Skip to content

Use plain text values for Sentry + env-injected token #1850

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mokagio merged 4 commits into from
Jul 30, 2026
Merged

Use plain text values for Sentry + env-injected token #1850

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
dbdadc6
Use plain text values for Sentry + env-injected token
mokagio Jul 19, 2026
ff4aefa
Use Gradle's provider API over `System.getenv`
mokagio Jul 19, 2026
7eaf543
Disable crash logging in debug builds
mokagio Jul 19, 2026
a816342
Stop the Sentry SDK installing itself
mokagio Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 1 addition & 6 deletions .configure
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,6 @@
"destination": "Simplenote/gradle.properties",
"encrypt": true
},
{
"file": "android/simplenote/sentry.properties",
"destination": "sentry.properties",
"encrypt": true
},
{
"file": "android/automattic.jks",
"destination": ".configure-files/release.jks",
Expand All @@ -32,4 +27,4 @@
"file_dependencies": [

]
}
}
1 change: 0 additions & 1 deletion .configure-files/sentry.properties.enc
View file
Open in desktop

This file was deleted.

10 changes: 9 additions & 1 deletion Simplenote/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,8 @@ android {

minSdkVersion 23
targetSdkVersion 35

buildConfigField "String", "SENTRY_DSN", "\"https://89e443ca3fd84e588d1809cfbfcc40f4@sentry.io/1455558\""
}
Comment on lines 43 to 47

@mokagio mokagio Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ParaskP7 @wzieba what do you think of this?

This is the first app, as far as I can tell, that makes the DSN public, so I think it'd be good to think it through well so we can adopt the same approach to the other apps.

On the one hand, the crashLoggingEnabled() implementation is such that we can afford to have a single, static DSN because only the release builds will effectively use it. On the other, that assumption can change at any time so I don't like relying on it.

@wzieba wzieba Jul 20, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it doesn't matter how we provide the DSN: as long as we have autoInstallation disabled (in projects that use newer versyion of Sentry Gradle Plugin), the way we provice DSN shouldn't matter.

It feels slightly odd to share the DSN in plaintext, though, but it's maybe the fact that I'm so used to keeping this in secrets (for side readers: the DSN is not technically a secret, because anyone can extract it from the app bundle from Google Play Store anyway)

@mokagio mokagio Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

as long as we have autoInstallation disabled (in projects that use newer versyion of Sentry Gradle Plugin), the way we provice DSN shouldn't matter.

Noted. Implemented in a816342

for side readers: the DSN is not technically a secret, because anyone can extract it from the app bundle from Google Play Store anyway

Moreover, the DSN is designed by Sentry to be public in the first place. See https://docs.sentry.io/concepts/key-terms/dsn-explainer/#dsn-utilization



Expand Down Expand Up @@ -69,6 +71,13 @@ android {
}
}

sentry {
org = "a8c"
projectName = "simplenote-android"
authToken = providers.environmentVariable("SENTRY_AUTH_TOKEN").orNull
autoInstallation.enabled = false
}
Comment thread
Copilot marked this conversation as resolved.

buildscript {
dependencies {
classpath "io.sentry:sentry-android-gradle-plugin:$sentryVersion"
Expand Down Expand Up @@ -219,7 +228,6 @@ android.applicationVariants.all { variant ->
key == "GOOGLE_ANALYTICS_ID" ||
key == "LOGIN_EMAIL" ||
key == "LOGIN_PASSWORD" ||
key == "SENTRY_DSN" ||
key == "WPCOM_CLIENT_ID" ||
key == "SCREENSHOT_EMAIL" ||
key == "SCREENSHOT_PASSWORD") {
Expand Down
1 change: 0 additions & 1 deletion Simplenote/gradle.properties-example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ crashlyticsApiKey = 0
googleAnalyticsId =
loginEmail =
loginPassword =
sentryDsn=https://00000000000000000000000000000000@sentry.io/00000000
simperiumAppId = history-analyst-dad
simperiumAppKey = dccacc59bbef4982a15abaeafaf7bc8a
wpcomClientId =
Expand Down
4 changes: 4 additions & 0 deletions ...n/java/com/automattic/simplenote/utils/crashlogging/SimplenoteCrashLoggingDataProvider.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,10 @@ class SimplenoteCrashLoggingDataProvider @Inject constructor(
get() = PerformanceMonitoringConfig.Disabled

override fun crashLoggingEnabled(): Boolean {
if (BuildConfig.DEBUG) {
return false
}

return Simplenote.analyticsIsEnabled()
}

Expand Down