[mattaltgear]

Fixes #1828.

Apple now rejects anisette data generated with Android's CoreADI (-80045, then HTTP 503). It accepts Windows anisette data (iTunes ADI) sent with that client's own client info and user agent.

• Tries Windows anisette servers first and rejects servers whose client info isn't Windows.
• Sends the anisette server's user agent with GrandSlam requests.
• Provisions a new anisette identity when re-provisioning or when the server's client info changes.
• Resynchronizes anisette data when Apple asks to (hsc 434).

Depends on rileytestut/AltSign#61 (includes #59). The submodule points to that branch until it's merged.

Tested on an iPhone Air with a free Apple ID: provisioning, resync, sign-in, and installing apps.

[whydr4]

Small thing, the "#59" in the description links to a 2019 issue in this repo ("You are not a member of any development teams" 😄). It's meant to be rileytestut/AltSign#59. Since this PR runs on @kisnner26's rileytestut/AltSign#61, which also carries the 2FA fix from #59, a quick mention of @kisnner26 and @whydr4 in the description would be nice, like #1834 does 🙂

[a7medpa]

Is anyone planning to review and merge this?

[kisnner26]

Confirming this builds on rileytestut/AltSign#61 as pinned (832d9ce). The two PRs are complementary: #1834 covers AltServer on macOS with the same AltSign changes, this one covers AltStore on device.

One thing for anyone building with Xcode 27 (iOS 27 SDK): everything compiles, including this PR's FetchAnisetteDataOperation changes and AltSign at 832d9ce, but the AltStore target fails to link because the prebuilt Dependencies/libcurl/libcurl.a is rejected by the new linker ("64-bit mach-o not 8-byte aligned"). It's unrelated to this PR, but it blocks testing it on Xcode 27 until libcurl is rebuilt. I haven't been able to test the sign-in on device because of that.

[a7medpa]

Confirming this builds on rileytestut/AltSign#61 as pinned (832d9ce). The two PRs are complementary: #1834 covers AltServer on macOS with the same AltSign changes, this one covers AltStore on device.

One thing for anyone building with Xcode 27 (iOS 27 SDK): everything compiles, including this PR's FetchAnisetteDataOperation changes and AltSign at 832d9ce, but the AltStore target fails to link because the prebuilt Dependencies/libcurl/libcurl.a is rejected by the new linker ("64-bit mach-o not 8-byte aligned"). It's unrelated to this PR, but it blocks testing it on Xcode 27 until libcurl is rebuilt. I haven't been able to test the sign-in on device because of that.

So no fix for altstore server on windows?

[izaankml]

Tested this with rileytestut/AltSign#61 (832d9ce), built with Xcode 26.3 on top of classic plus a few unrelated fixes. On-device refresh works again on an iPhone with iOS 26.6.2.

[BlueskyFR]

Without a Mac or Xcode, is there an "easy" way to test this PR before the rollout?

[IvorySvoboda]

Without a Mac or Xcode, is there an "easy" way to test this PR before the rollout?

i asked AI to create a codemagic action to build it to me:

workflows:
  altstore-pr1835:
    name: AltStore PR 1835 - unsigned IPA
    instance_type: mac_mini_m2
    max_build_duration: 120
    environment:
      xcode: latest
      vars:
        ALTSTORE_REVISION: "22f766d2edb47626a082a1f775649bcf3fc43aff"
    scripts:
      - name: Fetch the reviewed PR revision and its dependencies
        script: |
          set -euo pipefail
          cd "$CM_BUILD_DIR"
          git init source
          git -C source remote add origin https://github.com/altstoreio/AltStore.git
          git -C source fetch --depth 1 origin "$ALTSTORE_REVISION"
          git -C source checkout --detach FETCH_HEAD
          git -C source submodule sync --recursive
          git -C source submodule update --init --recursive
          mkdir -p output
          {
            xcodebuild -version
            git -C source rev-parse HEAD
            git -C source submodule status --recursive
          } > output/build-info.txt
          # This revision includes Pods in Git, as used by the upstream workspace.
          # Preserve those files instead of regenerating the Pods project.
          test -f source/Pods/Pods.xcodeproj/project.pbxproj
          test -f source/Dependencies/AltSign/Package.swift
          test "$(git -C source/Dependencies/AltSign rev-parse HEAD)" = \
            "832d9cec339ea6ef6891011833dbb7227b028a29"
      - name: Guard app-group migration when shared storage is unavailable
        script: |
          set -euo pipefail
          cd "$CM_BUILD_DIR/source"
          python3 - <<'PYCODE'
          from pathlib import Path
          p = Path("AltStoreCore/Model/DatabaseManager.swift")
          text = p.read_text()
          old = "guard UserDefaults.shared.requiresAppGroupMigration && Bundle.main.altstoreAppGroup != nil else { return completion(.success(())) }"
          new = """guard UserDefaults.shared.requiresAppGroupMigration,
                  Bundle.main.altstoreAppGroup != nil,
                  FileManager.default.altstoreSharedDirectory != nil
              else { return completion(.success(())) }"""
          assert text.count(old) == 1, "Migration guard changed upstream"
          text = text.replace(old, new)
          anchor = "        let appsDirectoryURL = InstalledApp.appsDirectoryURL\n"
          guard = """
                  // Defer migration if either destination resolves to its source.
                  // Keep the migration flag so a future valid app group can migrate.
                  guard previousDatabaseURL.resolvingSymlinksInPath().standardizedFileURL != databaseURL.resolvingSymlinksInPath().standardizedFileURL,
                        previousAppsDirectoryURL.resolvingSymlinksInPath().standardizedFileURL != appsDirectoryURL.resolvingSymlinksInPath().standardizedFileURL
                  else { return completion(.success(())) }
          """
          assert text.count(anchor) == 1, "Migration paths changed upstream"
          p.write_text(text.replace(anchor, anchor + guard))
          PYCODE
      - name: Build AltStore for a physical iPhone without signing
        script: |
          set -euo pipefail
          cd "$CM_BUILD_DIR/source"
          xcodebuild build \
            -workspace AltStore.xcworkspace \
            -scheme AltStore \
            -configuration Release \
            -sdk iphoneos \
            -destination 'generic/platform=iOS' \
            -derivedDataPath "$CM_BUILD_DIR/DerivedData" \
            CODE_SIGNING_ALLOWED=NO \
            CODE_SIGNING_REQUIRED=NO \
            CODE_SIGN_IDENTITY="" \
            DEVELOPMENT_TEAM="" \
            'OTHER_CFLAGS=$(inherited) -Wno-error=implicit-int-conversion-on-negation' \
            2>&1 | tee "$CM_BUILD_DIR/output/xcodebuild.log"
      - name: Package the unsigned IPA
        script: |
          set -euo pipefail
          cd "$CM_BUILD_DIR"
          app="DerivedData/Build/Products/Release-iphoneos/AltStore.app"
          test -d "$app"
          mkdir -p output/Payload
          ditto "$app" output/Payload/AltStore.app
          /usr/libexec/PlistBuddy -c 'Print :MinimumOSVersion' \
            output/Payload/AltStore.app/Info.plist > output/minimum-ios.txt
          cd output
          zip -qry AltStore-PR1835-unsigned.ipa Payload
          shasum -a 256 AltStore-PR1835-unsigned.ipa > SHA256SUMS.txt
    artifacts:
      - output/*.ipa
      - output/*.txt
      - output/*.log

if u prefer u can ask AI to convert it to a github action

[BlueskyFR]

Your answer uses both xcode and a Mac 😭😭

[gideontigelaar]

Tested with Remote AltServer + LocalDevVPN (free Apple ID, built with Xcode 27.1 on macOS 27.0.1).
It fixes -80045 for me, and refreshing works (iOS 27.0.1). Apple sometimes returns HTTP 503 when sign-ins are close after each other, but a later retry works.

[liuzhe1117]

Thanks for this PR and the related AltSign work. I integrated #1835 and rileytestut/AltSign#61 into my fork, and can confirm that on-device remote refresh works in my testing (Remote AltServer + LocalDevVPN, iPhone 15 on iOS 26.6.1; initial installation from macOS 15.7.2).

One observation: with the Windows Anisette servers, I still encountered intermittent HTTP 503 responses from Apple's GrandSlam authentication endpoint. After adding the Mac Anisette services now used by iLoader and switching to a Mac provider, remote refresh succeeded and I have not encountered another 503 so far:

• https://new.ani.sidestore.io
• https://mac-ani.jkcoxson.com — the provider used for my successful refresh test.

This is a result from my current environment, not proof that 503 is permanently resolved or that the provider change is the only factor.

For anyone who would like to test, I published an unofficial build with AltServer-mac.zip and AltStore-mac-anisette.ipa, plus full installation instructions in English and Chinese:

https://github.com/liuzhe1117/AltStore/releases/tag/v1.8-mac-anisette-unofficial-20261021

The release documents the upstream PRs and the additional changes in my fork, including Mac-provider support and a server-selection UI that displays the advertised device/platform identity. It is not an unmodified build of this PR or an official AltStore release. If installing over an existing AltStore installation, I recommend resetting Remote AltServer and pairing again; that addressed a separate pairing mismatch in my testing.

[PwnedG0blin]

• Versucht zuerst, Windows-Anisette-Server zu erreichen und lehnt Server ab, deren Clientinformationen nicht Windows entsprechen.
• Sendet den User-Agent des Anisette-Servers mit GrandSlam-Anfragen.
• Stellt eine neue Anisette-Identität bereit, wenn eine erneute Bereitstellung erfolgt oder sich die Clientinformationen des Servers ändern.
• Synchronisiert Anisette-Daten neu, wenn Apple dazu auffordert (hsc 434).

Abhängig von rileytestut/AltSign#61 (einschließlich #59 ). Das Submodul verweist auf diesen Branch, bis er zusammengeführt wird.

Getestet auf einem iPhone Air mit kostenloser Apple-ID: Bereitstellung, Resynchronisierung, Anmeldung und Installation von Apps.

That sounds really exciting!