@sentry/cli 2.0.4 → 2.1.4

package/README.md

@@ -1,6 +1,11 @@
 <p align="center">
-    <img src="https://sentry-brand.storage.googleapis.com/sentry-logo-black.png" width="280">
-    <br />
+  <a href="https://sentry.io/?utm_source=github&utm_medium=logo" target="_blank">
+    <picture>
+      <source srcset="https://sentry-brand.storage.googleapis.com/sentry-logo-white.png" media="(prefers-color-scheme: dark)" />
+      <source srcset="https://sentry-brand.storage.googleapis.com/sentry-logo-black.png" media="(prefers-color-scheme: light), (prefers-color-scheme: no-preference)" />
+      <img src="https://sentry-brand.storage.googleapis.com/sentry-logo-black.png" alt="Sentry" width="280">
+    </picture>
+  </a>
 </p>
 
 # Official Sentry Command Line Interface
@@ -20,10 +25,31 @@ fastlane tools.
 
 ## Installation
 
-The recommended way to install is with everybody's favorite curl to bash:
+If you are on OS X or Linux, you can use the automated downloader which will fetch the latest release version for you and install it:
 
     curl -sL https://sentry.io/get-cli/ | bash
 
+We do however, encourage you to pin the specific version of the CLI, so your builds are always reproducible.
+To do that, you can use the exact same method, with an additional version specifier:
+
+    curl -sL https://sentry.io/get-cli/ | SENTRY_CLI_VERSION=2.0.4 bash
+
+This will automatically download the correct version of `sentry-cli` for your operating system and install it. If necessary, it will prompt for your admin password for `sudo`. For a different installation location or for systems without `sudo` (like Windows), you can `export INSTALL_DIR=/custom/installation/path` before running this command.
+
+If you are using `sentry-cli` on Windows environments, [Microsoft Visual C++ Redistributable](https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist) is required.
+
+To verify it’s installed correctly you can bring up the help:
+
+    sentry-cli --help
+
+### pip
+
+_New in 2.14.3_: `sentry-cli` can also be installed using `pip`:
+
+```bash
+pip install sentry-cli
+```
+
 ### Node
 
 Additionally you can also install this binary via npm:
@@ -79,6 +105,15 @@ docker pull getsentry/sentry-cli
 docker run --rm -v $(pwd):/work getsentry/sentry-cli --help
 ```
 
+Starting version _`2.8.0`_, in case you see `"error: config value 'safe.directory' was not found;"` message,
+you also need to correctly set UID and GID of mounted volumes like so:
+
+```sh
+docker run --rm -u "$(id -u):$(id -g)" -v $(pwd):/work getsentry/sentry-cli --help
+```
+
+This is required due to security issue in older `git` implementations. See [here](https://github.blog/2022-04-12-git-security-vulnerability-announced/) for more details.
+
 ## Compiling
 
 In case you want to compile this yourself, you need to install at minimum the

package/checksums.txt

@@ -1,9 +1,9 @@
-sentry-cli-Darwin-arm64=6ad23605f6e345375a80aeebc5db7dc9e42226abf63e39dd91730b8b831511a8
-sentry-cli-Darwin-universal=283370a6bf7356a422f39ab805094edefe15f087d512c4579b60e584cf4a3e20
-sentry-cli-Darwin-x86_64=f1f3ea7f5d1ed481080e8eb150b3adbf4ab02890f9ec1227e1703f7ec8e25c84
-sentry-cli-Linux-aarch64=e796a2d535cc59c6d72e5e19aa7604e964328b5a7e09a62f695e0d9acde9b07e
-sentry-cli-Linux-armv7=19ea3f1a843b37df82b310ab82e330f6f26e4ff8b20b4c98c2a47c894c2164ff
-sentry-cli-Linux-i686=abb2f9daeb78ba01ae3f2c36e4d64fb54fd3e937683c25f980872331c2a0e1b3
-sentry-cli-Linux-x86_64=46b6d913e3bfeccaf3170493942120a1b7b11b07c04e932b8fa643187c621fdf
-sentry-cli-Windows-i686.exe=7df3c7e672dae7338245a07685a05847dfa8d18daea51bbbab78feb95a7c0199
-sentry-cli-Windows-x86_64.exe=ecbc89c357bf67cfa9a2f937a10253c46f1183e8480a86c688885a0e3017003b
+sentry-cli-Darwin-arm64=9bfaca2efe775f0ae4f3683d325fa98ce19a46acbeafd137674f3b21822564ab
+sentry-cli-Darwin-universal=94e1249b692301e7287ce059bbff83a68d9568e134bcb196bee79a20813b0c69
+sentry-cli-Darwin-x86_64=c0356f589eb28c9dcd530b6cdbadefac9e4ee7ddafb74ceae0754582fbead60e
+sentry-cli-Linux-aarch64=0e04e810af16520b39a4edb3dd163edd5991de4ea479e55834cf4ac7e36bfa90
+sentry-cli-Linux-armv7=1b97cce44b32ef10f992dbf627e75632ad72cdc00d9b06e9d75b7676f632ae86
+sentry-cli-Linux-i686=2003f137a2038c431723508680c01d058e35eea2db789f0ffc22d667c2c3f9be
+sentry-cli-Linux-x86_64=272fefd13e7076cec6aa1896820f4edf7d1e4478781a2c3538cfb7a62dee1214
+sentry-cli-Windows-i686.exe=379c2cf9434a670529aa51d1c9ff381a30106f29639852484252cdd017da0d06
+sentry-cli-Windows-x86_64.exe=a33e783bfdf70276aaa85cad6db38b994406f58119269c3f30976ba498ed86a6

package/js/helper.js

@@ -1,21 +1,29 @@
 'use strict';
 
+const path = require('path');
 const childProcess = require('child_process');
 
 /**
- * Absolute path to the sentry-cli binary (platform dependent).
- * @type {string}
+ * This convoluted function resolves the path to the `sentry-cli` binary in a
+ * way that can't be analysed by @vercel/nft.
+ *
+ * Without this, the binary can be detected as an asset and included by bundlers
+ * that use @vercel/nft.
+ * @returns {string} The path to the sentry-cli binary
  */
-let binaryPath = eval(
-  "require('path').resolve(__dirname, require('os').platform() === 'win32' ? '..\\sentry-cli.exe' : '../sentry-cli')"
-);
+function getBinaryPath() {
+  const parts = [];
+  parts.push(__dirname);
+  parts.push('..');
+  parts.push(`sentry-cli${process.platform === 'win32' ? '.exe' : ''}`);
+  return path.resolve(...parts);
+}
 
 /**
- * NOTE: `eval` usage is a workaround for @vercel/nft detecting the binary itself as the hard dependency
- *       and effectively always including it in the bundle, which is not what we want.
- * ref: https://github.com/getsentry/sentry-javascript/issues/3865
- * ref: https://github.com/vercel/nft/issues/203
+ * Absolute path to the sentry-cli binary (platform dependent).
+ * @type {string}
  */
+let binaryPath = getBinaryPath();
 
 /**
  * Overrides the default binary path with a mock value, useful for testing.
@@ -53,7 +61,7 @@ function mockBinaryPath(mockPath) {
 function serializeOptions(schema, options) {
   return Object.keys(schema).reduce((newOptions, option) => {
     const paramValue = options[option];
-    if (paramValue === undefined) {
+    if (paramValue === undefined || paramValue === null) {
       return newOptions;
     }
 
@@ -164,6 +172,12 @@ async function execute(args, live, silent, configFile, config = {}) {
   }
   if (config.customHeader) {
     env.CUSTOM_HEADER = config.customHeader;
+  } else if (config.headers) {
+    const headers = Object.entries(config.headers).flatMap(([key, value]) => [
+      '--header',
+      `${key}:${value}`,
+    ]);
+    args = [...headers, ...args];
   }
   return new Promise((resolve, reject) => {
     if (live === true) {

package/js/index.d.ts

@@ -38,11 +38,6 @@ declare module '@sentry/cli' {
      * This value will update `SENTRY_VCS_REMOTE` env variable.
      */
     vcsRemote?: string;
-    /**
-     * Unique identifier for the distribution, used to further segment your release.
-     * Usually your build number.
-     */
-    dist?: string;
     /**
      * If true, all logs are suppressed.
      */
@@ -52,6 +47,11 @@ declare module '@sentry/cli' {
      * This value will update `CUSTOM_HEADER` env variable.
      */
     customHeader?: string;
+    /**
+     * Headers added to every outgoing network request.
+     * This value does not set any env variable, and is overridden by `customHeader`.
+     */
+    headers?: Record<string, string>;
   }
 
   /**
@@ -59,7 +59,9 @@ declare module '@sentry/cli' {
    * case `paths` takes the place of `include` in the options so as to make it
    * clear that this is not recursive.
    */
-  export type SourceMapsPathDescriptor = Omit<SentryCliUploadSourceMapsOptions, 'include'> & { paths: string[] }
+  export type SourceMapsPathDescriptor = Omit<SentryCliUploadSourceMapsOptions, 'include'> & {
+    paths: string[];
+  };
 
   export interface SentryCliUploadSourceMapsOptions {
     /**
@@ -85,6 +87,11 @@ declare module '@sentry/cli' {
      * This prevents the automatic detection of sourcemap references.
      */
     sourceMapReference?: boolean;
+    /**
+     * Enable artifacts deduplication prior to uploading. This will skip uploading
+     * any artifacts that are already present on the server. Defaults to `true`.
+     */
+    dedupe?: boolean;
     /**
      * When paired with the rewrite option this will remove a prefix from uploaded files.
      * For instance you can use this to remove a path that is build machine specific.
@@ -116,6 +123,15 @@ declare module '@sentry/cli' {
      * By default the following file extensions are processed: js, map, jsbundle and bundle.
      */
     ext?: string[];
+    /**
+     * Unique identifier for the distribution, used to further segment your release.
+     * Usually your build number.
+     */
+    dist?: string;
+    /**
+     * Use new Artifact Bundles upload, that enables use of Debug ID for Source Maps discovery.
+     */
+    useArtifactBundle?: boolean;
   }
 
   export interface SentryCliNewDeployOptions {
@@ -176,31 +192,19 @@ declare module '@sentry/cli' {
   }
 
   export interface SentryCliReleases {
-    ['new'](
-      release: string,
-      options?: { projects: string[] } | string[]
-    ): Promise<string>;
+    ['new'](release: string, options?: { projects: string[] } | string[]): Promise<string>;
 
-    setCommits(
-      release: string,
-      options: SentryCliCommitsOptions
-    ): Promise<string>;
+    setCommits(release: string, options: SentryCliCommitsOptions): Promise<string>;
 
-    finalize(release: string): Promise<string>
+    finalize(release: string): Promise<string>;
 
-    proposeVersion(): Promise<string>
+    proposeVersion(): Promise<string>;
 
-    uploadSourceMaps(
-      release: string,
-      options: SentryCliUploadSourceMapsOptions
-    ): Promise<string>
+    uploadSourceMaps(release: string, options: SentryCliUploadSourceMapsOptions): Promise<string>;
 
     listDeploys(release: string): Promise<string>;
 
-    newDeploy(
-      release: string,
-      options: SentryCliNewDeployOptions
-    ): Promise<string>
+    newDeploy(release: string, options: SentryCliNewDeployOptions): Promise<string>;
 
     execute(args: string[], live: boolean): Promise<string>;
   }
@@ -214,14 +218,14 @@ declare module '@sentry/cli' {
      * This value will update `SENTRY_PROPERTIES` env variable.
      * @param options {@link SentryCliOptions}
      */
-    constructor(configFile?: string | null, options?: SentryCliOptions)
+    constructor(configFile?: string | null, options?: SentryCliOptions);
 
     public configFile?: string;
     public options?: SentryCliOptions;
-    public releases: SentryCliReleases
+    public releases: SentryCliReleases;
 
-    public static getVersion(): string
-    public static getPath(): string
-    public execute(args: string[], live: boolean): Promise<string>
+    public static getVersion(): string;
+    public static getPath(): string;
+    public execute(args: string[], live: boolean): Promise<string>;
   }
 }

package/js/logger.js

@@ -0,0 +1,14 @@
+'use strict';
+
+const format = require('util').format;
+
+module.exports = class Logger {
+  constructor(stream) {
+    this.stream = stream;
+  }
+
+  log() {
+    const message = format(...arguments);
+    this.stream.write(`[sentry-cli] ${message}\n`);
+  }
+};

package/js/releases/index.js

@@ -140,13 +140,15 @@ class Releases {
    *   ignoreFile: null,          // path to a file with ignore rules
    *   rewrite: false,            // preprocess sourcemaps before uploading
    *   sourceMapReference: true,  // add a source map reference to source files
+   *   dedupe: true,              // deduplicate already uploaded files
    *   stripPrefix: [],           // remove certain prefices from filenames
    *   stripCommonPrefix: false,  // guess common prefices to remove from filenames
    *   validate: false,           // validate source maps and cancel the upload on error
    *   urlPrefix: '',             // add a prefix source map urls after stripping them
    *   urlSuffix: '',             // add a suffix source map urls after stripping them
    *   ext: ['js', 'map', 'jsbundle', 'bundle'],  // override file extensions to scan for
-   *   projects: ['node']        // provide a list of projects
+   *   projects: ['node'],        // provide a list of projects
+   *   decompress: false          // decompress gzip files before uploading
    * });
    *
    * @param {string} release Unique name of the release.

package/js/releases/options/uploadSourcemaps.js

@@ -11,6 +11,10 @@ module.exports = {
     param: '--dist',
     type: 'string',
   },
+  decompress: {
+    param: '--decompress',
+    type: 'boolean',
+  },
   rewrite: {
     param: '--rewrite',
     invertedParam: '--no-rewrite',
@@ -20,6 +24,10 @@ module.exports = {
     invertedParam: '--no-sourcemap-reference',
     type: 'boolean',
   },
+  dedupe: {
+    invertedParam: '--no-dedupe',
+    type: 'boolean',
+  },
   stripPrefix: {
     param: '--strip-prefix',
     type: 'array',
@@ -44,4 +52,8 @@ module.exports = {
     param: '--ext',
     type: 'array',
   },
+  useArtifactBundle: {
+    param: '--use-artifact-bundle',
+    type: 'boolean',
+  },
 };

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@sentry/cli",
-  "version": "2.0.4",
+  "version": "2.1.4",
   "description": "A command line utility to work with Sentry. https://docs.sentry.io/hosted/learn/cli/",
   "repository": "git://github.com/getsentry/sentry-cli.git",
   "homepage": "https://docs.sentry.io/hosted/learn/cli/",
   "author": "Sentry",
   "license": "BSD-3-Clause",
   "engines": {
-    "node": ">= 12"
+    "node": ">= 10"
   },
   "main": "js/index.js",
   "types": "js/index.d.ts",
@@ -17,13 +17,13 @@
   "dependencies": {
     "https-proxy-agent": "^5.0.0",
     "node-fetch": "^2.6.7",
-    "npmlog": "^6.0.1",
     "progress": "^2.0.3",
     "proxy-from-env": "^1.1.0",
     "which": "^2.0.2"
   },
   "devDependencies": {
-    "eslint": "^8.13.0",
+    "@vercel/nft": "^0.22.1",
+    "eslint": "^7.32.0",
     "eslint-config-prettier": "^8.5.0",
     "jest": "^27.5.1",
     "npm-run-all": "^4.1.5",
@@ -34,11 +34,12 @@
     "fix": "npm-run-all fix:eslint fix:prettier",
     "fix:eslint": "eslint --fix bin/* scripts/**/*.js js/**/*.js",
     "fix:prettier": "prettier --write bin/* scripts/**/*.js js/**/*.js",
-    "test": "npm-run-all test:jest test:eslint test:prettier",
+    "test": "npm-run-all test:jest test:eslint test:prettier test:vercel-nft",
     "test:jest": "jest",
     "test:watch": "jest --watch --notify",
     "test:eslint": "eslint bin/* scripts/**/*.js js/**/*.js",
-    "test:prettier": "prettier --check  bin/* scripts/**/*.js js/**/*.js"
+    "test:prettier": "prettier --check  bin/* scripts/**/*.js js/**/*.js",
+    "test:vercel-nft": "node scripts/test-vercel-nft.js"
   },
   "jest": {
     "collectCoverage": true,
@@ -46,5 +47,9 @@
     "testPathIgnorePatterns": [
       "<rootDir>/src"
     ]
+  },
+  "volta": {
+    "node": "10.24.1",
+    "yarn": "1.22.19"
   }
 }

package/scripts/install.js

@@ -15,11 +15,13 @@ const fetch = require('node-fetch');
 const HttpsProxyAgent = require('https-proxy-agent');
 const ProgressBar = require('progress');
 const Proxy = require('proxy-from-env');
-const npmLog = require('npmlog');
 const which = require('which');
 
 const helper = require('../js/helper');
 const pkgInfo = require('../package.json');
+const Logger = require('../js/logger');
+
+const logger = new Logger(getLogStream('stderr'));
 
 const CDN_URL =
   process.env.SENTRYCLI_LOCAL_CDNURL ||
@@ -47,9 +49,10 @@ function shouldRenderProgressBar() {
   const silentFlag = process.argv.some((v) => v === '--silent');
   const silentConfig = process.env.npm_config_loglevel === 'silent';
   const silentEnv = process.env.SENTRYCLI_NO_PROGRESS_BAR;
-  const ciEnv = process.env.CI === 'true';
+  const ciEnv = process.env.CI === 'true' || process.env.CI === '1';
+  const notTTY = !process.stdout.isTTY;
   // If any of possible options is set, skip rendering of progress bar
-  return !(silentFlag || silentConfig || silentEnv || ciEnv);
+  return !(silentFlag || silentConfig || silentEnv || ciEnv || notTTY);
 }
 
 function getDownloadUrl(platform, arch) {
@@ -120,13 +123,17 @@ function createProgressBar(name, total) {
 }
 
 function npmCache() {
-  const env = process.env;
-  return (
-    env.npm_config_cache ||
-    env.npm_config_cache_folder ||
-    env.npm_config_yarn_offline_mirror ||
-    (env.APPDATA ? path.join(env.APPDATA, 'npm-cache') : path.join(os.homedir(), '.npm'))
-  );
+  const keys = ['npm_config_cache', 'npm_config_cache_folder', 'npm_config_yarn_offline_mirror'];
+
+  for (let key of [...keys, ...keys.map((k) => k.toUpperCase())]) {
+    if (process.env[key]) return process.env[key];
+  }
+
+  if (process.env.APPDATA) {
+    return path.join(process.env.APPDATA, 'npm-cache');
+  }
+
+  return path.join(os.homedir(), '.npm');
 }
 
 function getCachedPath(url) {
@@ -156,14 +163,14 @@ function validateChecksum(tempPath, name) {
       }
     }
   } catch (e) {
-    npmLog.info(
+    logger.log(
       'Checksums are generated when the package is published to npm. They are not available directly in the source repository. Skipping validation.'
     );
     return;
   }
 
   if (!storedHash) {
-    npmLog.info(`Checksum for ${name} not found, skipping validation.`);
+    logger.log(`Checksum for ${name} not found, skipping validation.`);
     return;
   }
 
@@ -175,7 +182,7 @@ function validateChecksum(tempPath, name) {
       `Checksum validation for ${name} failed.\nExpected: ${storedHash}\nReceived: ${currentHash}`
     );
   } else {
-    npmLog.info('Checksum validation passed.');
+    logger.log('Checksum validation passed.');
   }
 }
 
@@ -187,7 +194,7 @@ async function downloadBinary() {
   if (process.env.SENTRYCLI_USE_LOCAL === '1') {
     try {
       const binPath = which.sync('sentry-cli');
-      npmLog.info('sentry-cli', `Using local binary: ${binPath}`);
+      logger.log(`Using local binary: ${binPath}`);
       fs.copyFileSync(binPath, outputPath);
       return Promise.resolve();
     } catch (e) {
@@ -205,7 +212,7 @@ async function downloadBinary() {
 
   const cachedPath = getCachedPath(downloadUrl);
   if (fs.existsSync(cachedPath)) {
-    npmLog.info('sentry-cli', `Using cached binary: ${cachedPath}`);
+    logger.log(`Using cached binary: ${cachedPath}`);
     fs.copyFileSync(cachedPath, outputPath);
     return;
   }
@@ -213,10 +220,10 @@ async function downloadBinary() {
   const proxyUrl = Proxy.getProxyForUrl(downloadUrl);
   const agent = proxyUrl ? new HttpsProxyAgent(proxyUrl) : null;
 
-  npmLog.info('sentry-cli', `Downloading from ${downloadUrl}`);
+  logger.log(`Downloading from ${downloadUrl}`);
 
   if (proxyUrl) {
-    npmLog.info('sentry-cli', `Using proxy URL: ${proxyUrl}`);
+    logger.log(`Using proxy URL: ${proxyUrl}`);
   }
 
   let response;
@@ -257,19 +264,29 @@ async function downloadBinary() {
     decompressor = new stream.PassThrough();
   }
   const name = downloadUrl.match(/.*\/(.*?)$/)[1];
-  const total = parseInt(response.headers.get('content-length'), 10);
-  const progressBar = createProgressBar(name, total);
+  let downloadedBytes = 0;
+  const totalBytes = parseInt(response.headers.get('content-length'), 10);
+  const progressBar = createProgressBar(name, totalBytes);
   const tempPath = getTempFile(cachedPath);
   fs.mkdirSync(path.dirname(tempPath), { recursive: true });
 
   await new Promise((resolve, reject) => {
     response.body
       .on('error', (e) => reject(e))
-      .on('data', (chunk) => progressBar.tick(chunk.length))
+      .on('data', (chunk) => {
+        downloadedBytes += chunk.length;
+        progressBar.tick(chunk.length);
+      })
       .pipe(decompressor)
       .pipe(fs.createWriteStream(tempPath, { mode: '0755' }))
       .on('error', (e) => reject(e))
-      .on('close', () => resolve());
+      .on('close', () => {
+        if (downloadedBytes >= totalBytes) {
+          resolve();
+        } else {
+          reject(new Error('connection interrupted'));
+        }
+      });
   });
 
   if (process.env.SENTRYCLI_SKIP_CHECKSUM_VALIDATION !== '1') {
@@ -305,10 +322,8 @@ if (process.env.SENTRYCLI_LOCAL_CDNURL) {
   process.on('exit', () => server.close());
 }
 
-npmLog.stream = getLogStream('stderr');
-
 if (process.env.SENTRYCLI_SKIP_DOWNLOAD === '1') {
-  npmLog.info('sentry-cli', `Skipping download because SENTRYCLI_SKIP_DOWNLOAD=1 detected.`);
+  logger.log(`Skipping download because SENTRYCLI_SKIP_DOWNLOAD=1 detected.`);
   process.exit(0);
 }
 

package/scripts/test-vercel-nft.js

@@ -0,0 +1,16 @@
+const { nodeFileTrace } = require('@vercel/nft');
+
+const entryPoint = require.resolve('..');
+
+// Trace the module entrypoint
+nodeFileTrace([entryPoint]).then((result) => {
+  console.log('@vercel/nft traced dependencies:', Array.from(result.fileList));
+
+  // If either binary is picked up, fail the test
+  if (result.fileList.has('sentry-cli') || result.fileList.has('sentry-cli.exe')) {
+    console.error('ERROR: The sentry-cli binary should not be found by @vercel/nft');
+    process.exit(-1);
+  } else {
+    console.log('The sentry-cli binary was not traced by @vercel/nft');
+  }
+});

package/scripts/wheels

@@ -0,0 +1,174 @@
+#!/usr/bin/env python3
+import argparse
+import base64
+import hashlib
+import os.path
+import shutil
+import tempfile
+import zipfile
+from typing import NamedTuple
+
+
+class Wheel(NamedTuple):
+    src: str
+    plat: str
+    exe: str = 'sentry-cli'
+
+
+WHEELS = (
+    Wheel(
+        src='sentry-cli-Darwin-arm64',
+        plat='macosx_11_0_arm64',
+    ),
+    Wheel(
+        src='sentry-cli-Darwin-universal',
+        plat='macosx_11_0_universal2',
+    ),
+    Wheel(
+        src='sentry-cli-Darwin-x86_64',
+        plat='macosx_10_15_x86_64',
+    ),
+    Wheel(
+        src='sentry-cli-Linux-aarch64',
+        plat='manylinux_2_17_aarch64.manylinux2014_aarch64.musllinux_1_2_aarch64',
+    ),
+    Wheel(
+        src='sentry-cli-Linux-armv7',
+        plat='manylinux_2_17_armv7l.manylinux2014_armv7l.musllinux_1_2_armv7l',
+    ),
+    Wheel(
+        src='sentry-cli-Linux-i686',
+        plat='manylinux_2_17_i686.manylinux2014_i686.musllinux_1_2_i686',
+    ),
+    Wheel(
+        src='sentry-cli-Linux-x86_64',
+        plat='manylinux_2_17_x86_64.manylinux2014_x86_64.musllinux_1_2_x86_64',
+    ),
+    Wheel(
+        src='sentry-cli-Windows-i686.exe',
+        plat='win32',
+        exe='sentry-cli.exe',
+    ),
+    Wheel(
+        src='sentry-cli-Windows-x86_64.exe',
+        plat='win_amd64',
+        exe='sentry-cli.exe',
+    ),
+)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--binaries', required=True)
+    parser.add_argument('--base', required=True)
+    parser.add_argument('--dest', required=True)
+    args = parser.parse_args()
+
+    expected = {wheel.src for wheel in WHEELS}
+    received = set(os.listdir(args.binaries))
+    if expected < received:
+        raise SystemExit(
+            f'Unexpected binaries:\n\n'
+            f'- extra: {", ".join(sorted(received - expected))}\n'
+            f'- missing: {", ".join(sorted(expected - received))}'
+        )
+
+    sdist_path = wheel_path = None
+    for fname in os.listdir(args.base):
+        if fname.endswith('.tar.gz'):
+            sdist_path = os.path.join(args.base, fname)
+        elif fname.endswith('.whl'):
+            wheel_path = os.path.join(args.base, fname)
+        else:
+            raise SystemExit(f'unexpected file in `--base`: {fname}')
+
+    if sdist_path is None or wheel_path is None:
+        raise SystemExit('expected wheel and sdist in `--base`')
+
+    os.makedirs(args.dest, exist_ok=True)
+    shutil.copy(sdist_path, args.dest)
+
+    for wheel in WHEELS:
+        binary_src = os.path.join(args.binaries, wheel.src)
+        binary_size = os.stat(binary_src).st_size
+        with open(binary_src, 'rb') as bf:
+            digest = hashlib.sha256(bf.read()).digest()
+            digest_b64 = base64.urlsafe_b64encode(digest).rstrip(b'=').decode()
+
+        basename = os.path.basename(wheel_path)
+        wheelname, _ = os.path.splitext(basename)
+        name, version, py, abi, plat = wheelname.split('-')
+
+        with tempfile.TemporaryDirectory() as tmp:
+            with zipfile.ZipFile(wheel_path) as zipf:
+                zipf.extractall(tmp)
+
+            distinfo = os.path.join(tmp, f'{name}-{version}.dist-info')
+            scripts = os.path.join(tmp, f'{name}-{version}.data', 'scripts')
+
+            # replace the script binary with our copy
+            os.remove(os.path.join(scripts, 'sentry-cli'))
+            shutil.copy(binary_src, os.path.join(scripts, wheel.exe))
+
+            # rewrite RECORD to include the new file
+            record_fname = os.path.join(distinfo, 'RECORD')
+            with open(record_fname) as f:
+                record_lines = list(f)
+
+            record = f'{name}-{version}.data/scripts/sentry-cli,'
+            for i, line in enumerate(record_lines):
+                if line.startswith(record):
+                    record_lines[i] = (
+                        f'{name}-{version}.data/scripts/{wheel.exe},'
+                        f'sha256={digest_b64},'
+                        f'{binary_size}\n'
+                    )
+                    break
+            else:
+                raise SystemExit(f'could not find {record!r} in RECORD')
+
+            with open(record_fname, 'w') as f:
+                f.writelines(record_lines)
+
+            # rewrite WHEEL to have the new tags
+            wheel_fname = os.path.join(distinfo, 'WHEEL')
+            with open(wheel_fname) as f:
+                wheel_lines = list(f)
+
+            for i, line in enumerate(wheel_lines):
+                if line.startswith('Tag: '):
+                    wheel_lines[i:i + 1] = [
+                        f'Tag: {py}-{abi}-{plat}\n'
+                        for plat in wheel.plat.split('.')
+                    ]
+                    break
+            else:
+                raise SystemExit("could not find 'Tag: ' in WHEEL")
+
+            with open(wheel_fname, 'w') as f:
+                f.writelines(wheel_lines)
+
+            # write out the final zip
+            new_basename = f'{name}-{version}-{py}-{abi}-{wheel.plat}.whl'
+            tmp_new_wheel = os.path.join(tmp, new_basename)
+            fnames = sorted(
+                os.path.join(root, fname)
+                for root, _, fnames in os.walk(tmp)
+                for fname in fnames
+            )
+            with zipfile.ZipFile(tmp_new_wheel, 'w') as zipf:
+                for fname in fnames:
+                    zinfo = zipfile.ZipInfo(os.path.relpath(fname, tmp))
+                    if '/scripts/' in zinfo.filename:
+                        zinfo.external_attr = 0o100755 << 16
+                    with open(fname, 'rb') as fb:
+                        zipf.writestr(zinfo, fb.read())
+
+            # move into dest
+            shutil.move(tmp_new_wheel, args.dest)
+
+    return 0
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())