Repository navigation
Sign the escrow request as the Mac whose anisette the session uses - #12
Open
gregakespret wants to merge 8 commits into
Open
gregakespret wants to merge 8 commits into
gregakespret wants to merge 8 commits into
Conversation
On Apple's -21669 ("Try entering your verification code again.") the
login now asks for the code again for the same text instead of failing
with Bad2faCode. The 2FA closure takes a TfaPrompt (the texted phone,
plus how many codes Apple has refused for this text) and returns
Option<String>; the console callers in src/test.rs ignore the prompt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JvDrSTtCSuxsh3iMaZ8sPX
Moves the submodule to the head of apple-private-apis#8, which retypes a refused code only when -21669 is Apple's sole reason. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018qVCoJNNwwmBEafaSpCBiG
Pin apple-private-apis: a wrong SMS code can be retyped
Moves the submodule to 6557333, where the SMS code goes to Apple's default trusted phone and the 2FA prompt answers with `TfaAnswer` (a code, or another phone to text). The two console prompts in src/test.rs answer with `TfaAnswer::Code`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018qVCoJNNwwmBEafaSpCBiG
Moves the submodule to 1eaf3e0: a phone switch Apple will not send goes back to the text already sent instead of failing the sign-in, and TfaPrompt gains `texts` and `switch_refused`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018qVCoJNNwwmBEafaSpCBiG
Pin apple-private-apis to the default-phone change
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The keychain escrow request now presents the session's own Mac identity
when anisette comes from a real Mac. Before, it presented the configured
device's identity, which under export-findmy's
FakeIOSConfigis aniPhone. Apple answered -3001, so the trust circle was never joined and
no accessory keys came back.
escrow_anisette_headerspicks theX-Mme-Client-Infothe escrow callsends. For a macOS identity it keeps the Mac's model and OS and swaps in
only the escrow service's application component (sbd). An Android
identity is passed through unchanged. Anything else, including the
iPhone identity a v3 anisette server reports for
FakeIOSConfig, getsthe configured service identity, which is exactly what it got before. A
failed escrow request now also logs its command, HTTP status, host,
identity profile and Apple's error code.
gregakespret/export-findmy production has run this branch since
gregakespret/export-findmy#20. That is why this PR should land: the pin
sits on a branch that was never merged here. Any export-findmy change
that re-pins to
findmy-export-supportdrops the escrow fix and breaksconnects again. The open export-findmy PRs that bump rustpush do exactly
that. In the other direction, production lacks #11. Once this is merged,
export-findmy can pin
findmy-export-supportagain.The two sides touch different files (
src/icloud/keychain.rshere, theapple-private-apissubmodule pin onfindmy-export-support), so themerge is clean.
cargo test --libpasses all 13 tests at 7363665, includingthe three new
escrow_identity_tests.Review notes, not changed here: the new
headers["X-Mme-Client-Info"].to_str().unwrap()insend_escrow_requestpanics if the identity holds a byte outsidevisible ASCII, the same risk as the existing
b.parse().unwrap()a fewlines up. The Mac/Android detection is written twice, once in the helper
and once for the log profile. Nothing in export-findmy reaches the
Android branch, since no provider it uses reports an Android identity.
🤖 Generated with Claude Code
https://claude.ai/code/session_01UQoQ8qnF9rH1axBYS6Nqrn