quickwit-oss/quickwit · error · anyhow::Error

update_function_code response missing code_sha256

Error message

update_function_code response missing code_sha256

What it means

After calling UpdateFunctionCode, the SDK response's code_sha256 field is expected to be present; AWS documents it as always returned, so Quickwit treats a None as a violation of the API contract and errors out. This guards callers who rely on the returned hash for verifying the deployed code version.

Source

Thrown at quickwit/quickwit-lambda-client/src/deploy.rs:382

    function_name: &str,
) -> anyhow::Result<String> {
    info!(
        function_name = %function_name,
        "updating Lambda function code to current binary"
    );

    let response = client
        .update_function_code()
        .function_name(function_name)
        .zip_file(Blob::new(LAMBDA_BINARY))
        .architectures(Architecture::Arm64)
        .send()
        .await
        .context("failed to update Lambda function code")?;

    let code_sha256 = response
        .code_sha256()
        .ok_or_else(|| anyhow!("update_function_code response missing code_sha256"))?
        .to_string();

    wait_for_function_ready(client, function_name).await?;

    Ok(code_sha256)
}

/// Publish a new immutable version from `$LATEST` with our description.
///
/// The `code_sha256` parameter guards against races: if another process
/// overwrote `$LATEST` since our `update_function_code` call, AWS will
/// reject the publish.
///
/// Returns the version number (e.g., "8").
async fn publish_version(
    client: &LambdaClient,
    function_name: &str,
    code_sha256: &str,

View on GitHub (pinned to a39730c5cd)

Solutions

1. If running against an emulator (LocalStack/moto), upgrade it so UpdateFunctionCode returns code_sha256.
2. Check the aws-sdk-lambda version matches what quickwit-lambda-client expects; upgrade the SDK.
3. As a last resort, fetch the hash via GetFunction/GetFunctionConfiguration after the update instead of relying on the update response.

Example fix

// before
let code_sha256 = response.code_sha256().ok_or_else(|| anyhow!("update_function_code response missing code_sha256"))?.to_string();
// after: fall back to fetching the configuration
let code_sha256 = match response.code_sha256() {
    Some(hash) => hash.to_string(),
    None => client.get_function_configuration().function_name(function_name).send().await?.code_sha256().context("missing code_sha256")?.to_string(),
};

fn has_code_sha256(resp: &UpdateFunctionCodeOutput) -> bool { resp.code_sha256().is_some() }

let sha = deploy_lambda_function(...).await?;
// if this errors, fall back to get_function_configuration to obtain code_sha256

When it happens

Trigger: Calling deploy_lambda_function on an existing function: the UpdateFunctionCode response arrives without code_sha256 — effectively only possible with an unexpected/changed AWS SDK response or a mocked/partial response.

Common situations: AWS API behavior change or SDK upgrade where the field moved/renamed; testing against a stubbed LocalStack/moto that omits code_sha256 in the response.

Understand the failure class

Background: "invalid response format", "malformed payload", "missing data field": when an API returns 200 but the response shape is wrong — this error's family across 23 libraries.

Related errors

• lambda function '{}' last update failed: {}
• lambda function '{}' did not become ready within {} seconds
• failed to list Lambda versions for '{}': {}
• created function has no version number
• failed to create Lambda function '{}': {}

AI-assisted analysis of quickwit-oss/quickwit@a39730c5cd (2026-09-08). Data as JSON: /api/errors/7c7638629199014e. Report an issue: GitHub.