderer.testcryptogen.com:7050 # orderer监听的地址
BatchTimeout: 2s
BatchSize:
MaxMessageCount: 10
AbsoluteMaxBytes: 98 MB
PreferredMaxBytes: 512KB
Kafka:
Brokers:
- 127.0.0.1:9092
Organizations:
Application: &ApplicationDefaults
Organizations:
configtxgen -profile TestTwoOrgsOrdererGenesis -outputBlock ./orderer.genesis.block
configtxgen -profile TestTwoOrgsChannel -outputCreateChannelTx ./roberttestchannel.tx -channelID roberttestchannel
configtxgen -profile TestTwoOrgsChannel -outputAnchorPeersUpdate ./Org1MSPanchors.tx -channelID roberttestchannel -asOrg Org1MSP
configtxlator模块可以吧区块链的二进制文件转化成JSON格式文件,以便阅读
root@i:/opt/hyperledger/order# configtxlator --help
usage: configtxlator [<flags>] <command> [<args> ...]
Utility for generating Hyperledger Fabric channel configurations
Flags:
--help Show context-sensitive help (also try --help-long and --help-man).
Commands:
help [<command>...]
Show help.
start [<flags>]
Start the configtxlator REST server
proto_encode --type=TYPE [<flags>]
Converts a JSON document to protobuf.
proto_decode --type=TYPE [<flags>]
Converts a proto message to JSON.
compute_update --channel_id=CHANNEL_ID [<flags>]
Takes two marshaled common.Config messages and computes the config update which
transitions between the two.
version
Show version information
orderer模块 负责对交易进行排序,并将排好序的交易打包成区块
root@i:/opt/hyperledger/order# orderer --help
usage: orderer [<flags>] <command> [<args> ...]
Hyperledger Fabric orderer node
Flags:
--help Show context-sensitive help (also try --help-long and --help-man).
Commands:
help [<command>...]
Show help.
start*
Start the orderer node
version
Show version information
benchmark
Run orderer in benchmark mode
export set ORDERER_GENERAL_LOGLEVEL=debug
export set ORDERER_GENERAL_LISTENADDRESS=0.0.0.0
export set ORDERER_GENERAL_LISTENPORT=7050
export set ORDERER_GENERAL_GENESISMETHOD=file
export set ORDERER_GENERAL_GENESISFILE=/opt/hyperledger/order/orderer.genesis.block
export set ORDERER GENERAL_LOCALMSPID=OrdererMSP
export set ORDERER_GENERAL_LOCALMSPDIR=/opt/hyperledger/fabricconfig/crypto-config/ordererOrganizations/qklszzn.com/orderers/orderer.qklszzn.com/msp
export set ORDERER_GENERAL_LEDGERTYPE=file
export set ORDERER_GENERAL BATCHTIMEOUT=10s
export set ORDERER_GENERAL_MAXMESSAGECOUNT=10
export set ORDERER_GENERAL_TLS_ENABLED=false
export set ORDERER_GENERAL_TLS_PRIVATEKEY=/opt/hyperledger/fabricconfig/crypto-config/ordererOrganizations/qklszzn.com/orderers/orderer.qklszzn com/tls/server.key
export set ORDERER_GENERAL_TLS_CERTIFICATE=/opt/hyperledger/fabricconfig/
crypto-config/ordererOrganizations/qklszzn.com/orderers/orderer.qklszzn. com/tls/server.crt
export set ORDERER_GENERAL_TLS_ROOTCAS=[/opt/hyperledger/fabricconfig/cryptoconfig/ordererOrganizations/qklszzn.com/orderers/orderer.qklszzn.com/tls/ca.crt]
General:
LedgerType: file
ListenAddress: 0.0.0.0
ListenPort: 7050
TLS:
Enabled: false
PrivateKey: /opt/hyperledger/fabricconfig/crypto-config/ordererOrganizations/qklszzn.com/orderers/orderer.qklszzn.com/tls/server.key
Certificate: /opt/hyperledger/fabricconfig/crypto-config/ordererOrganizations/qklszzn.com/orderers/orderer.qklszzn.com/tls/server.crt
RootCAs:
- /opt/hyperledger/fabricconfig/crypto-config/ordererOrganizations/qklszzn.com/orderers/orderer.qklszzn.com/tls/ca.crt
#ClientAuthEnabled: false
ClientAuthRequired: false
ClientRootCAs:
LogLevel: debug
LogFormat: '%{color}%{time:2006-01-02 15:04:05.000 MST} [%{module}] %{shortfunc} -> %{level:.4s} %{id:03x}%{color:reset} %{message}'
GenesisMethod: file
GenesisProfile: TestOrgsOrdererGenesis
GenesisFile: /opt/hyperledger/order/orderer.genesis.block
LocalMSPDir: /opt/hyperledger/fabricconfig/crypto-config/ordererOrganizations/qklszzn.com/orderers/orderer.qklszzn.com/msp
LocalMSPID: OrdererMSP
Profile:
Enabled: false
Address: 0.0.0.0:6060
BCCSP:
Default: SW
SW:
Hash: SHA2
Security: 256
FileKeyStore:
KeyStore:
FileLedger:
Location: /opt/hyperledger/order/production/orderer
Prefix: hyperledger-fabric-ordererledger
RAMLedger:
HistorySize: 1000
Kafka:
Retry:
ShortInterval: 5s
ShortTotal: 10m
LongInterval: 5m
LongTotal: 12h
NetworkTimeouts:
DialTimeout: 10s
ReadTimeout: 10s
WriteTimeout: 10s
Metadata:
RetryBackoff: 250ms
RetryMax: 3
Producer:
RetryBackoff: 100ms
RetryMax: 3
Consumer:
RetryBackoff: 2s
Verbose: false
TLS:
Enabled: false
PrivateKey:
Certificate:
RootCAs:
Version: 0.10.2.0
Debug:
BroadcastTraceDir:
DeliverTraceDir:
General节点中包含了orderer模块的基本控制信息配置项的详细注释如下所示:
FileLedger节点中包含了orderer模块中账本文件相关的配置信息
RAMLedger节点包含了orderer模块的账本在内存中数据保存方式的相关配置信息
Kafka节点中包含了orderer模块中连接Kafka相关的信息,如果orderer节点的排序模式选择了solo,那么该节点所有配置均无效
(5) Debug
Debug节点中包含了orderer模块调试相关的选项
peer模块是Fabric中最重要的模块,主要负责存储区块链数据、运行维护链码、提供对外服务接口等作用
root@i:~# peer --help
Usage:
peer [command]
Available Commands:
chaincode Operate a chaincode: install|instantiate|invoke|package|query|signpackage|upgrade|list.
channel Operate a channel: create|fetch|join|list|update|signconfigtx|getinfo.
help Help about any command
logging Log levels: getlevel|setlevel|revertlevels.
node Operate a peer node: start|status.
version Print fabric peer version.
Flags:
-h, --help help for peer
--logging-level string Default logging level and overrides, see core.yaml for full syntax
Use "peer [command] --help" for more information about a command.
peer的配置文件的默认文件名为core.yaml,配置文件为logging、peer、vm、chaincode、ledger这五大部分