apple-crates

@@ -5,6 +5,9 @@ request that returns a device certificate. The subsequent APS handshake over

 TLS returns a push token. Neither step needs an Apple account or anisette.

 ```rust,ignore

+let client = reqwest::Client::builder()

+    .tls_certs_merge([reqwest::Certificate::from_der(aps::APPLE_ROOT_CA)?])

+    .build()?;

 let identity = aps::activate(&client, &device, &signer).await?;

 let mut connection = aps::PushConnection::connect(&client, identity).await?;

@@ -66,6 +69,9 @@ payloads stay as bytes, allowing AuthKit and future iMessage consumers to decode

 them independently. IDS registration and iMessage-specific operations are not

 part of this crate.

+The HTTPS client also needs this root for `init.push.apple.com`, as shown above.

+It is not included in every operating system's default trust store.

+

 ## Standalone Windows signing identity

 `WindowsActivationSigner::new()` selects one of ten embedded activation signing

@@ -46,6 +46,7 @@ async fn main() -> Result<(), ExampleError> {

     }

     let state_path = PathBuf::from(&args[0]);

     let client = reqwest::Client::builder()

+        .tls_certs_merge([reqwest::Certificate::from_der(aps::APPLE_ROOT_CA)?])

         .timeout(Duration::from_secs(30))

         .build()?;

     let mut connection = match fs::read(&state_path) {

@@ -283,9 +283,7 @@ async fn handshake(

     let target = format!("{}-{host}", 1 + u64::from(OsRng.next_u32()) % count);

     let server_name = ServerName::try_from(verified.to_owned())?;

     let mut roots = RootCertStore::empty();

-    roots.add(CertificateDer::from_slice(include_bytes!(

-        "../certs/AppleRootCA.der"

-    )))?;

+    roots.add(CertificateDer::from_slice(crate::APPLE_ROOT_CA))?;

     let mut config = ClientConfig::builder_with_provider(Arc::new(ring::default_provider()))

         .with_safe_default_protocol_versions()?

         .with_root_certificates(roots)

@@ -15,3 +15,7 @@ pub use activation::{

 pub use connection::{ConnectError, Notification, PushConnection, PushToken};

 pub use protocol::CourierError;

 pub use windows_signer::WindowsActivationSigner;

+

+/// DER-encoded Apple root needed by the push configuration HTTPS endpoint.

+/// Add it to the HTTP client's trust store before connecting.

+pub const APPLE_ROOT_CA: &[u8] = include_bytes!("../certs/AppleRootCA.der");

@@ -7,7 +7,7 @@ use base64::Engine;

 use base64::prelude::BASE64_STANDARD;

 use chrono::{Local, SecondsFormat};

 use plist::{Dictionary, Value};

-use reqwest::{Method, RequestBuilder};

+use reqwest::{Method, RequestBuilder, StatusCode};

 use serde::{Deserialize, Serialize};

 use thiserror::Error;

@@ -55,8 +55,8 @@ pub enum PostDataError {

     Network(#[from] reqwest::Error),

     #[error("Failed to perform the request! {0}")]

     Anisette(#[from] ADIError),

-    #[error("Failed to perform the request! {0}")]

-    Apple(#[from] AppleError),

+    #[error("Check-in returned HTTP {0}")]

+    HttpStatus(StatusCode),

     #[error("Invalid URL bag.")]

     InvalidURLBag,

 }

@@ -198,6 +198,7 @@ impl<'lt, 'adi> HeartbeatHTTPSession<'lt, 'adi> {

         Ok(dict)

     }

+    /// Check-in succeeds on HTTP 200; AuthKitWin does not interpret its response body.

     pub async fn post_data(&self, device_data: DeviceData) -> Result<(), PostDataError> {

         let post_data = plist::to_value(&device_data).map_err(PostDataError::Serialization)?;

         let post_data_url = self

@@ -210,19 +211,19 @@ impl<'lt, 'adi> HeartbeatHTTPSession<'lt, 'adi> {

         let mut request = Dictionary::new();

         request.insert("Request".into(), post_data);

+        request.insert("Header".into(), Dictionary::new().into());

         let response = self

             .heartbeat_request_builder(Method::POST, post_data_url)?

             .header("Content-Type", "text/x-xml-plist")

             .body(plist_to_body(request.into()))

             .send()

-            .await?

-            .bytes()

             .await?;

-        let status: Dictionary =

-            plist::from_bytes(&response).map_err(PostDataError::Serialization)?;

-

-        parse_status(&status).map_err(PostDataError::Apple)

+        if response.status() != StatusCode::OK {

+            Err(PostDataError::HttpStatus(response.status()))

+        } else {

+            Ok(())

+        }

     }

 }