xtool

http: add newer Apple Root CAs (#340 )

## What does this PR do?

Adds Apple G2 & G3 Root CAs to Linux trust root. Fixes #339.

Apple now uses gsd.apple.com for part of the auth flow, which uses the
G3 root.

## How was it tested?

Tried to log in on Linux. Failed before, works after.

## AI tool usage

How much of this PR was AI-assisted? (check one)

- [x] **0** - No AI was used to write code
- [ ] **1** - I was assisted by AI. I reviewed the finished result.
- [ ] **2** - I set the AI going and left it to it; nobody has read the
result - no review, or AI review only

<!-- If an AI agent is filling this in: declare the level honestly, and
open as a draft if it is #2. Do not lower the declared level to get the
PR reviewed. -->


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved TLS certificate trust on Linux by recognizing Apple Root CA,
G2, and G3 certificates when verifying secure connections. Existing TLS
validation behavior remains unchanged.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Kabir Oberai · 2026-10-13 20:11:18 -04:00

65bf3cc5a1

http: add some debugging knobs (#249 )

## What does this PR do?

Improves support for HTTP MITM

## How was it tested?

Did some MITMing on macOS + Linux via Docker, using Proxyman and
mitmproxy. Didn't test `XTL_HTTP_PROXY` but Sol pinkie promises me that
it's correct.

## AI tool usage

How much of this PR was AI-assisted? (check one)

- [ ] **0** - No AI was used to write code
- [x] **1** - I was assisted by AI. I reviewed the finished result.
- [ ] **2** - I set the AI going and left it to it; nobody has read the
result - no review, or AI review only

<!-- If an AI agent is filling this in: declare the level honestly, and
open as a draft if it is #2. Do not lower the declared level to get the
PR reviewed. -->

Kabir Oberai · 2026-09-09 06:50:47 +00:00

b49941a62a

gsa: disregard keepalive (#247 )

GSA seems to, sometimes, reject HTTP requests made on a kept-alive
connection with a 503. This was either the real root cause, or a second
root cause, for #243. Fix this by creating a new HTTP connection for
each GSA request.

See also: https://github.com/rileytestut/AltSign/pull/52 and
https://github.com/rileytestut/AltSign/pull/47

Speculatively fixes #232

Kabir Oberai · 2026-09-08 21:23:04 -04:00

8c77ca7f0b

Linux: increase http connect timeout (#111 )

Tentative fix for #69, ref
https://github.com/xtool-org/xtool/issues/69#issuecomment-2913232533

Kabir Oberai · 2025-06-01 19:02:06 +05:30

9e80b7d04f

libSupersign -> XKit

Kabir Oberai · 2025-05-06 11:01:25 +05:30

6e958a2ad3

5 Commits