Update GrandSlam authentication user agent - #47
Conversation
|
Adding data in support of this, and correcting my earlier thoughts of what was going on. I said elsewhere that the User-Agent looked unrelated to the 503s people are hitting on GsService2. That was based on a 6 request sample and it was wrong. Re-ran it interleaved so time variation is controlled, 100 requests per UA: @MeemeeLab also reports this patch got them signing in again on altstoreio/AltStore#1776. What seems to be going on: a connection gets a fixed number of requests before Apple starts 503ing it, and the User-Agent changes that number. Six requests down one reused connection, five trials each, identical every time: Two requests on the old UA, four on the new one, then everything after that fails on that connection. Sign in sends three requests down one connection, which is exactly why it dies on the third one with the old UA and why this patch fixes it. There is a separate baseline failure rate on top of that, around 20 to 25 percent even on a fresh connection's first request, and the UA does not change that part (old 15/20, new 16/20). So this patch solves the deterministic part, and retrying 5xx on a fresh connection (#49 for marketplace, #50 for notarized) covers the rest. |
|
Opened #51 to port this onto the |
The akd/1.0 CFNetwork/978.0.7 Darwin/18.7.0 string dates from macOS 10.14. Apple's GSA edge now allows only two requests per connection with it, and sign in sends three, so the third always fails with an HTML 503 that surfaces as NSCocoaErrorDomain 3840. A current AuthKit string raises that to four. Port of rileytestut#47 by @BreezeDelegate onto the notarized branch, which AltStore's classic branches pin.
Adapt upstream AltSign PRs rileytestut#47 and rileytestut#49 while preserving structured errors and redacted diagnostics. Restrict retries to GSA 5xx, five attempts and a 60-second exchange budget; invalidate every session. Verified by 17 local hosted XCTest cases and Apple builds in AltForge. User confirmed macOS login proceeds to device preparation; complete installation and cross-platform account coverage remain pending.
Since early September 2026 GrandSlam intermittently answers the sign-in requests with an HTML 503 page instead of a plist, which AltSign fed straight to PropertyListSerialization and surfaced as the opaque "Encountered unknown tag html on line 1" (NSCocoaError 3840). Two changes fix it: - Send the modern AuthKit User-Agent. Apple now rejects the obsolete akd/1.0 CFNetwork/978.0.7 Darwin/18.7.0 string a large fraction of the time; the AuthKit string current akd sends is accepted (measured on an affected Mac: old string 503'd 12/100, AuthKit 0/100). - Use a fresh ephemeral URLSession per request and retry. GrandSlam's edge assigns a keep-alive connection to one backend node; once that node starts failing, every later request on the same connection 503s and does not recover. Sign-in sends init, complete and apptokens over one shared session, so the third request always failed. A new connection per attempt, plus a bounded 5xx retry (up to 5 attempts, 1/2/4/8s backoff, within the ~30s anisette window), resolves it. Root cause and approach from altstoreio/AltStore#1776 (Calvin-Zikakis) and the upstream fixes in rileytestut#47/rileytestut#50/rileytestut#51.
Since early September 2026 GrandSlam intermittently answers the sign-in requests with an HTML 503 page instead of a plist, which AltSign fed straight to PropertyListSerialization and surfaced as the opaque "Encountered unknown tag html on line 1" (NSCocoaError 3840). Two changes fix it: - Send the modern AuthKit User-Agent. Apple now rejects the obsolete akd/1.0 CFNetwork/978.0.7 Darwin/18.7.0 string a large fraction of the time; the AuthKit string current akd sends is accepted (measured on an affected Mac: old string 503'd 12/100, AuthKit 0/100). - Use a fresh ephemeral URLSession per request and retry. GrandSlam's edge assigns a keep-alive connection to one backend node; once that node starts failing, every later request on the same connection 503s and does not recover. Sign-in sends init, complete and apptokens over one shared session, so the third request always failed. A new connection per attempt, plus a bounded 5xx retry (up to 5 attempts, 1/2/4/8s backoff, within the ~30s anisette window), resolves it. Root cause and approach from altstoreio/AltStore#1776 (Calvin-Zikakis) and the upstream fixes in rileytestut#47/rileytestut#50/rileytestut#51.
|
Yeah that's totally fine, thanks for porting it and keeping the attribution. Appreciate the extra testing too, the results are really useful. |
|
Independent confirmation that this fixes the Rather than rebuilding, I applied just this change at runtime to stock AltServer 1.7.2 (build 90) — rewriting After swapping the UA, One extra data point: the requests to Caveat on attribution: I had AltSign#49 active at the same time, so I cannot fully isolate the two. But |
|
One more stale User-Agent in the same file, in case it is in scope for this PR. On Line 501 is the one used for the To be clear about what I can and cannot claim: I replaced both UAs with the modern string in my test, and every |
|
@rileytestut Flagging for review — this PR is
Root cause and affected users are tracked in altstoreio/AltStore#1699, #1776, #1747, #1716 — several dozen reports total. Would appreciate a look when you have time. |
GSA seems to, sometimes, reject HTTP requests made on a kept-alive connection with a 503. This was either the real root cause, or a second root cause, for #243. Fix this by creating a new HTTP connection for each GSA request. See also: rileytestut/AltSign#52 and rileytestut/AltSign#47 Speculatively fixes #232
3 participants
Use a current AuthKit user agent for GrandSlam authentication requests instead of the Mojave-era
akdvalue.Related to altstoreio/AltStore#1716.