sentrySvelteKit vite build fails in CI: error: API request failed - SSL peer certificate or SSH remote key was not OK

[nohehf]

Update: If you encounter this issue or something similar, here is a workaround: #8207 (comment)

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/sveltekit

SDK Version

@sentry/browser 7.52.1

Framework Version

@sentry/sveltekit 7.52.1

Link to Sentry event

No response

SDK Setup

This is not related to Sentry.init, but rather to the vite plugin.

The Vite config I use to build and upload source maps is the following:

import { sveltekit } from '@sveltejs/kit/vite';
import { fileURLToPath } from 'node:url';
import { defineConfig } from 'vite';
import windicss from 'vite-plugin-windicss';
import { sentrySvelteKit } from '@sentry/sveltekit';

const sentryPlugin = sentrySvelteKit({
  sourceMapsUploadOptions: {
    release: process.env.PUBLIC_RELEASE,
    org: process.env.SENTRY_ORG,
    project: process.env.SENTRY_PROJECT,
    authToken: process.env.SENTRY_AUTH_TOKEN,
    ignore: ['node_modules'],
  },
  debug: true,
});

export default defineConfig({
  plugins: [sentryPlugin, sveltekit(), windicss()]
  mode: process.env.ENVIRONMENT ?? 'localhost',
  envDir: './env',
  css: {
    preprocessorOptions: {
      scss: { additionalData: '@use "src/variables.scss" as *;' },
    },
  },
  resolve: {
    // Aliases have to be copied to svelte.config.js too
    alias: {
      // Storybook requires absolute paths, for some reason
      $assets: fileURLToPath(new URL('src/assets', import.meta.url)),
      $lib: fileURLToPath(new URL('src/lib', import.meta.url)),
      $params: fileURLToPath(new URL('src/params', import.meta.url)),
    },
  },
});

Steps to Reproduce

This config works just fine on my local machine when building my application.
When used in a GitlabCI it crashes with the error below. I could not reproduce the error on any machine other than GitlabCI. The environment used in local and CI is verified to be the exact same, and I use the same commands to build the application.
We have other CIs using sentry-cli that works just fine (with the same sentry organization and auth_token).

Expected Result

The plugin should upload source maps in the CI as on a local machine.

Actual Result

You can see the logs of the failed CI below.
Notes:

• I replaced some somewhat sensitive information with [...]
• [MASKED] was already in the original logs
• I've set SENTRY_LOG_LEVEL to debug in the env

[Previous tasks...]
@[...]/frontend:build: [Source Maps Plugin] Enabeling source map generation
@[...]/frontend:build: 
@[...]/frontend:build: vite v4.3.0-beta.2 building SSR bundle for localhost...
@[...]/frontend:build: [sentry-vite-plugin] Debug: Called 'buildStart'
@[...]/frontend:build: ✓ 0 modules transformed.
@[...]/frontend:build: [Source Maps Plugin] Looking up source maps in /builds/[...]/services/frontend/build
@[...]/frontend:build: [Source Maps Plugin] Flattening source maps
@[...]/frontend:build: [sentry-vite-plugin] Debug: Called "writeBundle"
@[...]/frontend:build: ✓ built in 8ms
@[...]/frontend:build: [sentry-vite-plugin] Error: Command failed: /builds/[...]/node_modules/@sentry/cli/sentry-cli releases new a5e2df6f
@[...]/frontend:build:   DEBUG   2023-05-24 12:58:33.876380273 +00:00 sentry-cli version: 2.18.1, platform: "linux", architecture: "x86_64"
@[...]/frontend:build:   INFO    2023-05-24 12:58:33.876479163 +00:00 sentry-cli was invoked with the following command line: "/builds/[...]/node_modules/@sentry/cli/sentry-cli" "releases" "new" "a5e2df6f"
@[...]/frontend:build:   DEBUG   2023-05-24 12:58:33.87700[149](https://gitlab.com/[...]/-/jobs/4342561873#L149)1 +00:00 request POST [MASKED]api/0/projects/[...]/releases/
@[...]/frontend:build:   DEBUG   2023-05-24 12:58:33.877026071 +00:00 using token authentication
@[...]/frontend:build:   DEBUG   2023-05-24 12:58:33.877044671 +00:00 json body: {"version":"a5e2df6f","projects":["frontend"],"dateStarted":"2023-05-24T12:58:33.876979631Z"}
@[...]/frontend:build:   DEBUG   2023-05-24 12:58:33.877054211 +00:00 retry number 0, max retries: 0
@[...]/frontend:build: error: API request failed
@[...]/frontend:build:   caused by: [60] SSL peer certificate or SSH remote key was not OK (SSL certificate problem: unable to get local issuer certificate)
@[...]/frontend:build:   DEBUG   2023-05-24 12:58:33.945186632 +00:00 skipping update nagger because session is not attended
@[...]/frontend:build: 
@[...]/frontend:build: [Source Maps Plugin] Failed to upload source maps!
@[...]/frontend:build: [Source Maps Plugin] Please make sure, you specified a valid Sentry auth token, as well as your org and project slugs.
@[...]/frontend:build: [Source Maps Plugin] Further information: https://github.com/getsentry/sentry-javascript/blob/develop/packages/sveltekit/README.md#uploading-source-maps
@[...]/frontend:build: [sentry-upload-source-maps] Sentry CLI "info" command failed, make sure you have an auth token configured, and your `url` option is correct.
@[...]/frontend:build: error during build:
@[...]/frontend:build: Error: Sentry CLI "info" command failed, make sure you have an auth token configured, and your `url` option is correct.
@[...]/frontend:build:     at _callee2$ (/builds/[...]/node_modules/@sentry/bundler-plugin-core/dist/cjs/index.js:1334:19)
@[...]/frontend:build:     at tryCatch (/builds/[...]/node_modules/@sentry/bundler-plugin-core/dist/cjs/index.js:134:17)
@[...]/frontend:build:     at Generator._invoke (/builds/[...]/node_modules/@sentry/bundler-plugin-core/dist/cjs/index.js:114:24)
@[...]/frontend:build:     at Generator.throw (/builds/[...]/node_modules/@sentry/bundler-plugin-core/dist/cjs/index.js:[165](https://gitlab.com/[...]/-/jobs/4342561873#L165):21)
@[...]/frontend:build:     at asyncGeneratorStep (/builds/[...]/node_modules/@sentry/bundler-plugin-core/dist/cjs/index.js:398:24)
@[...]/frontend:build:     at _throw (/builds/[...]/node_modules/@sentry/bundler-plugin-core/dist/cjs/index.js:424:9)
@[...]/frontend:build: ERROR: command finished with error: command (/builds/[...]/services/frontend) yarn run build exited (1)
command (/builds/[...]/services/frontend) yarn run build exited (1)
 ERROR  run failed: command  exited (1)
 Tasks:    13 successful, 14 total
Cached:    0 cached, 14 total
  Time:    1m3.592s

[lforst]

Hm, looks like a blip with certs. I don't think this is related to an issue in the code. Can you try again in a while or check the SSH/DNS setup in your CI?

[nohehf]

I'll check that, tho as I said it works just fine in other CIs via the sentry-cli and it is SAAS gitlab (not selfhosted) so the SSH/DNS setup is probably not on our side

[Lms24]

Hmm never seen this before... In the other CIs that work correctly, are you using v1.x or v2.x of sentry-cli?

[nohehf]

Hmm never seen this before... In the other CIs that work correctly, are you using v1.x or v2.x of sentry-cli?

In this very CI I didn't install sentry-cli it is a dependency of @sentry/sveltekit resolved to version 2.18.1
In the other CIs we install it via curl -sL https://sentry.io/get-cli/ | bash so probably latest so ^v2 too

[nohehf]

I guess I'll try to generate source maps from the Vite plugin, disable auto uploading and then upload them manually via sentry-cli. But this is definitely weird. Should I open an issue on GitLab? might be on their end

[Lms24]

I'll try to generate source maps from the Vite plugin

You mean @sentry/vite-plugin? I'd be surprised if this yielded a different result. sentrySvelteKit basically just initializes the Vite plugin with a bit of custom behaviour around it to fix the messed up SvelteKit source maps. It doesn't change anything related to uploading them. But feel free to give it a try :)

The thing that bugs me here is that our vite plugin doesn't do anything with certificates either. It just invokes Sentry CLI for the respective API calls to Sentry.

I'll tag @kamilogorek - have you by any chance ever heard of certificate problems with Sentry CLI/bundler plugins in GitLab?

[nohehf]

I'll try to generate source maps from the Vite plugin

You mean @sentry/vite-plugin? I'd be surprised if this yielded a different result. sentrySvelteKit basically just initializes the Vite plugin with a bit of custom behaviour around it to fix the messed up SvelteKit source maps. It doesn't change anything related to uploading them. But feel free to give it a try :)

The thing that bugs me here is that our vite plugin doesn't do anything with certificates either. It just invokes Sentry CLI for the respective API calls to Sentry.

I'll tag @kamilogorek - have you by any chance ever heard of certificate problems with Sentry CLI/bundler plugins in GitLab?

No I meant still generating it with @sentry/seveltekit but uploading manually via sentry-cli, sorry for the confusion.

Thanks for the help and for the tag!