(TLS 1.3) sentry-cli debug-files upload fails with [35] SSL connect error (A bad protocol version was encountered)

[igordrljic]

CLI Version

sentry-cli 2.38.0

Operating System and Architecture

• macOS (arm64)
• macOS (x86_64)
• Linux (i686)
• Linux (x86_64)
• Linux (armv7)
• Linux (aarch64)
• Windows (i686)
• Windows (x86_64)

Operating System Version

maxOS Sonoma Version 14.2.1 (23C71)

Link to reproduction repository

No response

CLI Command

sentry-cli debug-files upload \ --log-level debug \ --include-sources \ --org organization \ --project project-ios \ ~/Library/Developer/Xcode/DerivedData/project-eseqoymeqyogfmenscunnswtziup/Build/Products/Debug-iphoneos

Exact Reproduction Steps

I am developing an iOS application and would like to use Sentry for issue monitoring.
I set up the sentry by installing it following instructions from this link: https://docs.sentry.io/platforms/apple/guides/ios/
After that I integrated the sentry into my project using sentry-wizard.
For integration method I chose Swift Package Manager.

During app building phase I noticed that Upload Debug Symbols to Sentry Xcode script fails to uploads symbols. I checked the portal and reported issues didn't have symbols.

I tried uploading debug symbol files with sentry-cli, but the result was the same:

% sentry-cli debug-files upload \
  --log-level debug \
  --include-sources \
  --org organization \
  --project project-ios \
  ~/Library/Developer/Xcode/DerivedData/project-eseqoymeqyogfmenscunnswtziup/Build/Products/Debug-iphoneos

  INFO    2024-10-29 11:58:32.785299 +01:00 Loaded config from ~/Projects/iOS/applications/project/.sentryclirc
  
  DEBUG   2024-10-29 11:58:32.786138 +01:00 sentry-cli version: 2.38.0, platform: "darwin", architecture: "arm64"
  
  INFO    2024-10-29 11:58:32.788834 +01:00 sentry-cli was invoked with the following command line: "sentry-cli" "debug-files" "upload" "--log-level" "debug" "--include-sources" "--org" "organization" "--project" "project-ios" "~/Library/Developer/Xcode/DerivedData/project-eseqoymegyolfmenscunkswtziup/Build/Products/Debug-iphoneos"
 
  INFO    2024-10-29 11:58:32.789113 +01:00 Issuing a command for Organization: organization Project: project-ios

  DEBUG   2024-10-29 11:58:32.790293 +01:00 request GET https://sentry.custom.org/api/0/organizations/organization/chunk-upload/

  DEBUG   2024-10-29 11:58:32.790331 +01:00 using token authentication

  DEBUG   2024-10-29 11:58:32.790343 +01:00 retry number 0, max retries: 0

error: API request failed
Caused by:
    [35] SSL connect error (A bad protocol version was encountered)
  
  INFO    2024-10-29 11:58:32.826271 +01:00 Skipping update nagger update check

I tried debugging the connection using curl:

% curl -X GET https://sentry.custom.org/api/0/organizations/organization/chunk-upload/ \
-H "Authorization: Bearer ..." 

{"url":"https://sentry.custom.org/api/0/organizations/organization/chunk-upload/","chunkSize":8388608,"chunksPerRequest":64,"maxFileSize":2147483648,"maxRequestSize":33554432,"concurrency":8,"hashAlgorithm":"sha1","compression":["gzip"],"accept":["debug_files","release_files","pdbs","sources","bcsymbolmaps","il2cpp","portablepdbs","artifact_bundles"]}

It looks like the curl doesn't have the SSL issue that sentry-cli has.

Can you please help me find out what is the issue?
If you need any additional information I'm at your disposal.

Expected Results

I expected Upload Debug Symbols to Sentry Xcode script to upload debug symbols successfully.
I expected sentry-cli to upload debug symbols successfully.

Actual Results

Instead of successful debug symbol upload I see this error:

error: API request failed
Caused by:
    [35] SSL connect error (A bad protocol version was encountered)

Logs

% sentry-cli debug-files upload \
  --log-level debug \
  --include-sources \
  --org organization \
  --project project-ios \
  ~/Library/Developer/Xcode/DerivedData/project-eseqoymeqyogfmenscunnswtziup/Build/Products/Debug-iphoneos

  INFO    2024-10-29 11:58:32.785299 +01:00 Loaded config from ~/Projects/iOS/applications/project/.sentryclirc
  
  DEBUG   2024-10-29 11:58:32.786138 +01:00 sentry-cli version: 2.38.0, platform: "darwin", architecture: "arm64"
  
  INFO    2024-10-29 11:58:32.788834 +01:00 sentry-cli was invoked with the following command line: "sentry-cli" "debug-files" "upload" "--log-level" "debug" "--include-sources" "--org" "organization" "--project" "project-ios" "~/Library/Developer/Xcode/DerivedData/project-eseqoymegyolfmenscunkswtziup/Build/Products/Debug-iphoneos"
 
  INFO    2024-10-29 11:58:32.789113 +01:00 Issuing a command for Organization: organization Project: project-ios

  DEBUG   2024-10-29 11:58:32.790293 +01:00 request GET https://sentry.custom.org/api/0/organizations/organization/chunk-upload/

  DEBUG   2024-10-29 11:58:32.790331 +01:00 using token authentication

  DEBUG   2024-10-29 11:58:32.790343 +01:00 retry number 0, max retries: 0

error: API request failed
Caused by:
    [35] SSL connect error (A bad protocol version was encountered)
  
  INFO    2024-10-29 11:58:32.826271 +01:00 Skipping update nagger update check

% curl -X GET https://sentry.custom.org/api/0/organizations/organization/chunk-upload/ \
-H "Authorization: Bearer ..." 

{"url":"https://sentry.custom.org/api/0/organizations/organization/chunk-upload/","chunkSize":8388608,"chunksPerRequest":64,"maxFileSize":2147483648,"maxRequestSize":33554432,"concurrency":8,"hashAlgorithm":"sha1","compression":["gzip"],"accept":["debug_files","release_files","pdbs","sources","bcsymbolmaps","il2cpp","portablepdbs","artifact_bundles"]}

[szokeasaurusrex]

@igordrljic I am not sure either why this issue is occurring. The error is coming from the underlying curl library. Not sure why calling curl directly does not cause the issue.

The error could be either due to a problem in Sentry CLI, or possibly a problem with your server. It looks like you are using self-hosted Sentry. Would you be able to try creating an account on our SaaS platform (the free plan will work for this) and uploading the debug files there? If you don't see an error when uploading to our SaaS platform, then this is probably due to a problem on your server.

[igordrljic]

It looks like the issue is with our self-hosted Sentry instance. I created a sample project, set it up against the SaaS Sentry instance and everything works.
Thank you for quick response!

[igordrljic]

The thing that solved the issue was downgrading TLS 1.3 to TLS 1.2 on the self-hosted Sentry server.
Did you notice before that sentry-cli has issues with TLS 1.3?

[szokeasaurusrex]

@igordrljic, no, I was not aware of a problem with TLS 1.3. This information is very helpful; I will investigate and see if I can reproduce the issue. I am renaming the issue title accordingly.