Fix Apple ID sign-in failing with an HTML 503 (NSCocoaError 3840)

[izaankml]

Problem

Since early September 2026, signing in with an Apple ID fails with:

NSCocoaErrorDomain 3840: "Encountered unknown tag html on line 1"
AltServer could not sign in with your Apple ID. The data is not in the correct format.

GrandSlam intermittently answers the sign-in requests with an HTML 503 page instead of a plist, and AltSign feeds that straight to PropertyListSerialization, which reports the opaque 3840 parse error rather than the underlying server failure.

Cause

Two things drive it:

1. Obsolete User-Agent. AltSign sent akd/1.0 CFNetwork/978.0.7 Darwin/18.7.0. Apple now rejects that string with an HTML 503 a large fraction of the time. Measured on an affected Mac, 100 requests each: the old string 503'd 12 times, the modern AuthKit string 0 times.
2. Connection reuse. GrandSlam's edge assigns a keep-alive connection to one backend node. Once that node starts failing, every later request on the same connection returns 5xx and does not recover. Sign-in sends init, complete and apptokens over one shared URLSession, so the first two succeed, the connection then starts failing, and apptokens (always third) gets the HTML 503.

Fix

• Send the modern AuthKit-style User-Agent, with the macOS version taken from the running system so it agrees with the OS named in X-MMe-Client-Info.
• Give each GrandSlam request (and each retry) its own ephemeral URLSession, so every attempt opens a new connection. Retry 5xx up to 5 times with 1/2/4/8s backoff, which stays within the ~30s anisette one-time-password window and keeps the request rate low enough not to trigger Apple's anti-abuse lock.

Testing

Built AltServer and a patched AltStore for iOS from this fork against a live Apple ID on macOS 15.7.9 with an iOS device. Before: apptokens returned HTTP 503 (HTML) on every attempt. After: init, complete and apptokens all return HTTP 200 on the first attempt, and both AltStore install and on-device refresh sign in successfully.

Credit

Root-cause analysis is from altstoreio/AltStore#1776 (Calvin-Zikakis), and the same approach is in the upstream pull requests rileytestut/AltSign#47, #50 and #51. This ports it to this fork's macos-26-27 line.

[izaankml]

Closing this. The same fix is upstream in rileytestut#50 (fresh connection per attempt plus 5xx retry, by Calvin-Zikakis) and rileytestut#51 (AuthKit User-Agent, by BreezeDelegate), both against notarized, and I would rather not carry their work under my name.

macos-26-27 is notarized plus your Xcode 27 link fix, and rileytestut#50 and rileytestut#51 cherry-pick onto it cleanly, so pulling notarized once they land is all this fork needs. If you want them here sooner, I am happy to open a PR that cherry-picks their commits with the original authorship, after checking with them.