[Mr3242-Scripter]

Description of Changes
Ports SideInstaller’s temporary GrandSlam / Apple ID auth workaround into SideSign so clients (e.g. SideStore) can sign in again after Apple began rejecting common Mac/Xcode client identities.
GrandSlam (sendAuthenticationRequest):
• Prefer Windows client-info and akd User-Agent when the provided identity looks like Mac/Xcode/Android stock values:
◦ Client-Info:
◦ User-Agent: akd/1.0 CFNetwork/808.1.4
• Headers aligned with SideInstaller: X-Mme-Client-Info, User-Agent, X-Xcode-Version: 14.2 (14C18), X-Apple-App-Info: com.apple.gs.xcode.auth, Accept/Content-Type: text/x-xml-plist, Connection: close
• Retry HTTP 429 and 503 with spaced backoff (2s, 5s)
Defaults / session:
• Default GrandSlam and AppleAuth User-Agent set to akd/1.0 CFNetwork/808.1.4 (no longer Macintosh/Xcode)
• DeveloperPortal uses an ephemeral URLSession (no connection pooling/reuse; GSA often returns 5xx on reused connections)
Anisette:
• Prefer Windows client-info + akd User-Agent when constructing the Anisette client / headers (instead of always using Mac-oriented defaults)
2FA (gsa.apple.com/auth):
• SideInstaller found these pages often return a bare 403 for the Windows client used on GrandSlam; retry once as Mac with:
◦
• Also retry as Mac on 500/503/433 when needed
• SMS: PUT JSON to https://gsa.apple.com/auth/verify/phone with numeric phoneNumber.id (SideInstaller parity), instead of the older plist /phone/put path
• 2FA requests start with Mac client-info where appropriate
Rationale behind Changes
In mid-October 2026, Apple started rejecting widely used Mac/Xcode (and some remote-anisette) client identities during GrandSlam. Callers saw HTTP 503, -80045, and “could not connect to iCloud” on password auth and especially after choosing a 2FA method.
SideInstaller’s temporary approach that restored login:
1 Windows + akd for GrandSlam SRP
2 Fresh HTTP connections and limited 429/5xx retries
3 Mac client-info fallback for gsa.apple.com/auth 2FA pages
SideSign is the auth library used by SideStore; without these changes, app-level anisette tweaks alone are not enough. This is intended as a temporary compatibility fix until Apple’s requirements stabilize.
Suggested Testing Steps
1 Point a SideStore (or other) build at this SideSign revision.
2 Use a Windows anisette server, for example:
◦ https://ani.jkcoxson.com
◦ https://win.ani.sidestore.io
◦ https://nythepegasus.com (confirmed working with this change set)
3 Sign in with Apple ID + password; confirm SRP init/complete succeeds.
4 At 2FA, try trusted device and SMS; confirm code request and verification succeed (no generic iCloud connection failure after method selection).
5 Confirm wrong password still maps to incorrect-credentials, not a generic transport error.
6 Optional: log headers and confirm GSA uses Windows/akd and 2FA can retry as Mac on 403/5xx.
Already tested via a SideStore Nightly that vendors this SideSign: full sign-in including 2FA completed successfully (including with the nythepegasus anisette server).
Did you use AI to help find, test, or implement this issue or feature?
Yes. AI (Grok) was used to diff SideInstaller’s GrandSlam/2FA flow against SideSign, identify gaps (Windows/akd defaults, header parity, retries, ephemeral session, 2FA Mac fallback, SMS PUT JSON, and a too-broad “ec” substring check that blocked Mac retry), and help draft patches. The changes were built and verified on device through a SideStore Nightly. AI did not replace manual testing or the decision to contribute upstream.

[IntelRyzenYT]

LLM assisted/ generated