Fix/gsa 503 acq - #15
Open
xiaopebaka wants to merge 10 commits into
Open
xiaopebaka wants to merge 10 commits into
xiaopebaka wants to merge 10 commits into
Conversation
Apple's GrandSlam edge answers any request whose X-Mme-Client-Info names com.apple.dt.Xcode with an HTML 503 page, before the request reaches the backend at all. Signing in has been failing on the very first request since around 2026-08-31. Bisected against gsa.apple.com/grandslam/GsService2 with an init-shaped body, three requests per row: <com.apple.AuthKit/1 (com.apple.dt.Xcode/25183.54.10)> 503 503 503 <com.apple.AuthKit/1 (com.apple.dt.Xcode/26.0)> 503 503 503 <com.apple.AuthKit/1 (com.apple.dt.Xcode)> 503 503 503 <com.apple.AuthKit/1 (com.apple.dt.Xcodex/26.0)> 503 503 503 <com.apple.AuthKit/1 (com.apple.foo/1.0)> 200 200 200 <com.apple.AuthKit/1 (com.apple.akd/1.0)> 200 200 200 <com.apple.AuthKit/1> 200 200 200 The match is on the com.apple.dt.Xcode prefix, not on the version and not on the parentheses: appending a character to the identifier is still blocked, while any other identifier is served. Dropping the trailing identifier is enough, and the Xcode flow is still identified by X-Apple-App-Info and X-Xcode-Version, neither of which is filtered. X-Mme-Client-Info is only ever sent as a header - the copy in the anisette client-provided data is commented out and AnisetteData::_device_description is unused - so nothing else depends on this string. Also make the failure legible if Apple does this again. plist_request checked nothing before handing the body to the plist parser, so an HTML error page surfaced as a parse error that named neither the status code nor the fact that the response came from the edge rather than the backend. It now verifies the status and Content-Type first and reports both plus a snippet of the body, and retries 5xx responses five times with exponential backoff. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0194fngS3qeEqdSqR2JubDHE
Runs login plus the apptokens request without needing a device attached, and takes a --provision mode that exercises anisette provisioning and the GrandSlam requests it makes without needing any credentials at all. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0194fngS3qeEqdSqR2JubDHE
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.