feat(tombstones): Add option to attach raw tombstone as protobuf

[romtsn]

📜 Description

Adds a new attachRawTombstone option (default false) that attaches the raw tombstone protobuf from ApplicationExitInfo.getTraceInputStream() as an attachment on native crash events.

Changes:

• Hint.java: Added tombstone field with getter/setter
• Attachment.java: Added fromTombstone(byte[]) factory method (tombstone.pb, application/x-protobuf)
• SentryClient.java: Retrieves tombstone from hint and adds to envelope attachments
• SentryAndroidOptions.java: Added attachRawTombstone boolean option with getter/setter
• TombstoneIntegration.java: Buffers raw bytes from the trace InputStream before parsing, attaches when option is enabled
• ManifestMetadataReader.java: Added io.sentry.tombstone.attach-raw manifest meta-data option

Usage

Kotlin (programmatic):

SentryAndroid.init(context) { options ->
    options.isAttachRawTombstone = true
}

AndroidManifest.xml:

<meta-data
    android:name="io.sentry.tombstone.attach-raw"
    android:value="true" />

💡 Motivation and Context

Allows users to get the raw tombstone protobuf alongside the parsed native crash event, useful for deeper post-mortem analysis.

💚 How did you test it?

Manually tested on a physical device (HMD Pulse, Android 15) by triggering a native crash in the sample app and verifying the tombstone attachment is present.

https://sentry-sdks.sentry.io/issues/7229399848/events/1e81d1e1ed9a400b78e1be7811776a18/

Downloaded the raw tombstone file and verified it can be correctly parsed and viewed via protoc:

tombstone.txt

📝 Checklist

• I added GH Issue ID & Linear ID
• I added tests to verify the changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• Review from the native team if needed.
• No breaking change or entry added to the changelog.
• No breaking change for hybrid SDKs or communicated to hybrid SDKs.

🔮 Next steps

• Update docs

[github-actions]

	Messages
📖	Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against 8a1c5ba

[sentry]

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.41.0 (1)	release

⚙️ sentry-android Build Distribution Settings

[github-actions]

Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	321.92 ms	364.57 ms	42.65 ms
Size	0 B	0 B	0 B

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
48277cd	320.38 ms	379.90 ms	59.52 ms
382d6c1	306.85 ms	368.70 ms	61.85 ms
fc5ccaf	279.11 ms	353.34 ms	74.23 ms
9770665	315.64 ms	378.00 ms	62.36 ms
d15471f	315.20 ms	370.22 ms	55.02 ms
62b579c	349.26 ms	426.26 ms	77.00 ms
ee35ac3	346.83 ms	435.48 ms	88.65 ms
cd0981b	313.29 ms	356.63 ms	43.34 ms
22f4345	314.79 ms	375.02 ms	60.23 ms
fcec2f2	311.35 ms	384.94 ms	73.59 ms

App size

Revision	Plain	With Sentry	Diff
48277cd	0 B	0 B	0 B
382d6c1	1.58 MiB	2.29 MiB	719.85 KiB
fc5ccaf	1.58 MiB	2.13 MiB	557.54 KiB
9770665	0 B	0 B	0 B
d15471f	1.58 MiB	2.13 MiB	559.54 KiB
62b579c	0 B	0 B	0 B
ee35ac3	1.58 MiB	2.13 MiB	558.77 KiB
cd0981b	0 B	0 B	0 B
22f4345	1.58 MiB	2.29 MiB	719.83 KiB
fcec2f2	1.58 MiB	2.12 MiB	551.51 KiB

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9a4963e. Configure here.}

[supervacuus]

This looks good, only minor comments.

Just one general assessment: the tombstone also includes raw memory views into regions pointed to by register contents. These are potentially PII-relevant and should move the tombstone attachment into a PII category similar to minidumps. This might also raise storage retention as a follow-up.

[supervacuus]

nit: this says "attachment with plain text", but it is actually protobuf-encoded (and correctly identified as s such via the content-type, likely a copypasta from the ANR thread dump option.

[supervacuus]

l: Not a blocker, but we now unconditionally read the tombstone fully, even if the option is not turned on.