[mattaltgear]

This is a concept PR. It's meant to help with #1828 (error -80045 when refreshing or installing apps), not to be merged as-is.

Context

Since around October 12, Apple's GrandSlam servers have been rejecting sign-ins that use anisette data from anisette-v3-server instances with -80045 (Dadoum/anisette-v3-server#61). Those servers generate anisette data with Android's CoreADI, but the client info they return claims to be a Mac. Apple appears to reject that mismatch.

xtool fixed the same error by reporting Android client info instead (xtool-org/xtool#337, confirmed working in 1.22.2).

Changes

• When using a remote anisette server, AltStore now sends <Pixel 7> <Android;14;UQ1A.240205.002> <com.apple.AuthKit/1 (com.apple.akd/1.0)> as client info, both for provisioning and for GSA sign-in. User-Agent is unchanged, matching xtool.
• Records which client info the cached adi.pb was provisioned with, and re-provisions once if it doesn't match.
• Updates AltSign to handle 2FA codes Apple has already pushed (hsc 409 with no au): Concept: Handle pushed 2FA codes when Apple omits "au" rileytestut/AltSign#60.
• Local AltServer anisette is unchanged, since that's genuine Mac data.

Based on v2.3, targeting classic.

Testing

Built from v2.3 with these changes, installed on an iPhone Air, and signed in with a remote anisette server. Sign-in succeeded without -80045. The latest AltSign bump (merging notarized) has been built but not re-tested on device.

To build with Xcode 27, the prebuilt Dependencies/libcurl/libcurl.a had to be repacked locally (its archive members are misaligned for the new linker), and IPHONEOS_DEPLOYMENT_TARGET=17.4 set on the command line. Neither change is included here.

Not covered

Reinstalling AltStore via AltServer (also mentioned in #1828) uses AltServer's own anisette data and isn't addressed by this PR.

[kisnner26]

@mattaltgear FYI for the concept: the Pixel 7 client info now gets a 503 HTML page from gsa.apple.com (since Oct 14 ~20:50 UTC; nab138/iloader#920, #921), so reporting Android client info no longer works for remote anisette either.

What passes is Windows anisette from a v3 server that serves it (ani.jkcoxson.com, ani2.stikstore.app), sending the server's client_info (<PC> <Windows;6.2(0,0);9200> <com.apple.AuthKit/1 (com.apple.iTunes/12.12.4.1)>) and user_agent (akd/1.0 CFNetwork/808.1.4) for provisioning, GsService2 and 2FA, and a Mac client info only for the URL bag lookup. That's what iloader 2.3.8 shipped.

I applied it to AltServer in #1834 (+ rileytestut/AltSign#61) and tested it end-to-end on macOS 27.2: sign-in, 2FA and AltStore 2.3 installed on iPadOS 27.2. The same client info/user agent handling should work for the app's remote anisette mode here.

[mattaltgear]

Superseded by #1835.