ipatool 2.3.2 SAP authentication fix

macOS SAP authentication fix

The canonical standalone repository is now
maksimryabkin/ipatool-sapfix.

Community prerelease based on upstream ipatool v2.3.2. It fixes App Store
login requests that started returning an empty HTTP 403 by adding Apple's
required SAP action signature (X-Apple-ActionSignature) through the macOS
CommerceKit service.

Also included:

• login, pod redirect, and plist response fixes included in this build;
• passwords and 2FA codes are no longer printed by --verbose;
• arm64 (Apple Silicon) and amd64 (Intel) macOS binaries;
• SHA-256 checksum files for both archives.

Authentication in this build is macOS-only and requires cgo. The SAP flow was
verified against the live App Store login endpoint on Apple Silicon. This is an
unofficial standalone community project based on
majd/ipatool.

Install

Download the archive matching uname -m, verify it with the attached
.sha256sum, extract it, and install the binary. Apple Silicon example:

shasum -a 256 -c ipatool-2.3.2-sapfix.1-macos-arm64.tar.gz.sha256sum
tar -xzf ipatool-2.3.2-sapfix.1-macos-arm64.tar.gz
sudo install -m 0755 bin/ipatool-2.3.2-sapfix.1-macos-arm64 /usr/local/bin/ipatool
ipatool --version

For Intel Macs, use the macos-amd64 archive and binary names instead.

If a browser-added quarantine attribute blocks first launch, verify the
checksum first, then remove the attribute from the extracted binary:

xattr -d com.apple.quarantine bin/ipatool-2.3.2-sapfix.1-macos-arm64

Authenticate

ipatool auth login --email "you@example.com"