code: func newBlockPuller(support consensus.ConsenterSupport,
  	baseDialer *cluster.PredicateDialer,
  	clusterConfig localconfig.Cluster) (BlockPuller, error) {
  
  	verifyBlockSequence := func(blocks []*common.Block, _ string) error {
  		return cluster.VerifyBlocks(blocks, support)
  	}
  
  	secureConfig, err := baseDialer.ClientConfig()
  	if err != nil {
  		return nil, err
  	}
  	secureConfig.AsyncConnect = false
  	stdDialer := &cluster.StandardDialer{
  		Dialer: cluster.NewTLSPinningDialer(secureConfig),
  	}
  
  	// Extract the TLS CA certs and endpoints from the configuration,
  	endpointConfig, err := EndpointconfigFromFromSupport(support)
  	if err != nil {
  		return nil, err
  	}
  	// and overwrite them.
  	secureConfig.SecOpts.ServerRootCAs = endpointConfig.TLSRootCAs
  	stdDialer.Dialer.SetConfig(secureConfig)
  
  	der, _ := pem.Decode(secureConfig.SecOpts.Certificate)
  	if der == nil {
  		return nil, errors.Errorf("client certificate isn't in PEM format: %v",
  			string(secureConfig.SecOpts.Certificate))
  	}
  
  	bp := &cluster.BlockPuller{
  		VerifyBlockSequence: verifyBlockSequence,
  		Logger:              flogging.MustGetLogger("orderer.common.cluster.puller"),
  		RetryTimeout:        clusterConfig.ReplicationRetryTimeout,
  		MaxTotalBufferBytes: clusterConfig.ReplicationBufferSize,
  		FetchTimeout:        clusterConfig.ReplicationPullTimeout,
  		Endpoints:           endpointConfig.Endpoints,
  		Signer:              support,
  		TLSCert:             der.Bytes,
  		Channel:             support.ChainID(),
  		Dialer:              stdDialer,
  	}
  
  	return &LedgerBlockPuller{
  		Height:         support.Height,
  		BlockRetriever: support,
  		BlockPuller:    bp,
  	}, nil
  }
docs: // newBlockPuller creates a new block puller