Fix Apple ID sign in failing with a 3840 plist parse error (notarized line) - #50
Calvin-Zikakis wants to merge 2 commits into
Conversation
…as a plist Port of the marketplace-branch fix onto the notarized line, which AltStore's classic branches pin. Apple's GSA edge keeps a keep-alive connection pinned to a backend node. When that node starts failing, every subsequent request on the same connection returns 5xx and never recovers. ALTAppleAPI uses a single shared session, so authenticate() sends init, complete and apptokens down one connection: the first two succeed, the connection sours, and apptokens gets an HTML 503 that surfaces as NSCocoaErrorDomain 3840 "Encountered unknown tag html on line 1". Retry 5xx up to five times with exponential backoff, each attempt on its own session so it opens a new connection, and route the response through a helper that reports NSURLErrorBadServerResponse with the status, Content-Type and a body snippet instead of an opaque parse failure.
That handler had the identical blind parse, so an HTML error page there still surfaced as an opaque 3840. Brings the notarized-line port to parity with the marketplace one.
d4ffa49 to
67f90ce
Compare
Since early September 2026 GrandSlam intermittently answers the sign-in requests with an HTML 503 page instead of a plist, which AltSign fed straight to PropertyListSerialization and surfaced as the opaque "Encountered unknown tag html on line 1" (NSCocoaError 3840). Two changes fix it: - Send the modern AuthKit User-Agent. Apple now rejects the obsolete akd/1.0 CFNetwork/978.0.7 Darwin/18.7.0 string a large fraction of the time; the AuthKit string current akd sends is accepted (measured on an affected Mac: old string 503'd 12/100, AuthKit 0/100). - Use a fresh ephemeral URLSession per request and retry. GrandSlam's edge assigns a keep-alive connection to one backend node; once that node starts failing, every later request on the same connection 503s and does not recover. Sign-in sends init, complete and apptokens over one shared session, so the third request always failed. A new connection per attempt, plus a bounded 5xx retry (up to 5 attempts, 1/2/4/8s backoff, within the ~30s anisette window), resolves it. Root cause and approach from altstoreio/AltStore#1776 (Calvin-Zikakis) and the upstream fixes in rileytestut#47/rileytestut#50/rileytestut#51.
Since early September 2026 GrandSlam intermittently answers the sign-in requests with an HTML 503 page instead of a plist, which AltSign fed straight to PropertyListSerialization and surfaced as the opaque "Encountered unknown tag html on line 1" (NSCocoaError 3840). Two changes fix it: - Send the modern AuthKit User-Agent. Apple now rejects the obsolete akd/1.0 CFNetwork/978.0.7 Darwin/18.7.0 string a large fraction of the time; the AuthKit string current akd sends is accepted (measured on an affected Mac: old string 503'd 12/100, AuthKit 0/100). - Use a fresh ephemeral URLSession per request and retry. GrandSlam's edge assigns a keep-alive connection to one backend node; once that node starts failing, every later request on the same connection 503s and does not recover. Sign-in sends init, complete and apptokens over one shared session, so the third request always failed. A new connection per attempt, plus a bounded 5xx retry (up to 5 attempts, 1/2/4/8s backoff, within the ~30s anisette window), resolves it. Root cause and approach from altstoreio/AltStore#1776 (Calvin-Zikakis) and the upstream fixes in rileytestut#47/rileytestut#50/rileytestut#51.
|
Closing this, #52 covers it and landed first. Two bits from here weren't in that fix, so I split them out rather than leave this sitting: #54 gives the 2FA code verification its own connection too, it still uses the pooled session #49 is the same fix as #52 for |
|
Browser sign-in at appleid.apple.com works fine with the same credentials, so Likely root causeThe AltStore/AltSign project has diagnosed what looks like the same issue: Their finding: Apple's GSA edge keeps a keep-alive connection pinned to a They also found that an outdated User-Agent Suggested fixTheir fix was to retry 5xx responses with exponential backoff, opening a new Relevant code here looks to be Environment
|
2 participants
Same fix as #49, ported to
notarized.marketplaceandnotarizedhave diverged and neither contains the other, so #49 does not reach anyone on the classic branches. AltStore'sclassic(AltServer 1.8b1, AltStore 2.3b2) andclassic_v2.3b1both pindb8e0ebhere, so this is the side that reaches AltServer and non EU AltStore users.Reported in altstoreio/AltStore#1776, #1699, #1747.
What happens
Sign in makes three calls to GsService2. Apple returns an HTML error page for some of them, and
sendAuthenticationRequest()hands the body straight toPropertyListSerializationwith no check, so a server error surfaces asNSCocoaErrorDomain 3840 "Encountered unknown tag html on line 1"and reads like bad credentials.Apple's edge also pins a connection to a backend node, and once that node starts failing every later request on the same connection fails too.
ALTAppleAPIuses one session for everything, so all three calls share a connection and whichever request lands after it sours is the one that dies.Changes
Retry 5xx up to five times with backoff, each attempt on its own session so it opens a new connection. Retrying on the shared session does nothing, every attempt inherits the same dead node.
Report a failed parse as
NSURLErrorBadServerResponsewith the status, Content-Type and a body snippet instead of the raw 3840.ALTAppleAPI.malready does this for the other endpoints. The same helper covers the trusted device 2FA handler, which had the identical blind parse.It parses first and only builds the better error on failure, rather than gating on the status code. A status check misses HTML served with a 200, and GSA reports its own status in the body as
Status.hsc, so returning early could hide real error codes.Numbers
25 full sign in attempts per row, on an affected Mac:
The User-Agent matters more than anything else here. #47 fixes that on
marketplace, but there is no equivalent for this branch yet, sonotarizedis still on the old UA even with this merged. Worth doing both.Testing
Verified on a Mac and iPhone that had both been failing:
classic_v2.3b1with this patch signed in first try and installed AltStore.Builds clean for iOS.