From c4c266d166cb7e3d21af947614547aa38f496e4b Mon Sep 17 00:00:00 2001 From: Matt Reeves Date: Wed, 14 Oct 2026 14:26:52 -0500 Subject: [PATCH 1/2] Reports Android client info with remote anisette data Apple now rejects GSA requests (-80045) when anisette data generated by Android's CoreADI comes with Mac client info. Report Android client info with remote anisette servers, and re-provision once if the cached adi.pb was provisioned with different client info. Also updates AltSign to handle 2FA codes Apple has already pushed (hsc 409 without "au"). Based on xtool: https://github.com/xtool-org/xtool/pull/337 Fixes https://github.com/altstoreio/AltStore/issues/1828 Co-Authored-By: Claude Opus 5.5 --- .../Operations/FetchAnisetteDataOperation.swift | 16 +++++++++++----- AltStoreCore/Components/Keychain.swift | 4 ++++ Dependencies/AltSign | 2 +- 3 files changed, 16 insertions(+), 6 deletions(-) diff --git a/AltStore/Operations/FetchAnisetteDataOperation.swift b/AltStore/Operations/FetchAnisetteDataOperation.swift index ae6c09e34e..504a96ffcf 100644 --- a/AltStore/Operations/FetchAnisetteDataOperation.swift +++ b/AltStore/Operations/FetchAnisetteDataOperation.swift @@ -20,6 +20,11 @@ private extension URL static let appleGSALookup = URL(string: "https://gsa.apple.com/grandslam/GsService2/lookup")! } +// Anisette servers generate data with Android's CoreADI, and Apple now rejects it (-80045) +// unless the client info also claims to be Android. +// Based on xtool: https://github.com/xtool-org/xtool/pull/337 +private let androidClientInfo = " " + extension FetchAnisetteDataOperation { fileprivate struct AnisetteIdentity @@ -249,17 +254,18 @@ private extension FetchAnisetteDataOperation Keychain.shared.anisetteIdentityKey = identity.bytes } - // 3. Provision against this server if we don't have a cached adi.pb + // 3. Provision against this server if we don't have a cached adi.pb (provisioned with the current client info) let adiPB: Data - if let pb = Keychain.shared.anisetteADIPB + if let pb = Keychain.shared.anisetteADIPB, Keychain.shared.anisetteADIPBClientInfo == androidClientInfo { adiPB = pb } else { - Logger.sideload.notice("No cached adi.pb; running anisette provisioning against \(serverURL.absoluteString, privacy: .public).") - adiPB = try await self.provision(against: serverURL, clientInfo: response.clientInfo, userAgent: response.userAgent, identity: identity) + Logger.sideload.notice("No up-to-date cached adi.pb; running anisette provisioning against \(serverURL.absoluteString, privacy: .public).") + adiPB = try await self.provision(against: serverURL, clientInfo: androidClientInfo, userAgent: response.userAgent, identity: identity) Keychain.shared.anisetteADIPB = adiPB + Keychain.shared.anisetteADIPBClientInfo = androidClientInfo } // 4. Fetch anisette headers @@ -273,7 +279,7 @@ private extension FetchAnisetteDataOperation routingInfo: routingInfo, deviceUniqueIdentifier: identity.deviceID, deviceSerialNumber: "C02LKHBBFD57", - deviceDescription: response.clientInfo, + deviceDescription: androidClientInfo, date: .now, locale: .current, timeZone: .current diff --git a/AltStoreCore/Components/Keychain.swift b/AltStoreCore/Components/Keychain.swift index 851158c27d..867f554801 100644 --- a/AltStoreCore/Components/Keychain.swift +++ b/AltStoreCore/Components/Keychain.swift @@ -88,6 +88,10 @@ public class Keychain @KeychainItem(key: "anisetteADIPB", synchronizable: false) public var anisetteADIPB: Data? + // Client info anisetteADIPB was provisioned with. + @KeychainItem(key: "anisetteADIPBClientInfo", synchronizable: false) + public var anisetteADIPBClientInfo: String? + @KeychainItem(key: "devicePairingFile", synchronizable: false) public var devicePairingFile: Data? diff --git a/Dependencies/AltSign b/Dependencies/AltSign index 0d3c1a3cac..ab739398cf 160000 --- a/Dependencies/AltSign +++ b/Dependencies/AltSign @@ -1 +1 @@ -Subproject commit 0d3c1a3cac608e724ca0c8d7404253cd5fee9495 +Subproject commit ab739398cfb5efd7623a3565ad909256a3c28118 From 85a5b9645328982e52b0fbf698e83412efb6e2da Mon Sep 17 00:00:00 2001 From: Matt Reeves Date: Wed, 14 Oct 2026 14:51:27 -0500 Subject: [PATCH 2/2] Updates AltSign to merge latest notarized branch Co-Authored-By: Claude Opus 5.5 --- Dependencies/AltSign | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dependencies/AltSign b/Dependencies/AltSign index ab739398cf..1a6431f9e7 160000 --- a/Dependencies/AltSign +++ b/Dependencies/AltSign @@ -1 +1 @@ -Subproject commit ab739398cfb5efd7623a3565ad909256a3c28118 +Subproject commit 1a6431f9e736018b8ab4f3985d0d0fac135dfcdb