Fix Apple ID sign in failing with a 3840 plist parse error (notarized line) - #50
Open
Calvin-Zikakis wants to merge 2 commits into
Open
Fix Apple ID sign in failing with a 3840 plist parse error (notarized line)#50Calvin-Zikakis wants to merge 2 commits into
Calvin-Zikakis wants to merge 2 commits into
Conversation
…as a plist Port of the marketplace-branch fix onto the notarized line, which AltStore's classic branches pin. Apple's GSA edge keeps a keep-alive connection pinned to a backend node. When that node starts failing, every subsequent request on the same connection returns 5xx and never recovers. ALTAppleAPI uses a single shared session, so authenticate() sends init, complete and apptokens down one connection: the first two succeed, the connection sours, and apptokens gets an HTML 503 that surfaces as NSCocoaErrorDomain 3840 "Encountered unknown tag html on line 1". Retry 5xx up to five times with exponential backoff, each attempt on its own session so it opens a new connection, and route the response through a helper that reports NSURLErrorBadServerResponse with the status, Content-Type and a body snippet instead of an opaque parse failure.
That handler had the identical blind parse, so an HTML error page there still surfaced as an opaque 3840. Brings the notarized-line port to parity with the marketplace one.
This was referenced Sep 4, 2026
Calvin-Zikakis
force-pushed
the
fix/gsa-retry-classic
branch
from
September 4, 2026 06:17
d4ffa49 to
67f90ce
Compare
izaankml
added a commit
to izaankml/AltSign
that referenced
this pull request
Sep 5, 2026
Since early September 2026 GrandSlam intermittently answers the sign-in requests with an HTML 503 page instead of a plist, which AltSign fed straight to PropertyListSerialization and surfaced as the opaque "Encountered unknown tag html on line 1" (NSCocoaError 3840). Two changes fix it: - Send the modern AuthKit User-Agent. Apple now rejects the obsolete akd/1.0 CFNetwork/978.0.7 Darwin/18.7.0 string a large fraction of the time; the AuthKit string current akd sends is accepted (measured on an affected Mac: old string 503'd 12/100, AuthKit 0/100). - Use a fresh ephemeral URLSession per request and retry. GrandSlam's edge assigns a keep-alive connection to one backend node; once that node starts failing, every later request on the same connection 503s and does not recover. Sign-in sends init, complete and apptokens over one shared session, so the third request always failed. A new connection per attempt, plus a bounded 5xx retry (up to 5 attempts, 1/2/4/8s backoff, within the ~30s anisette window), resolves it. Root cause and approach from altstoreio/AltStore#1776 (Calvin-Zikakis) and the upstream fixes in rileytestut#47/rileytestut#50/rileytestut#51.
izaankml
added a commit
to izaankml/AltSign
that referenced
this pull request
Sep 5, 2026
Since early September 2026 GrandSlam intermittently answers the sign-in requests with an HTML 503 page instead of a plist, which AltSign fed straight to PropertyListSerialization and surfaced as the opaque "Encountered unknown tag html on line 1" (NSCocoaError 3840). Two changes fix it: - Send the modern AuthKit User-Agent. Apple now rejects the obsolete akd/1.0 CFNetwork/978.0.7 Darwin/18.7.0 string a large fraction of the time; the AuthKit string current akd sends is accepted (measured on an affected Mac: old string 503'd 12/100, AuthKit 0/100). - Use a fresh ephemeral URLSession per request and retry. GrandSlam's edge assigns a keep-alive connection to one backend node; once that node starts failing, every later request on the same connection 503s and does not recover. Sign-in sends init, complete and apptokens over one shared session, so the third request always failed. A new connection per attempt, plus a bounded 5xx retry (up to 5 attempts, 1/2/4/8s backoff, within the ~30s anisette window), resolves it. Root cause and approach from altstoreio/AltStore#1776 (Calvin-Zikakis) and the upstream fixes in rileytestut#47/rileytestut#50/rileytestut#51.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Same fix as #49, ported to
notarized.marketplaceandnotarizedhave diverged and neither contains the other, so #49 does not reach anyone on the classic branches. AltStore'sclassic(AltServer 1.8b1, AltStore 2.3b2) andclassic_v2.3b1both pindb8e0ebhere, so this is the side that reaches AltServer and non EU AltStore users.Reported in altstoreio/AltStore#1776, #1699, #1747.
What happens
Sign in makes three calls to GsService2. Apple returns an HTML error page for some of them, and
sendAuthenticationRequest()hands the body straight toPropertyListSerializationwith no check, so a server error surfaces asNSCocoaErrorDomain 3840 "Encountered unknown tag html on line 1"and reads like bad credentials.Apple's edge also pins a connection to a backend node, and once that node starts failing every later request on the same connection fails too.
ALTAppleAPIuses one session for everything, so all three calls share a connection and whichever request lands after it sours is the one that dies.Changes
Retry 5xx up to five times with backoff, each attempt on its own session so it opens a new connection. Retrying on the shared session does nothing, every attempt inherits the same dead node.
Report a failed parse as
NSURLErrorBadServerResponsewith the status, Content-Type and a body snippet instead of the raw 3840.ALTAppleAPI.malready does this for the other endpoints. The same helper covers the trusted device 2FA handler, which had the identical blind parse.It parses first and only builds the better error on failure, rather than gating on the status code. A status check misses HTML served with a 200, and GSA reports its own status in the body as
Status.hsc, so returning early could hide real error codes.Numbers
25 full sign in attempts per row, on an affected Mac:
The User-Agent matters more than anything else here. #47 fixes that on
marketplace, but there is no equivalent for this branch yet, sonotarizedis still on the old UA even with this merged. Worth doing both.Testing
Verified on a Mac and iPhone that had both been failing:
classic_v2.3b1with this patch signed in first try and installed AltStore.Builds clean for iOS.