AltStore 2.0b2 - Permissions Granted! (Patreon)

Hi Patrons!

AltStore 2.0b2 is now available with some big security updates, including a brand new “Permissions” section on app store pages that list all of an app’s permissions. You can view more information about each permission by tapping them. If you try to download an app with permissions not listed in the source, AltStore will show a warning alert with all the undeclared permissions and ask if you’d like to install it anyway.

And for developers, AltStore now supports providing build numbers in the source, which allows distributing multiple builds of an app with the same “version”. Additionally, you can now include the SHA-256 hash of an app in your source, and AltStore will verify the downloaded .ipa matches to ensure users are installing the exact build you uploaded.

Plus, this update includes a major fix for updating certain “tweaked” apps like uYou+ due to a bug with removing app extensions. You should now be able to update these apps without hanging on installation, but please let us know if you’re still having trouble.

Until next time!

Riley + Shane

Release Notes

New

Detailed App Permissions

• View all entitlements and privacy permissions for an app from its store page
• Tap any permission to view a detailed description
• Automatically verifies permissions are accurate before installing
• Temporarily allows bypassing warning alert while sources are in beta

Sources

• Supports remote blocking malicious sources
• `buildVersion` parameter allows distributing multiple builds with same app version
• `sha256` parameter lets AltStore verify downloaded .ipa's have the correct SHA-256 hash
• `appPermissions` parameter declares all permissions used by an app and its extensions

Improved

App Verification

• Verifies downloaded app version matches source
• Verifies downloaded app build version matches source
• Verifies downloaded app’s permissions match source
• Verifies downloaded .ipa matches SHA-256 hash (if provided)

Source Verification

• Verifies source's identifier doesn't change after refreshing
• Verifies source’s identifier doesn’t match existing sources when adding
• Verifies all privacy permissions have a valid `usageDescription`

Fixed

• Fixed updating apps with manually-removed app extensions (e.g. uYou+)
• Fixed showing “Update” button on app store page when no supported update is available
• Fixed "More" button appearing by accident if text height exactly equals collapsed height
• Fixed various memory leaks on "Sources" screens
• Fixed erroneously showing “Unsupported Updates Available” message
• Fixed “Core Data error” if error occurs while parsing Source JSON
• Fixed incorrectly handling various cancelled operations
• Fixed resigning apps with entitlements the original app doesn’t have
• Fixed crash when adding source with the same name as another source
• Fixed resigning apps with entitlements the original app doesn’t have
• Fixed resigning apps without required entitlements
• Fixed resigning apps with wildcard `keychain-access-groups` entitlement

Installation Instructions

If you’re already using the AltStore beta, you can update to this version from the My Apps tab.

If you're installing the beta for the first time, make sure to first link your Patreon account in the Settings tab by following these instructions: https://faq.altstore.io/patreon/altstore-beta