feat(build): support dSYMs with IPA uploads - #1467
Conversation
Add a repeatable --dsym flag to `build upload` that embeds dSYM bundles into the synthetic XCArchive built from an IPA. IPAs often omit dSYMs after app thinning, so this lets clients attach debug symbols without constructing an XCArchive themselves. Each --dsym value may be a .dSYM bundle, a directory of bundles, or a ZIP of either. dSYMs only apply to a single IPA upload; using --dsym with a non-IPA build or multiple builds is rejected. Ports getsentry/sentry-cli#3393. Fixes #1428
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
Jared, resume this PR. Address every active finding: normalize trailing slashes on direct dSYM bundles, use the straightforward efficient collection path where appropriate, add regression coverage, then validate and re-request review. |
jamieQ
left a comment
jamieQ
left a comment
There was a problem hiding this comment.
Overall seems like a pretty faithful port from what I can tell. I'm a bit concerned with possible memory consumption issues when processing the dSYMs which we can hopefully improve. Since we're modeling this logic off what (hopefully) will go into the sentry-cli implementation, let's hold off on merging this until that version is merged.
|
Jared, see my inline responses. Address all of them and ask for a re-review from Jamie |
…ntee no symlinks from ZIPs - Normalize both / and \ before the .. check; add resolve-based safeJoin guard. - Post-extract scan rejects any symlink that somehow appears inside the temp dir (even though fflate never emits them). - Addresses the two remaining JamieQ review comments on the ZIP extraction path.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
There are 3 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 2ec3f33. Configure here.
- Replace the hardcoded base+'/' containment check with relative()/isAbsolute() so the traversal guard works on Windows (resolve emits backslashes there). - Parse the ZIP central directory for S_IFLNK external attributes and reject symlink entries before extraction — fflate's unzipSync drops attributes and would otherwise turn a symlink into a regular file holding the link target. - Drop the post-extract readdir scan (it could never see ZIP symlinks). - Add regression tests for a ZIP symlink entry and a ..\ traversal entry.
Replaces the push loop for dsymEntries with a spread .map(), per BYK's review comment.
3 participants
Adds a repeatable
--dsymflag tosentry build upload. IPAs often omit dSYMs after app thinning, so this embeds the specified dSYM bundles into the synthetic XCArchive built from an IPA — no client-side XCArchive construction needed. Ports getsentry/sentry-cli#3393.Each
--dsymvalue may be a.dSYMbundle, a directory of bundles, or a ZIP of either. dSYMs only apply to a single IPA upload;--dsymwith a non-IPA build or with multiple builds is rejected.Testing
vitest run test/lib/build test/commands/build(65 pass),tsc --noEmit, biome check.Closes #1428