Double Retrace for ProGuard Symbolication

[Angelodaniel]

Problem

Customer is developing an SDK and an App which utilizes this SDK. These are separate projects, published on a different cadence and both use ProGuard for obfuscation.

The SDK is obfuscated during the build and published to their maven repository as a set of modules. We are currently not uploading the SDK's ProGuard mapping files to Sentry.
The App then consumes the SDK as a dependency from the maven repository. We are uploading the ProGuard mapping file for the application to Sentry.

When an issue occurs, we get the application-specific references deobfuscated correctly. However, SDK frames remain minified and this is what we would like to address.

Users have confirmed that calling retrace twice locally works correctly:

1. First call with the application mapping file
2. Second call with the SDK library mapping file

However, on Sentry side, only the application mapping file is being used for retracing, even though SDK library mapping UUIDs are provided through the custom event processor. We expected Sentry to iterate through all listed mapping files to de-obfuscate the respective stacktrace, similar to the local double retrace process.

They've tried merging the files but this gives the incorrect line numbers still, even though it's already an improvement.

Proposed Solution

Implement double retrace (chaining multiple ProGuard mappings) that applies each ProGuard mapping in sequence:

1. Apply the application ProGuard mapping to deobfuscate the frame
2. Take the deobfuscated result and apply the SDK library ProGuard mapping
3. Continue until all mapping files (application + SDK libraries) have been applied or no further deobfuscation is possible

Add a chain_proguard_mappings: bool parameter to SymbolicateJvmStacktraces (default: false for backward compatibility).

Benefits

1. Accurate Line Numbers: Correct line numbers for SDK frames in app stack traces
2. Complete Deobfuscation: Full symbolication including inline functions
3. Reduced Manual Work: Eliminates need for manual double retrace
4. Better Debugging: More accurate stack traces for issue resolution
5. Expected Behavior: Matches the working local double retrace process
6. SDK Development: Enables proper debugging for SDK developers when issues occur in consuming applications

[linear]

SYMBOLI-29 Double Retrace for ProGuard Symbolication

[loewenheim]

Hi, is there an example event we can look at?

[loewenheim]

To explain the status quo a bit: Symbolicator already uses all ProGuard files listed in the event, but what it doesn't do is iterate the deobfuscation. I don't think that would be very hard to adapt.

[djevayopattij-tomtom]

Hi, the example event would be https://tomtom-navapp.sentry.io/issues/6748147036/events/4ce74234e0de4ff5a55d10290ec70910/.

[loewenheim]

Hi @djevayopattij-tomtom, that event only contains a single ProGuard image. Symbolicator fundamentally can't apply ProGuard mapping files that aren't listed in the event and aren't uploaded to Sentry.