Skip to content

ipatool-rs v0.3.0 — Native desktop and guided FairPlay

Choose a tag to compare

View all tags
@everettjf everettjf released this 03 Nov 21:00
· 6 commits to main since this release
v0.3.0
9368505
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Native desktop and shared Rust workflows

v0.3.0 adds an experimental native dark GPUI desktop on Apple Silicon macOS alongside the CLI and MCP server. Explore, account access, Library, download tasks and FairPlay use shared Rust services. Browsing starts with iOS and follows the loaded account's region; manual region changes show download guidance. The sidebar shows sign-in status and region without the account name.

FairPlay now offers a one-time preparation guide, private model storage, and automatic matching/decryption for later entitled IPA downloads. Advanced controls are collapsed. Current-format recovery is ported from pinned UnfairPlay b3a7a432; legacy exact-build recovery remains explicit. A separately signed, fixed-input helper provides approved protected reads while the GUI stays unprivileged.

Real controlled macOS acceptance covered preparation, complete available plaintext page-hash verification, restart and automatic reuse on a different IPA after removing collection access. The two IPAs contained 37 encrypted images / 179,040 pages. Model bytes and all 16,546 decrypted ZIP members matched pinned UnfairPlay. This release also fixes native authorization source metadata handling, recursive private capture permissions and independent local/central ZIP extra fields.

Install on Apple Silicon macOS

Desktop:

brew tap everettjf/tap
brew install --cask everettjf/tap/ipatool-rs-gui

Open IPATOOL-RS from Applications. Requires macOS 12 or later; protected FairPlay preparation requires macOS 13 or later and explicit administrator approval. Remove collection access in the app before uninstalling it. No account state, model or downloaded app is bundled.

CLI:

brew install everettjf/tap/ipatool-rs
# Existing installation:
brew upgrade everettjf/tap/ipatool-rs
ipatool-rs --version

The formula and cask install separately. You can use either or both.

Assets and validation

  • macOS arm64: Developer ID signed/notarized CLI .tar.gz and desktop .zip, each with a SHA-256 file. The desktop carries a stapled notarization ticket and includes the scoped helper. Extract IPATOOL-RS.app into Applications for manual GUI installation.
  • Linux x86_64: experimental CLI .tar.gz and SHA-256 file.
  • Windows x86_64: experimental CLI .zip and SHA-256 file.
  • 596 active local tests passed, with 70 opt-in library tests ignored. Formatting, strict default/GUI/GUI-test Clippy, ARM64 builds and all five platform CI jobs validate the shared services and GUI controllers. Release CI independently verifies native packages and macOS trust checks before publication.

Full prerequisites and evidence: README, FairPlay guide, acceptance record.

Scope and remaining limits

This is an experimental Rust rewrite created to use otherwise-unused Codex quota and test a substantial port. Prefer the original ipatool and UnfairPlay for practical use.

Controlled Apple Silicon results do not establish arbitrary-enrollment or cross-platform private-data parity. The same Apple ID alone does not guarantee a matching model. Embedded plaintext hashes do not establish Apple CMS signature trust. Linux/Windows live account and package workflows, Windows managed-model ACLs, desktop accessibility and remaining macOS 2FA/session-recovery gates stay open. Linux/Windows GUI builds are validated in CI but are not distributed as desktop releases. macOS x86_64, Linux ARM64, Windows ARM64 and iOS runtime releases remain deferred.

Release validation: main platform CI, native release CI.

Assets 10
Loading