fix: disable ICP query signature verification to resolve TrustError#3398
Draft
fix: disable ICP query signature verification to resolve TrustError#3398
Conversation
The @dfinity/agent v3.4.3 fails on Azure with "Query response did not contain any node signatures" because fetchSubnetKeys returns empty responses from IC boundary nodes. This blocks all ICP operations (balances, tx confirmations, payment links). Setting verifyQuerySignatures: false skips the subnet key verification for query calls while update calls (transfers) remain unaffected as they use consensus verification.
The @dfinity/agent v3.4.3 on Azure fails with "TrustError: Query response did not contain any node signatures". The fetchSubnetKeys() read_state call is rejected with "Invalid request expiry", preventing all ICP query operations (balances, tx confirmations, payment links). - verifyQuerySignatures: false skips the failing fetchSubnetKeys() call entirely. Only affects query (read) calls; update calls (transfers) remain consensus-verified. - shouldSyncTime: true lets the agent sync its internal clock with the IC network to prevent ingress expiry rejections.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
verifyQuerySignaturesin the ICP HttpAgent to fix persistentTrustError: Query response did not contain any node signatureson production (Azure)@dfinity/agentv3.4.3fetchSubnetKeys()call fails consistently on Azure, blocking all ICP query operationsRoot Cause
The
HttpAgent.query()method callsfetchSubnetKeys()viaread_stateto verify node signatures. On Azure, this returns empty subnet data, causing every ICP query to fail — balances, tx confirmations, and payment link balances.Impact
All ICP operations were broken on production:
BlockchainAdapter.updateBalancesFor(balance updates every ~30s)PayInService.checkInputConfirmations(tx completion for block 34726178)PaymentBalanceService.getPaymentBalances(payment link balances)Test plan
query_blocks(block height) all work with the fix