{"record":{"id":"907d484b7e557d44","repo":"pulumi/pulumi","slug":"serializing-checkpoint-w","errorCode":null,"errorMessage":"serializing checkpoint: %w","messagePattern":"serializing checkpoint: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/backend/diy/state.go","lineNumber":386,"sourceCode":"\n\treturn backupFile, file, nil\n}\n\nfunc (b *diyBackend) saveStack(\n\tctx context.Context,\n\tref *diyBackendReference,\n\tdeployment apitype.TypedDeployment,\n) (string, error) {\n\tcontract.Requiref(ref != nil, \"ref\", \"ref was nil\")\n\tchk, err := stack.DeploymentV3ToCheckpointWithMarshaler(\n\t\tdiyJSONMarshaler,\n\t\tref.FullyQualifiedName(),\n\t\tdeployment.Deployment,\n\t\tdeployment.Version,\n\t\tdeployment.Features,\n\t)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"serializing checkpoint: %w\", err)\n\t}\n\n\tbackup, file, err := b.saveCheckpoint(ctx, ref, chk)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tif !backend.DisableIntegrityChecking {\n\t\t// Finally, *after* writing the checkpoint, check the integrity.  This is done afterwards so that we write\n\t\t// out the checkpoint file since it may contain resource state updates.  But we will warn the user that the\n\t\t// file is already written and might be bad.\n\t\tif verifyerr := snapshot.VerifyIntegrity(deployment.Deployment); verifyerr != nil {\n\t\t\treturn \"\", fmt.Errorf(\n\t\t\t\t\"%s: snapshot integrity failure; it was already written, but is invalid (backup available at %s): %w\",\n\t\t\t\tfile, backup, verifyerr)\n\t\t}\n\t}\n","sourceCodeStart":368,"sourceCodeEnd":404,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/backend/diy/state.go#L368-L404","documentation":"saveStack wraps an error from marshalVersionedCheckpoint with 'serializing checkpoint'. The deployment produced by the operation could not be serialized into a versioned checkpoint, so nothing was written to the backend. The underlying cause comes from the JSON marshaling step.","triggerScenarios":"saveStack (CreateStack path) after GetDeployment marshalVersionedCheckpoint fails — marshaler cannot encode the deployment/version/features into a VersionedCheckpoint.","commonSituations":"Secrets provider failures while re-encrypting secrets in the deployment, internal marshal errors on unexpected deployment contents, or corrupted in-memory deployment state.","solutions":["Inspect the wrapped cause for the specific marshal failure.","If secrets-related, confirm the secrets provider is configured and reachable (passphrase set, KMS credentials valid).","Retry the operation; transient provider failures may resolve.","If reproducible, gather the error and report a bug since deployments should always serialize."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Confirm secrets provider availability before creating/updating stacks\nif (secretsProvider === 'passphrase' && !process.env.PULUMI_CONFIG_PASSPHRASE) {\n  throw new Error('passphrase required for this stack\\'s secrets provider');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await pulumi.stack.create(name);\n} catch (err) {\n  if (/serializing checkpoint/.test(err.message)) {\n    // read wrapped cause; fix secrets provider or retry\n  } else throw err;\n}","preventionTips":["Set PULUMI_CONFIG_PASSPHRASE or KMS credentials before stack operations","Keep Pulumi up to date for serialization fixes","Escalate reproducible failures as bugs with the wrapped cause"],"tags":["serialization","checkpoint","deployment"],"backgroundTag":"checkpoint-marshal-failed","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}