ipatool-rs v0.3.0 — Native desktop and guided FairPlay

Native desktop and shared Rust workflows

v0.3.0 adds an experimental native dark GPUI desktop on Apple Silicon macOS alongside the CLI and MCP server. Explore, account access, Library, download tasks and FairPlay use shared Rust services. Browsing starts with iOS and follows the loaded account's region; manual region changes show download guidance. The sidebar shows sign-in status and region without the account name.

FairPlay now offers a one-time preparation guide, private model storage, and automatic matching/decryption for later entitled IPA downloads. Advanced controls are collapsed. Current-format recovery is ported from pinned UnfairPlay b3a7a432; legacy exact-build recovery remains explicit. A separately signed, fixed-input helper provides approved protected reads while the GUI stays unprivileged.

Real controlled macOS acceptance covered preparation, complete available plaintext page-hash verification, restart and automatic reuse on a different IPA after removing collection access. The two IPAs contained 37 encrypted images / 179,040 pages. Model bytes and all 16,546 decrypted ZIP members matched pinned UnfairPlay. This release also fixes native authorization source metadata handling, recursive private capture permissions and independent local/central ZIP extra fields.

Install on Apple Silicon macOS

Desktop:

brew tap everettjf/tap
brew install --cask everettjf/tap/ipatool-rs-gui

Open IPATOOL-RS from Applications. Requires macOS 12 or later; protected FairPlay preparation requires macOS 13 or later and explicit administrator approval. Remove collection access in the app before uninstalling it. No account state, model or downloaded app is bundled.

CLI:

brew install everettjf/tap/ipatool-rs
# Existing installation:
brew upgrade everettjf/tap/ipatool-rs
ipatool-rs --version

The formula and cask install separately. You can use either or both.

Assets and validation

• macOS arm64: Developer ID signed/notarized CLI .tar.gz and desktop .zip, each with a SHA-256 file. The desktop carries a stapled notarization ticket and includes the scoped helper. Extract IPATOOL-RS.app into Applications for manual GUI installation.
• Linux x86_64: experimental CLI .tar.gz and SHA-256 file.
• Windows x86_64: experimental CLI .zip and SHA-256 file.
• 596 active local tests passed, with 70 opt-in library tests ignored. Formatting, strict default/GUI/GUI-test Clippy, ARM64 builds and all five platform CI jobs validate the shared services and GUI controllers. Release CI independently verifies native packages and macOS trust checks before publication.

Full prerequisites and evidence: README, FairPlay guide, acceptance record.

Scope and remaining limits

This is an experimental Rust rewrite created to use otherwise-unused Codex quota and test a substantial port. Prefer the original ipatool and UnfairPlay for practical use.

Controlled Apple Silicon results do not establish arbitrary-enrollment or cross-platform private-data parity. The same Apple ID alone does not guarantee a matching model. Embedded plaintext hashes do not establish Apple CMS signature trust. Linux/Windows live account and package workflows, Windows managed-model ACLs, desktop accessibility and remaining macOS 2FA/session-recovery gates stay open. Linux/Windows GUI builds are validated in CI but are not distributed as desktop releases. macOS x86_64, Linux ARM64, Windows ARM64 and iOS runtime releases remain deferred.

Release validation: main platform CI, native release CI.

v0.2.1

Experimental release

This patch release narrows the published targets to:

• Apple Silicon macOS (ipatool-rs-0.2.1-macos-arm64.tar.gz), Developer ID signed and Apple notarized.
• Linux x86_64 (ipatool-rs-0.2.1-linux-x86_64.tar.gz).
• Windows x86_64 (ipatool-rs-0.2.1-windows-x86_64.zip).

Each archive has a companion SHA-256 file. Linux ARM64 and Windows ARM64 artifacts from v0.2.0 are outside the current release scope. The command remains ipatool-rs and can coexist with the original ipatool. Automatic FairPlay startup-profile export remains open in issue #2 and draft PR #6.

Native CI covers tests, release builds, version checks, public App Store search, and package checksums for Linux and Windows x86_64. The macOS archive passed local checksum, signature, public-search and notarization checks. These checks do not establish full parity: real 2FA, rejected-token recovery, interactive Keychain login/revoke, private FairPlay decryption, and authenticated Linux/Windows account and package flows remain to be validated. See the TODO list.

This is an experimental Rust rewrite to use otherwise-unused Codex quota and test how far Codex could carry the port. For practical use, prefer ipatool and UnfairPlay.

ipatool-rs v0.2.0

Experimental portable release

Version 0.2.0 adds native Linux x86_64 and ARM64 and Windows x86_64 and ARM64 archives alongside the Developer ID signed, Apple notarized macOS ARM64 archive. Each archive has a companion SHA-256 file. The command remains ipatool-rs (ipatool-rs.exe on Windows).

Native CI runs the portable test suite, Clippy, a release build, version output, and a live public App Store catalog search on all four Linux and Windows targets. The 20 tests requiring locally cached Apple framework images run on a checked macOS development host and are explicitly skipped on clean CI runners.

This remains an experimental Rust rewrite. Authenticated Store, credential-store migration, package downloads, and private FairPlay workflows still need live end-to-end validation on Linux and Windows. Real 2FA, expired-token recovery, interactive macOS Keychain login and revoke, and private FairPlay decryption are also open. For practical use, prefer the original ipatool and UnfairPlay projects. See docs/TODO.md for exact gates.

v0.1.0 — Apple Silicon macOS

0.1.0 for macOS on Apple Silicon

This is the first regular GitHub release of the experimental Rust rewrite. It uses the ipatool-rs command and includes the signed runtime fix first shipped in preview.2. The runtime behavior is otherwise unchanged from preview.3.

The ARM64 archive is Developer ID signed. Apple notarization returned Accepted with zero issues. The archive checksum, contents, strict code signature, runtime entitlements, public catalog search, and controlled-account purchase-history request were checked against the extracted release executable. Its binary matches the notarized ZIP payload byte for byte.

Download the .tar.gz archive and adjacent .sha256 file, then verify with shasum -a 256 -c ipatool-rs-0.1.0-macos-arm64.tar.gz.sha256. The project Homebrew tap is another install option: brew tap everettjf/tap and brew install everettjf/tap/ipatool-rs.

This version number does not assert full parity. Real 2FA, successful recovery from an expired Store token, interactive Keychain login and revoke, authenticated MCP version/metadata/download responses, and private FairPlay enrollment and decryption still need end-to-end validation. macOS x86_64, iOS, Linux, and Windows runtime work is deferred. For practical use, prefer the original ipatool and UnfairPlay projects.

v0.1.0-preview.3 — Apple Silicon macOS preview

Apple Silicon macOS preview

This preview refreshes the versioned release, README, Pages install link, and porting status. The runtime behavior is unchanged from preview.2, which fixed the signed executable's Unicorn library loading and JIT access. The command remains ipatool-rs.

The ARM64 archive is Developer ID signed and Apple notarization returned Accepted with zero issues. Its SHA-256 checksum, archive contents, strict code signature, runtime entitlements, public catalog search, and controlled-account purchase-history request were checked against the extracted release executable. The archived executable matches the notarized ZIP payload byte for byte.

Download the .tar.gz archive and the adjacent .sha256 file, then verify with shasum -a 256 -c ipatool-rs-0.1.0-preview.3-macos-arm64.tar.gz.sha256.

Known validation gaps: real 2FA, successful recovery from an expired Store token, interactive Keychain login and revoke, authenticated MCP version/metadata/download responses, and private FairPlay enrollment and decryption. macOS x86_64, iOS, Linux, and Windows runtime support is deferred. This is an experimental preview; prefer the original ipatool and UnfairPlay projects for practical use.

v0.1.0-preview.2 (experimental)

Experimental Apple Silicon macOS preview

Preview.2 fixes the Developer ID signed runtime's account-backed Store commands. Preview.1 could not load the checksum-pinned Unicorn dynamic library under macOS library validation; allowing that library exposed a separate JIT restriction. The new signed executable carries the two required hardened-runtime entitlements.

The extracted archive passed codesign --verify --strict, a SHA-256 check, controlled-account purchase history, TouchLink version listing and metadata, and a TouchLink Mac-compatible IPA download with SINF on macOS 27.0.1 ARM64. Apple notarization accepted submission a0b08df0-7978-4ca8-bedc-179fb324641c with zero issues. The archive includes the MIT license, notices, and the DarkPhoenix Apache-2.0 license.

For practical use, prefer the original ipatool and UnfairPlay projects. This is an experimental Rust rewrite.

Install

brew tap everettjf/tap
brew install everettjf/tap/ipatool-rs

Alternatively, download the attached tarball and SHA-256 file, verify with shasum -a 256 -c ipatool-rs-0.1.0-preview.2-macos-arm64.tar.gz.sha256, and extract the archive.

Known limits

• Real 2FA and interactive default-Keychain login and revoke still need end-to-end checks. The user approved an interactive auth info Keychain dialog.
• Successful recovery from an expired Store token remains unverified. The signed CLI download succeeded with a valid saved account; a prior MCP download had failed after token refresh.
• Three authenticated MCP outputs and private FairPlay enrollment/decryption still need live validation.
• macOS x86_64, iOS, Linux, and Windows runtime validation is deferred.

See the remaining work and porting record.

v0.1.0-preview.1 (experimental)

Experimental Rust preview

This is the first ipatool-rs preview for Apple Silicon macOS. It is a research rewrite combining App Store workflows and FairPlay tooling. For practical use, prefer the original ipatool and UnFairPlay projects.

License packaging update

The preview archive was repackaged on 2026-10-27 to include LICENSE, NOTICE, and the DarkPhoenix Apache-2.0 license. The signed executable is unchanged (SHA-256 8619a5aa1491f61a6a55129725fc1a1437bc8fff50989b501c5ae80bc0a6e75c). Use the current SHA-256 file when verifying the archive.

Install

Download ipatool-rs-0.1.0-preview.1-macos-arm64.tar.gz and its .sha256 file, then run:

shasum -a 256 -c ipatool-rs-0.1.0-preview.1-macos-arm64.tar.gz.sha256
tar -xzf ipatool-rs-0.1.0-preview.1-macos-arm64.tar.gz
./ipatool-rs --version

The executable is Developer ID signed and Apple notarization returned Accepted. It was built and exercised on an Apple Silicon Mac running macOS 27.0.1. The executable name ipatool-rs avoids replacing the original ipatool.

Known limits

• Real 2FA and interactive default Keychain authorization still need end-to-end checks.
• A recent controlled-account run saw Store metadata errors and a token rejection after refresh. Successful recovery and three authenticated MCP tools remain unverified.
• Private FairPlay enrollment and decryption require paired private data and remain unverified.
• macOS x86_64, iOS, Linux, and Windows runtime validation is deferred.

See the porting record and remaining work for current evidence.