Clear sign-in error when this Mac isn't set up for Apple, version 0.1.4

- "Anisette not provisioned" now explains what to do: sign in to an
  Apple Account (or the App Store) on this Mac once, then try again.
- Sign-in identity always comes from this Mac. Public anisette servers
  are no longer offered: Apple rejects them (403 at the verification
  code, -80045 at login), so the Settings picker is removed.
- The public anisette client no longer crashes or hangs on unexpected
  server responses.
- New hidden `anisette-check` engine command for diagnostics.

Author: vbrvrh6ynd-svg

README.md

@@ -43,5 +43,5 @@ Data lives in `~/Library/Application Support/GatePass`.
 ## Notes
 
 - Free Apple IDs: apps last 7 days, max 3 active sideloaded apps, 10 new App IDs per week. These are Apple's limits.
-- Apple ID login uses Apple's private APIs (same as every sideloader). On macOS, anisette data is generated locally by the system's AOSKit, so Apple sees your real Mac; set `GATEPASS_REMOTE_ANISETTE=1` to use a public anisette server instead. Your password is only sent to Apple.
+- Apple ID login uses Apple's private APIs (same as every sideloader). On macOS, anisette data is generated locally by the system's AOSKit, so Apple sees your real Mac and no third-party server is involved. The Mac must be signed in to an Apple Account (or the App Store) at least once; otherwise sign-in fails with "Anisette not provisioned". Public anisette servers aren't offered because Apple currently rejects them. Your password is only sent to Apple.
 - Use it for apps you have the right to install.

app/Sources/GatePass/Engine.swift

@@ -55,9 +55,9 @@ enum Engine {
         process.arguments = args
         var env = ProcessInfo.processInfo.environment
         env["RUST_LOG"] = env["RUST_LOG"] ?? "info"
-        // Default "local": sign-in identity comes from this Mac; no third-party anisette server.
-        let anisette = UserDefaults.standard.string(forKey: Pref.anisette) ?? "local"
-        env["GATEPASS_ANISETTE"] = ["local", "auto", "remote"].contains(anisette) ? anisette : "local"
+        // Sign-in identity always comes from this Mac. Public anisette servers are rejected
+        // by Apple (403 at 2FA, -80045 at login), so they are not offered.
+        env["GATEPASS_ANISETTE"] = "local"
         if UserDefaults.standard.bool(forKey: Pref.keychain) { env["GATEPASS_KEYCHAIN"] = "1" }
         process.environment = env
 

app/Sources/GatePass/Settings.swift

@@ -6,7 +6,6 @@ enum Pref {
     static let autoRefresh = "autoRefresh"    // Bool, default true
     static let notifications = "notifications" // Bool, default true
     static let devMode = "devMode"            // Bool, default false
-    static let anisette = "anisette"          // "local" | "auto" | "remote"
     static let didOnboard = "didOnboard"      // Bool
     static let keychain = "useKeychain"       // Bool, default false
 
@@ -84,7 +83,6 @@ struct GeneralSettings: View {
 
 struct AdvancedSettings: View {
     @AppStorage(Pref.devMode) private var devMode = false
-    @AppStorage(Pref.anisette) private var anisette = "local"
 
     var body: some View {
         Form {
@@ -95,16 +93,6 @@ struct AdvancedSettings: View {
             }
 
             if devMode {
-                Section("Sign-in identity (anisette)") {
-                    Picker("Source", selection: $anisette) {
-                        Text("Local — this Mac (recommended)").tag("local")
-                        Text("Automatic — local, then public server").tag("auto")
-                        Text("Public server").tag("remote")
-                    }
-                    Text("Local means Apple sees your real Mac and no data goes to a third party. Use a public server only if local doesn't work.")
-                        .font(.caption).foregroundStyle(.secondary)
-                }
-
                 Section("Troubleshooting") {
                     Button("Open Log (engine.log)") { NSWorkspace.shared.open(EngineLog.url) }
                     Button("Open Data Folder") {

engine/Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "gatepass-engine"
-version = "0.1.3"
+version = "0.1.4"
 edition = "2024"
 license = "MIT"
 description = "Headless signing/installing engine for GatePass, built on Impactor's crates."

engine/Cargo.toml

@@ -42,6 +42,9 @@ enum Command {
     },
     /// Show saved accounts
     Accounts,
+    /// Diagnostics: obtain sign-in identity (anisette) and print which header names came back
+    #[command(hide = true)]
+    AnisetteCheck,
     /// Free-account limits: App IDs left this week, active apps per device
     Quota,
     /// Read name/bundle id/version/icon from an .ipa without installing
@@ -131,6 +134,19 @@ pub fn anisette() -> AnisetteConfiguration {
     AnisetteConfiguration::default().set_configuration_path(data_path())
 }
 
+async fn anisette_check() -> Result<()> {
+    let data = plume_core::auth::anisette_data::AnisetteData::new(anisette()).await?;
+    let mut names: Vec<_> = data
+        .generate_headers(false, true, true)
+        .into_iter()
+        .filter(|(_, v)| !v.is_empty())
+        .map(|(k, _)| k)
+        .collect();
+    names.sort();
+    emit(json!({ "type": "anisette", "headers": names }));
+    Ok(())
+}
+
 pub async fn load_store() -> Result<AccountStore> {
     Ok(AccountStore::load(&Some(store_path())).await?)
 }
@@ -149,6 +165,7 @@ async fn main() {
         Command::Login => login().await,
         Command::Logout { email } => logout(email).await,
         Command::Accounts => accounts().await,
+        Command::AnisetteCheck => anisette_check().await,
         Command::Quota => quota().await,
         Command::IpaInfo { ipa, icon_out } => install::ipa_info(ipa, icon_out),
         Command::Install { ipa, udid, opts } => install::install(ipa, udid, opts).await,
@@ -188,6 +205,10 @@ fn friendly_error(e: &anyhow::Error) -> String {
         "Incorrect email or password."
     } else if lower.contains("-21669") || lower.contains("verification code") || lower.contains("-21667") {
         "Incorrect verification code. Try again."
+    } else if lower.contains("anisette not provisioned") || lower.contains("anisette error: unsupported device") {
+        "This Mac isn't set up for Apple sign-in yet. Open System Settings and sign in to your Apple Account (or sign in to the App Store once), then try again. GatePass doesn't work in a virtual machine."
+    } else if lower.contains("-80045") {
+        "Apple temporarily refused this sign-in. Wait 15–30 minutes and try again."
     } else if lower.contains("sign-in cancelled") {
         "Sign-in was cancelled."
     } else if lower.contains("not found") && lower.contains("device") {

engine/src/main.rs

@@ -61,7 +61,13 @@ pub enum AnisetteError {
 
 pub const DEFAULT_ANISETTE_URL: &str = "https://ani.f1sh.me/";
 
-pub const DEFAULT_ANISETTE_URL_V3: &str = "https://mac-ani.jkcoxson.com";
+pub const DEFAULT_ANISETTE_URL_V3: &str = "https://ani.sidestore.io";
+
+/// [GatePass] Public v3 servers tried in order. ani.sidestore.io advertises macOS 13.1;
+/// mac-ani.jkcoxson.com advertises macOS 10.12, which Apple may reject during 2FA,
+/// so it is only the last resort.
+pub const FALLBACK_ANISETTE_URLS_V3: &[&str] =
+    &["https://ani.sidestore.io", "https://mac-ani.jkcoxson.com"];
 
 #[derive(Clone, Debug)]
 pub struct AnisetteConfiguration {
@@ -141,10 +147,11 @@ impl AnisetteHeaders {
     pub fn get_anisette_headers_provider(
         configuration: AnisetteConfiguration,
     ) -> Result<AnisetteHeadersProviderRes, AnisetteError> {
-        // [GatePass] On macOS prefer the machine's own identity; public servers advertise
-        // macOS 10.12, which Apple now rejects with 403 during 2FA.
-        // GATEPASS_ANISETTE: "local" (default: never contact third-party servers),
-        // "auto" (local, falling back to remote) or "remote".
+        // [GatePass] On macOS use the machine's own identity. Apple rejects identities
+        // from public anisette servers (403 during 2FA, -80045 at login), so the default
+        // never falls back to them.
+        // GATEPASS_ANISETTE: "local" (default), "auto" (local, then public server) or
+        // "remote" — the latter two only for debugging.
         #[cfg(target_os = "macos")]
         {
             let policy = std::env::var("GATEPASS_ANISETTE").unwrap_or_else(|_| "local".into());
@@ -163,7 +170,8 @@ impl AnisetteHeaders {
             }
         }
 
-        // TODO: handle Err because it will just go to remote anisette and not tell the user anything
+        // StoreServicesCore needs Android libraries we don't ship on macOS.
+        #[cfg(not(target_os = "macos"))]
         if let Ok(ssc_anisette_headers_provider) =
             AnisetteHeaders::get_ssc_anisette_headers_provider(configuration.clone())
         {
@@ -178,6 +186,9 @@ impl AnisetteHeaders {
                 configuration.macos_serial.clone(),
             ),
         )));
+
+        #[cfg(not(feature = "remote-anisette-v3"))]
+        Err(AnisetteError::UnsupportedDevice)
     }
 
     pub fn get_ssc_anisette_headers_provider(

upstream/impactor/3rdparty/omnisette/src/lib.rs

@@ -263,7 +263,7 @@ impl AnisetteClient {
                 if message.contains("-45061") {
                     Err(AnisetteError::AnisetteNotProvisioned)
                 } else {
-                    panic!("Unknown error {}", message)
+                    Err(anyhow::anyhow!("Anisette server error: {message}").into())
                 }
             }
             AnisetteHeaders::Headers {
@@ -297,22 +297,22 @@ impl AnisetteClient {
         let protocol_val = plist::Value::from_reader(Cursor::new(text.as_str()))?;
         let urls = protocol_val
             .as_dictionary()
-            .unwrap()
+            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?
             .get("urls")
-            .unwrap()
+            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?
             .as_dictionary()
-            .unwrap();
+            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?;
 
         let start_provisioning_url = urls
             .get("midStartProvisioning")
-            .unwrap()
+            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?
             .as_string()
-            .unwrap();
+            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?;
         let end_provisioning_url = urls
             .get("midFinishProvisioning")
-            .unwrap()
+            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?
             .as_string()
-            .unwrap();
+            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?;
         debug!(
             "Got provisioning urls: {} and {}",
             start_provisioning_url, end_provisioning_url
@@ -338,11 +338,13 @@ impl AnisetteClient {
         }
 
         loop {
-            let Some(Ok(data)) = connection.next().await else {
-                continue;
+            let data = match connection.next().await {
+                Some(Ok(data)) => data,
+                Some(Err(e)) => return Err(e.into()),
+                None => return Err(anyhow::anyhow!("Anisette server closed the connection").into()),
             };
             if data.is_text() {
-                let txt = data.to_text().unwrap();
+                let txt = data.to_text()?;
                 let msg: ProvisionInput = serde_json::from_str(txt)?;
                 match msg {
                     ProvisionInput::GiveIdentifier => {
@@ -377,15 +379,15 @@ impl AnisetteClient {
                         let protocol_val = plist::Value::from_reader(Cursor::new(text.as_str()))?;
                         let spim = protocol_val
                             .as_dictionary()
-                            .unwrap()
+            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?
                             .get("Response")
-                            .unwrap()
+                            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?
                             .as_dictionary()
-                            .unwrap()
+                            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?
                             .get("spim")
-                            .unwrap()
+                            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?
                             .as_string()
-                            .unwrap();
+                            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?;
 
                         debug!("GiveStartProvisioningData");
                         #[derive(Serialize)]
@@ -419,11 +421,11 @@ impl AnisetteClient {
                         let protocol_val = plist::Value::from_reader(Cursor::new(text.as_str()))?;
                         let response = protocol_val
                             .as_dictionary()
-                            .unwrap()
+            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?
                             .get("Response")
-                            .unwrap()
+                            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?
                             .as_dictionary()
-                            .unwrap();
+                            .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?;
 
                         debug!("GiveEndProvisioningData");
 
@@ -433,8 +435,14 @@ impl AnisetteClient {
                             tk: &'t str,
                         }
                         let end_provisioning = EndProvisioning {
-                            ptm: response.get("ptm").unwrap().as_string().unwrap(),
-                            tk: response.get("tk").unwrap().as_string().unwrap(),
+                            ptm: response
+                                .get("ptm")
+                                .and_then(|v| v.as_string())
+                                .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?,
+                            tk: response
+                                .get("tk")
+                                .and_then(|v| v.as_string())
+                                .ok_or_else(|| AnisetteError::from(anyhow::anyhow!("Unexpected provisioning response from Apple")))?,
                         };
                         connection
                             .send(Message::Text(
@@ -489,7 +497,31 @@ impl AnisetteHeadersProvider for RemoteAnisetteProviderV3 {
         _skip_provisioning: bool,
     ) -> Result<HashMap<String, String>, AnisetteError> {
         if self.client.is_none() {
-            self.client = Some(AnisetteClient::new(self.client_url.clone()).await?);
+            // [GatePass] try the configured server, then the other known public servers.
+            let mut urls = vec![self.client_url.clone()];
+            urls.extend(
+                crate::FALLBACK_ANISETTE_URLS_V3
+                    .iter()
+                    .map(|u| u.to_string())
+                    .filter(|u| *u != self.client_url),
+            );
+            let mut last_err = None;
+            for url in urls {
+                match AnisetteClient::new(url.clone()).await {
+                    Ok(c) => {
+                        log::info!("Using public anisette server {url}");
+                        self.client = Some(c);
+                        break;
+                    }
+                    Err(e) => {
+                        log::warn!("Anisette server {url} unavailable: {e}");
+                        last_err = Some(e);
+                    }
+                }
+            }
+            if self.client.is_none() {
+                return Err(last_err.unwrap_or(AnisetteError::Misc));
+            }
         }
         let client = self.client.as_ref().unwrap();
 
@@ -518,7 +550,7 @@ impl AnisetteHeadersProvider for RemoteAnisetteProviderV3 {
                     plist::to_file_xml(config_path, state)?;
                     client.get_headers(&state).await?
                 } else {
-                    panic!()
+                    return Err(err);
                 }
             }
         };