Port GSA authentication fixes (AltSign PRs #50/#51) to Windows

[shanegillio]

This ports the GSA sign-in fixes from rileytestut/AltSign#50 and rileytestut/AltSign#51 to AltServer for Windows. The macOS versions were confirmed working against the recent GSA 503 / error-3840 sign-in failures; the Windows code has the same blind spots, so it presumably fails the same way.

Changes (all in AltSign/AppleAPI+Authentication.cpp)

• User agent: replaces the 2019-era akd/1.0 CFNetwork/978.0.7 Darwin/18.7.0 string with AuthKit/1 (Macintosh; OS X 26.5.2) (com.apple.dt.Xcode/26.0), matching AltSign PR Port GSA authentication fixes (AltSign PRs #50/#51) to Windows #51.
• Retry on 5xx: SendAuthenticationRequest now retries up to 5 times with 1/2/4/8s backoff. Each attempt constructs a fresh http_client — the cpprestsdk equivalent of the ephemeral URLSession in PR Hello, after upgrading to version 26.4 and installing it via a self-signed installer, the app crashes. What could be the reason? #50 — because Apple's GSA edge pins a keep-alive connection to a backend node, and once that node starts 5xx-ing, retries on the same connection never recover.
• Descriptive errors: when Apple returns a non-plist body (typically an HTML error page), the error now surfaces the HTTP status, Content-Type, and a body snippet via LocalizedAPIError instead of a bare APIErrorCode::InvalidResponse.
• Trusted-device 2FA: the verify-code response goes through the same validation.

Notes for review

• Untested on Windows — I don't have a Windows build environment, so this compiles-by-inspection only and needs a build + sign-in test on a real setup. Submitting for review so it can be compiled and tested on the correct platform.
• Based on the 1.7.4 branch (hence the base). Happy to rebase elsewhere if there's a better target.
• One consideration: e91915d switched X-Mme-Client-Info to a native Windows AuthKit client ID, while the new User-Agent identifies as Xcode on a Mac. If the patched build still hits 503s, that mismatch is the first thing worth investigating.

🤖 Generated with Claude Code

[kisnner26]

@shanegillio you closed this the same day you opened it, so I don't know whether you hit a problem with it or just withdrew it — but there's now field evidence that the Windows side really is affected, in case that changes the calculus.

Two Windows users confirmed fixed by the User-Agent change alone. I couldn't build for Windows, so instead I patched the string directly in the shipped AltServer.exe 1.7.4 — it's stored as UTF-16LE at offset 0x14D6A8, one occurrence, immediately adjacent to /grandslam/GsService2 in the binary, and the replacement is the same length so it drops in place. The binary carries no Authenticode signature, so nothing else breaks.

Results reported back in altstoreio/AltStore#1776:

• @akgang-rgb: "run your powershell script/patch for altserver.exe … Sign In ok"
• @BorbushArtem: "I entered your code in the windows powershell, and after that, I was finally able to update the Altstore on my phone"

So the blind spot you inferred from the macOS side is real and reproducible on Windows, and the source-level fix here is what those two users are currently working around with a hex patch.

This also covers Linux. NyaMisty/AltServer-Linux pulls this repo in as its upstream_repo submodule (branch = develop), so it compiles the same AltSign/AppleAPI+Authentication.cpp and the same 2018 User-Agent at line 967. A fix here is the fix for both platforms; there's nowhere else for Linux users to get it.

One thing worth folding in from upstream, since your PR predates it: @Calvin-Zikakis measured the mechanism in AltSign#51 — Apple's GSA edge allows a fixed number of requests per connection before it 503s, and the User-Agent changes that budget from 2 to 4. authenticate() sends three down one connection, which is exactly why the third one dies. Their numbers also show a residual ~20-25% failure on a fresh connection's first request that the UA doesn't fix, which is what the 5xx retry covers — so your combination of both changes matches what they found necessary. Note also the marketplace / notarized split they document: #47 targets marketplace, while #50/#51 are the ports that reach classic AltServer.

To be clear about my own evidence: I confirmed the string change fixes sign-in, on macOS (where I captured apptokens going 503 → 200) and via those two Windows reports. I have not built this PR or tested your retry/error-surfacing code paths.

Would you consider reopening?