From 97a0fe31bd9a72e7793a1400c89d4a807e5bfee5 Mon Sep 17 00:00:00 2001 From: Shane B Date: Sun, 13 Sep 2026 16:28:30 +0200 Subject: [PATCH 1/2] fix: report the client as akd, not Xcode, to stop Apple refusing sign-in Since early September 2026 every sign-in fails with `Error response for GSA request: 503`. Apple's edge refuses any POST to `gsa.apple.com/grandslam/GsService2` whose `X-MMe-Client-Info` names `com.apple.dt.Xcode`, before any credential is examined -- it answers a 190-byte HTML page from `Server: Apple` in about 0.2s instead of a GSA plist. `com.apple.akd` is the daemon that performs this request on macOS and is answered normally. Reproducible without an account: curl -so /dev/null -w '%{http_code}\n' -X POST --data-binary t \ -H 'X-MMe-Client-Info: ' \ https://gsa.apple.com/grandslam/GsService2 # 503 curl -so /dev/null -w '%{http_code}\n' -X POST --data-binary t \ -H 'X-MMe-Client-Info: ' \ https://gsa.apple.com/grandslam/GsService2 # 401, i.e. it reached the service And with this library's own request shape, real anisette data, one variable changed: akd returns HTTP 200 with a GSA plist, Xcode returns HTTP 503 with the edge page. Only the app token matters -- bumping the Xcode version does not help, and the user agent, the hardware and OS portion of the header, and which edge IP is used make no difference. That isolation is AltStore's, in altstoreio/AltStore#1790, shipped in AltServer 1.7.6. The same block took out SideStore, Macless Haystack, OpenBubbles and OpenTagViewer; Dadoum/anisette-v3-server#60 is the same one-token change. Closes #268. --- findmy/reports/anisette.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/findmy/reports/anisette.py b/findmy/reports/anisette.py index 1c5e3e5..5565722 100644 --- a/findmy/reports/anisette.py +++ b/findmy/reports/anisette.py @@ -117,12 +117,18 @@ def client(self) -> str: BUILD: The build number of the OS (e.g. 19C57) AUTHKIT_BUNDLE_ID: The bundle ID of the AuthKit framework (e.g. com.apple.AuthKit) AUTHKIT_VERSION: The version of the AuthKit framework (e.g. 1) - APP_BUNDLE_ID: The bundle ID of the app (e.g. com.apple.dt.Xcode) - APP_VERSION: The version of the app (e.g. 3594.4.19) + APP_BUNDLE_ID: The bundle ID of the app (e.g. com.apple.akd) + APP_VERSION: The version of the app (e.g. 1.0) + + The app must not be reported as `com.apple.dt.Xcode`. Since early September 2026 + Apple's edge refuses any Grand Slam request whose client info names Xcode, before + any credential is examined: a 190-byte HTML page from `Server: Apple` rather than + a GSA plist, which surfaces as HTTP 503. `com.apple.akd` is the daemon that + actually performs this request on macOS, and is answered normally. """ return ( " " - "" + "" ) async def get_headers( From ee453571ead01bcbdd44f0400636ae2b1ea45636 Mon Sep 17 00:00:00 2001 From: "pre-commit-ci-lite[bot]" <117423508+pre-commit-ci-lite[bot]@users.noreply.github.com> Date: Sun, 13 Sep 2026 14:30:12 +0000 Subject: [PATCH 2/2] [pre-commit.ci lite] apply automatic fixes --- findmy/reports/anisette.py | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/findmy/reports/anisette.py b/findmy/reports/anisette.py index 5565722..699ce82 100644 --- a/findmy/reports/anisette.py +++ b/findmy/reports/anisette.py @@ -126,10 +126,7 @@ def client(self) -> str: a GSA plist, which surfaces as HTTP 503. `com.apple.akd` is the daemon that actually performs this request on macOS, and is answered normally. """ - return ( - " " - "" - ) + return " " async def get_headers( self,