Skip to content

Use a separate connection for each GrandSlam request (marketplace) - #49

Open
Calvin-Zikakis wants to merge 1 commit into
rileytestut:marketplacefrom
Calvin-Zikakis:fix/gsa-html-response-marketplace
Open

Use a separate connection for each GrandSlam request (marketplace)#49
Calvin-Zikakis wants to merge 1 commit into
rileytestut:marketplacefrom
Calvin-Zikakis:fix/gsa-html-response-marketplace

Conversation

@Calvin-Zikakis

@Calvin-Zikakis Calvin-Zikakis commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Same fix as #52, for marketplace. That branch still has the bug.

Apple's edge serves at most two requests per connection and 503s everything after that. Signing in takes three requests over one pooled session, so apptokens always fails:

o=init       200
o=complete   200  ec=0
o=apptokens  503  <html>503 Service Temporarily Unavailable ... Apple</html>

The HTML 503 then goes to the plist parser, which is where NSCocoaErrorDomain 3840 comes from.

Approach and wording lifted from @sshane's #52 so the two branches stay consistent.

Reported in altstoreio/AltStore#1776, #1699, #1747.

This was referenced Sep 4, 2026
Open
Open
@Calvin-Zikakis Calvin-Zikakis changed the title Report server errors instead of a plist parse failure during GSA auth Fix Apple ID sign in failing with a 3840 plist parse error Sep 4, 2026
This was referenced Sep 4, 2026
Closed
Open
@Calvin-Zikakis
Calvin-Zikakis force-pushed the fix/gsa-html-response-marketplace branch from 9199500 to a91fb9e Compare September 4, 2026 06:17
legeling added a commit to legeling/AltSign that referenced this pull request Sep 5, 2026
@legeling
fix(auth): adopt AuthKit identity and bounded isolated GSA retries
9b06df7 
Adapt upstream AltSign PRs rileytestut#47 and rileytestut#49 while preserving structured errors and redacted diagnostics. Restrict retries to GSA 5xx, five attempts and a 60-second exchange budget; invalidate every session.

Verified by 17 local hosted XCTest cases and Apple builds in AltForge. User confirmed macOS login proceeds to device preparation; complete installation and cross-platform account coverage remain pending.
@ElectricS01

ElectricS01 commented Sep 5, 2026

Copy link
Copy Markdown

Tried this patch but I'm getting

Error Description
AltServer could not sign in with your Apple ID. MID is invalid. (-80009)

Failure
AltServer could not sign in with your Apple ID.

Title
AltStore could not be installed onto Thomas’s iPhone.

Any ideas?

@Calvin-Zikakis

Calvin-Zikakis commented Sep 6, 2026

Copy link
Copy Markdown
Author

MID is invalid

I'm not totally sure. Could be a couple things including your system time being off. Without knowing anymore info about your system and how you tried the patch I am going to be unable to help.

Would honestly recommend trying Claude code or Codex with your error and the patch.

This was referenced Sep 6, 2026
Open
Open
@kisnner26 kisnner26 mentioned this pull request Sep 7, 2026
Open
@kisnner26

kisnner26 commented Sep 7, 2026

Copy link
Copy Markdown

Supporting evidence for the diagnosis here, from altstoreio/AltStore#1699.

Before finding this PR, I had instrumented stock AltServer 1.7.2 and added automatic retries on the 503, expecting a transient backend blip. All 6 attempts over ~7 seconds returned 503, and I wrongly concluded Apple was refusing the operation outright.

The reason is exactly what this PR describes: my retries reused the same NSURLSession, so every attempt went back over the same pooled connection to the same failing node. A retry that does not open a new connection can never recover from this — which is a good argument for the .ephemeral session per attempt rather than a plain retry/backoff loop.

I have since run with a fresh ephemeral session per request (plus AltSign#47) on macOS 27.0 beta (26A5416b), and sign-in completes: init 200, complete 200, apptokens 200. In that run apptokens succeeded on the first attempt, so the retry path itself was not exercised — I can confirm the diagnosis, but not independently measure how often the retry saves a request.

@kisnner26

kisnner26 commented Sep 8, 2026

Copy link
Copy Markdown

@rileytestut Same flag as on #47 — this one's also MERGEABLE/clean with no reviews. Together with #47 it fixes the NSCocoaErrorDomain 3840 sign-in failure that's been reported across altstoreio/AltStore#1699, #1776, #1747, #1716 (several dozen reports, still coming in daily).

I ran the fresh-ephemeral-session change in isolation against stock AltServer 1.7.2 and it matches the diagnosis in this PR's description exactly — the retry-on-same-connection failure mode is real and reproducible. Multiple people (myself, @Scope666, @spaceace90) have now confirmed #47+#49 together resolve sign-in end to end. Would appreciate a review when you get a chance.

@kisnner26 kisnner26 mentioned this pull request Sep 8, 2026
Open
This was referenced Sep 8, 2026
Open
Open
@Calvin-Zikakis
Use a separate connection for each GrandSlam request
f499856 
Apple's edge serves at most two requests per connection and 503s
everything after that. Signing in takes three requests over one pooled
session, so apptokens always fails and the HTML 503 gets parsed as a
plist, which is where the 3840 comes from.

Same fix as rileytestut#52, which landed on notarized. This branch still has the bug.
@Calvin-Zikakis
Calvin-Zikakis force-pushed the fix/gsa-html-response-marketplace branch from a91fb9e to f499856 Compare September 8, 2026 23:36
@Calvin-Zikakis Calvin-Zikakis changed the title Fix Apple ID sign in failing with a 3840 plist parse error Use a separate connection for each GrandSlam request (marketplace) Sep 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@Calvin-Zikakis @ElectricS01 @kisnner26