ReProvision VS TrustKit

A few years ago, I built ReProvision (https://github.com/Matchstic/ReProvision) which used Apple APIs to sign iOS apps every 7 days. Even then, the authentication methods I was using kept getting blocked, and that was for something realistically low on Apple’s radar.

> Apple doesn't allow side loading apps

HN readers might be surprised at the extent of modded-iOS-app communities (just like APK communities for Androids) that manage to exist within the meager 7-day signing window Apple allows a free-tier developer account. Tools like AltStore and ReProvision are the standard for sideloading and renewing (respectively) legitimate jailbreak-entrypoint apps:

https://github.com/rileytestut/AltStore

https://github.com/Matchstic/ReProvision

Even for un-jailbroken devices there are entire alternative ecosystems based around sideloading modded/pirated apps. They are obviously full of pirated stuff, usually work by abusing an enterprise cert from an endless list of Chinese companies (not insinuating anything bad, just firsthand experience), and they probably have some nasty malware mixed in here and there as well. Zero endorsement for any of these examples from the first page of a DDG search, but you get the idea:

https://iphonecake.com/

https://sideload.tweakboxapp.com/

https://ipaspot.app/

https://www.valuewalk.com/2019/04/spotify-up-tweakbox-users-...

Good points. SSL pinning provides a certain level of protection. It’s tricky to implement correctly, so one can for instance consider https://github.com/datatheorem/TrustKit if you want to leverage SSL pinning.