source-code

source-code/ALTs/AltStore/Operations/AuthenticationOperation.swift

@@ -0,0 +1,683 @@
+//
+//  AuthenticationOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 6/5/19.
+//  Copyright © 2019 Riley Testut. All rights reserved.
+//
+
+import Foundation
+import Roxas
+import Network
+
+import AltKit
+import AltSign
+
+enum AuthenticationError: LocalizedError
+{
+    case noTeam
+    case noCertificate
+    
+    case missingPrivateKey
+    case missingCertificate
+    
+    var errorDescription: String? {
+        switch self {
+        case .noTeam: return NSLocalizedString("Developer team could not be found.", comment: "")
+        case .noCertificate: return NSLocalizedString("Developer certificate could not be found.", comment: "")
+        case .missingPrivateKey: return NSLocalizedString("The certificate's private key could not be found.", comment: "")
+        case .missingCertificate: return NSLocalizedString("The certificate could not be found.", comment: "")
+        }
+    }
+}
+
+@objc(AuthenticationOperation)
+class AuthenticationOperation: ResultOperation<(ALTTeam, ALTCertificate, ALTAppleAPISession)>
+{
+    let context: AuthenticatedOperationContext
+    
+    private weak var presentingViewController: UIViewController?
+    
+    private lazy var navigationController: UINavigationController = {
+        let navigationController = self.storyboard.instantiateViewController(withIdentifier: "navigationController") as! UINavigationController
+        if #available(iOS 13.0, *)
+        {
+            navigationController.isModalInPresentation = true
+        }
+        return navigationController
+    }()
+    
+    private lazy var storyboard = UIStoryboard(name: "Authentication", bundle: nil)
+    
+    private var appleIDPassword: String?
+    private var shouldShowInstructions = false
+    
+    private let operationQueue = OperationQueue()
+    
+    private var submitCodeAction: UIAlertAction?
+    
+    init(context: AuthenticatedOperationContext, presentingViewController: UIViewController?)
+    {
+        self.context = context
+        self.presentingViewController = presentingViewController
+        
+        super.init()
+        
+        self.context.authenticationOperation = self
+        self.operationQueue.name = "com.altstore.AuthenticationOperation"
+        self.progress.totalUnitCount = 4
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        if let error = self.context.error
+        {
+            self.finish(.failure(error))
+            return
+        }
+                
+        // Sign In
+        self.signIn() { (result) in
+            guard !self.isCancelled else { return self.finish(.failure(OperationError.cancelled)) }
+            
+            switch result
+            {
+            case .failure(let error): self.finish(.failure(error))
+            case .success((let account, let session)):
+                self.context.session = session
+                self.progress.completedUnitCount += 1
+                
+                // Fetch Team
+                self.fetchTeam(for: account, session: session) { (result) in
+                    guard !self.isCancelled else { return self.finish(.failure(OperationError.cancelled)) }
+                    
+                    switch result
+                    {
+                    case .failure(let error): self.finish(.failure(error))
+                    case .success(let team):
+                        self.context.team = team
+                        self.progress.completedUnitCount += 1
+                        
+                        // Fetch Certificate
+                        self.fetchCertificate(for: team, session: session) { (result) in
+                            guard !self.isCancelled else { return self.finish(.failure(OperationError.cancelled)) }
+                            
+                            switch result
+                            {
+                            case .failure(let error): self.finish(.failure(error))
+                            case .success(let certificate):
+                                self.context.certificate = certificate
+                                self.progress.completedUnitCount += 1
+                                       
+                                // Register Device
+                                self.registerCurrentDevice(for: team, session: session) { (result) in
+                                    guard !self.isCancelled else { return self.finish(.failure(OperationError.cancelled)) }
+                                    
+                                    switch result
+                                    {
+                                    case .failure(let error): self.finish(.failure(error))
+                                    case .success:
+                                        self.progress.completedUnitCount += 1
+                                        
+                                        // Save account/team to disk.
+                                        self.save(team) { (result) in
+                                            guard !self.isCancelled else { return self.finish(.failure(OperationError.cancelled)) }
+                                            
+                                            switch result
+                                            {
+                                            case .failure(let error): self.finish(.failure(error))
+                                            case .success:
+                                                // Must cache App IDs _after_ saving account/team to disk.
+                                                self.cacheAppIDs(team: team, session: session) { (result) in
+                                                    let result = result.map { _ in (team, certificate, session) }
+                                                    self.finish(result)
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    
+    func save(_ altTeam: ALTTeam, completionHandler: @escaping (Result<Void, Error>) -> Void)
+    {
+        let context = DatabaseManager.shared.persistentContainer.newBackgroundContext()
+        context.performAndWait {
+            do
+            {
+                let account: Account
+                let team: Team
+                
+                if let tempAccount = Account.first(satisfying: NSPredicate(format: "%K == %@", #keyPath(Account.identifier), altTeam.account.identifier), in: context)
+                {
+                    account = tempAccount
+                }
+                else
+                {
+                    account = Account(altTeam.account, context: context)
+                }
+                
+                if let tempTeam = Team.first(satisfying: NSPredicate(format: "%K == %@", #keyPath(Team.identifier), altTeam.identifier), in: context)
+                {
+                    team = tempTeam
+                }
+                else
+                {
+                    team = Team(altTeam, account: account, context: context)
+                }
+                
+                account.update(account: altTeam.account)
+                team.update(team: altTeam)
+                                
+                try context.save()
+                
+                completionHandler(.success(()))
+            }
+            catch
+            {
+                completionHandler(.failure(error))
+            }
+        }
+    }
+    
+    override func finish(_ result: Result<(ALTTeam, ALTCertificate, ALTAppleAPISession), Error>)
+    {
+        guard !self.isFinished else { return }
+        
+        print("Finished authenticating with result:", result.error?.localizedDescription ?? "success")
+        
+        let context = DatabaseManager.shared.persistentContainer.newBackgroundContext()
+        context.perform {
+            do
+            {
+                let (altTeam, altCertificate, session) = try result.get()
+                
+                guard
+                    let account = Account.first(satisfying: NSPredicate(format: "%K == %@", #keyPath(Account.identifier), altTeam.account.identifier), in: context),
+                    let team = Team.first(satisfying: NSPredicate(format: "%K == %@", #keyPath(Team.identifier), altTeam.identifier), in: context)
+                else { throw AuthenticationError.noTeam }
+                
+                // Account
+                account.isActiveAccount = true
+                
+                let otherAccountsFetchRequest = Account.fetchRequest() as NSFetchRequest<Account>
+                otherAccountsFetchRequest.predicate = NSPredicate(format: "%K != %@", #keyPath(Account.identifier), account.identifier)
+                
+                let otherAccounts = try context.fetch(otherAccountsFetchRequest)
+                for account in otherAccounts
+                {
+                    account.isActiveAccount = false
+                }
+                
+                // Team
+                team.isActiveTeam = true
+                
+                let otherTeamsFetchRequest = Team.fetchRequest() as NSFetchRequest<Team>
+                otherTeamsFetchRequest.predicate = NSPredicate(format: "%K != %@", #keyPath(Team.identifier), team.identifier)
+                
+                let otherTeams = try context.fetch(otherTeamsFetchRequest)
+                for team in otherTeams
+                {
+                    team.isActiveTeam = false
+                }
+                
+                let activeAppsMinimumVersion = OperatingSystemVersion(majorVersion: 13, minorVersion: 3, patchVersion: 1)
+                if team.type == .free, ProcessInfo.processInfo.isOperatingSystemAtLeast(activeAppsMinimumVersion)
+                {
+                    UserDefaults.standard.activeAppsLimit = ALTActiveAppsLimit
+                }
+                else
+                {
+                    UserDefaults.standard.activeAppsLimit = nil
+                }
+                
+                // Save
+                try context.save()
+                
+                // Update keychain
+                Keychain.shared.appleIDEmailAddress = altTeam.account.appleID
+                Keychain.shared.appleIDPassword = self.appleIDPassword
+                
+                Keychain.shared.signingCertificate = altCertificate.p12Data()
+                Keychain.shared.signingCertificatePassword = altCertificate.machineIdentifier
+                
+                self.showInstructionsIfNecessary() { (didShowInstructions) in
+                    
+                    let signer = ALTSigner(team: altTeam, certificate: altCertificate)
+                    // Refresh screen must go last since a successful refresh will cause the app to quit.
+                    self.showRefreshScreenIfNecessary(signer: signer, session: session) { (didShowRefreshAlert) in
+                        super.finish(result)
+                        
+                        DispatchQueue.main.async {
+                            self.navigationController.dismiss(animated: true, completion: nil)
+                        }
+                    }
+                }
+            }
+            catch
+            {
+                super.finish(result)
+                
+                DispatchQueue.main.async {
+                    self.navigationController.dismiss(animated: true, completion: nil)
+                }
+            }
+        }
+    }
+}
+
+private extension AuthenticationOperation
+{
+    func present(_ viewController: UIViewController) -> Bool
+    {
+        guard let presentingViewController = self.presentingViewController else { return false }
+        
+        self.navigationController.view.tintColor = .white
+        
+        if self.navigationController.viewControllers.isEmpty
+        {
+            guard presentingViewController.presentedViewController == nil else { return false }
+            
+            self.navigationController.setViewControllers([viewController], animated: false)            
+            presentingViewController.present(self.navigationController, animated: true, completion: nil)
+        }
+        else
+        {
+            viewController.navigationItem.leftBarButtonItem = nil
+            self.navigationController.pushViewController(viewController, animated: true)
+        }
+        
+        return true
+    }
+}
+
+private extension AuthenticationOperation
+{
+    func signIn(completionHandler: @escaping (Result<(ALTAccount, ALTAppleAPISession), Swift.Error>) -> Void)
+    {
+        func authenticate()
+        {
+            DispatchQueue.main.async {
+                let authenticationViewController = self.storyboard.instantiateViewController(withIdentifier: "authenticationViewController") as! AuthenticationViewController
+                authenticationViewController.authenticationHandler = { (appleID, password, completionHandler) in
+                    self.authenticate(appleID: appleID, password: password) { (result) in
+                        completionHandler(result)
+                    }
+                }
+                authenticationViewController.completionHandler = { (result) in
+                    if let (account, session, password) = result
+                    {
+                        // We presented the Auth UI and the user signed in.
+                        // In this case, we'll assume we should show the instructions again.
+                        self.shouldShowInstructions = true
+                        
+                        self.appleIDPassword = password
+                        completionHandler(.success((account, session)))
+                    }
+                    else
+                    {
+                        completionHandler(.failure(OperationError.cancelled))
+                    }
+                }
+                
+                if !self.present(authenticationViewController)
+                {
+                    completionHandler(.failure(OperationError.notAuthenticated))
+                }
+            }
+        }
+        
+        if let appleID = Keychain.shared.appleIDEmailAddress, let password = Keychain.shared.appleIDPassword
+        {
+            self.authenticate(appleID: appleID, password: password) { (result) in
+                switch result
+                {
+                case .success((let account, let session)):
+                    self.appleIDPassword = password
+                    completionHandler(.success((account, session)))
+                    
+                case .failure(ALTAppleAPIError.incorrectCredentials), .failure(ALTAppleAPIError.appSpecificPasswordRequired):
+                    authenticate()
+                    
+                case .failure(let error):
+                    completionHandler(.failure(error))
+                }
+            }
+        }
+        else
+        {
+            authenticate()
+        }
+    }
+    
+    func authenticate(appleID: String, password: String, completionHandler: @escaping (Result<(ALTAccount, ALTAppleAPISession), Swift.Error>) -> Void)
+    {
+        let fetchAnisetteDataOperation = FetchAnisetteDataOperation(context: self.context)
+        fetchAnisetteDataOperation.resultHandler = { (result) in
+            switch result
+            {
+            case .failure(let error): completionHandler(.failure(error))
+            case .success(let anisetteData):
+                let verificationHandler: ((@escaping (String?) -> Void) -> Void)?
+                
+                if let presentingViewController = self.presentingViewController
+                {
+                    verificationHandler = { (completionHandler) in
+                        DispatchQueue.main.async {
+                            let alertController = UIAlertController(title: NSLocalizedString("Please enter the 6-digit verification code that was sent to your Apple devices.", comment: ""), message: nil, preferredStyle: .alert)
+                            alertController.addTextField { (textField) in
+                                textField.autocorrectionType = .no
+                                textField.autocapitalizationType = .none
+                                textField.keyboardType = .numberPad
+                                
+                                NotificationCenter.default.addObserver(self, selector: #selector(AuthenticationOperation.textFieldTextDidChange(_:)), name: UITextField.textDidChangeNotification, object: textField)
+                            }
+                            
+                            let submitAction = UIAlertAction(title: NSLocalizedString("Continue", comment: ""), style: .default) { (action) in
+                                let textField = alertController.textFields?.first
+                                
+                                let code = textField?.text ?? ""
+                                completionHandler(code)
+                            }
+                            submitAction.isEnabled = false
+                            alertController.addAction(submitAction)
+                            self.submitCodeAction = submitAction
+                            
+                            alertController.addAction(UIAlertAction(title: RSTSystemLocalizedString("Cancel"), style: .cancel) { (action) in
+                                completionHandler(nil)
+                            })
+                            
+                            if self.navigationController.presentingViewController != nil
+                            {
+                                self.navigationController.present(alertController, animated: true, completion: nil)
+                            }
+                            else
+                            {
+                                presentingViewController.present(alertController, animated: true, completion: nil)
+                            }
+                        }
+                    }
+                }
+                else
+                {
+                    // No view controller to present security code alert, so don't provide verificationHandler.
+                    verificationHandler = nil
+                }
+                    
+                ALTAppleAPI.shared.authenticate(appleID: appleID, password: password, anisetteData: anisetteData,
+                                                verificationHandler: verificationHandler) { (account, session, error) in
+                    if let account = account, let session = session
+                    {
+                        completionHandler(.success((account, session)))
+                    }
+                    else
+                    {
+                        completionHandler(.failure(error ?? OperationError.unknown))
+                    }
+                }
+            }
+        }
+        
+        self.operationQueue.addOperation(fetchAnisetteDataOperation)
+    }
+    
+    func fetchTeam(for account: ALTAccount, session: ALTAppleAPISession, completionHandler: @escaping (Result<ALTTeam, Swift.Error>) -> Void)
+    {
+        func selectTeam(from teams: [ALTTeam])
+        {
+            if let team = teams.first(where: { $0.type == .free })
+            {
+                return completionHandler(.success(team))
+            }
+            else if let team = teams.first(where: { $0.type == .individual })
+            {
+                return completionHandler(.success(team))
+            }
+            else if let team = teams.first
+            {
+                return completionHandler(.success(team))
+            }
+            else
+            {
+                return completionHandler(.failure(AuthenticationError.noTeam))
+            }
+        }
+
+        ALTAppleAPI.shared.fetchTeams(for: account, session: session) { (teams, error) in
+            switch Result(teams, error)
+            {
+            case .failure(let error): completionHandler(.failure(error))
+            case .success(let teams):
+                DatabaseManager.shared.persistentContainer.performBackgroundTask { (context) in
+                    if let activeTeam = DatabaseManager.shared.activeTeam(in: context), let altTeam = teams.first(where: { $0.identifier == activeTeam.identifier })
+                    {
+                        completionHandler(.success(altTeam))
+                    }
+                    else
+                    {
+                        selectTeam(from: teams)
+                    }
+                }
+            }
+        }
+    }
+    
+    func fetchCertificate(for team: ALTTeam, session: ALTAppleAPISession, completionHandler: @escaping (Result<ALTCertificate, Swift.Error>) -> Void)
+    {
+        func requestCertificate()
+        {
+            let machineName = "AltStore - " + UIDevice.current.name
+            ALTAppleAPI.shared.addCertificate(machineName: machineName, to: team, session: session) { (certificate, error) in
+                do
+                {
+                    let certificate = try Result(certificate, error).get()
+                    guard let privateKey = certificate.privateKey else { throw AuthenticationError.missingPrivateKey }
+                    
+                    ALTAppleAPI.shared.fetchCertificates(for: team, session: session) { (certificates, error) in
+                        do
+                        {
+                            let certificates = try Result(certificates, error).get()
+                            
+                            guard let certificate = certificates.first(where: { $0.serialNumber == certificate.serialNumber }) else {
+                                throw AuthenticationError.missingCertificate
+                            }
+                            
+                            certificate.privateKey = privateKey
+                            completionHandler(.success(certificate))
+                        }
+                        catch
+                        {
+                            completionHandler(.failure(error))
+                        }
+                    }
+                }
+                catch
+                {
+                    completionHandler(.failure(error))
+                }
+            }
+        }
+        
+        func replaceCertificate(from certificates: [ALTCertificate])
+        {
+            guard let certificate = certificates.first else { return completionHandler(.failure(AuthenticationError.noCertificate)) }
+            
+            ALTAppleAPI.shared.revoke(certificate, for: team, session: session) { (success, error) in
+                if let error = error, !success
+                {
+                    completionHandler(.failure(error))
+                }
+                else
+                {
+                    requestCertificate()
+                }
+            }
+        }
+        
+        ALTAppleAPI.shared.fetchCertificates(for: team, session: session) { (certificates, error) in
+            do
+            {
+                let certificates = try Result(certificates, error).get()
+                
+                if
+                    let data = Keychain.shared.signingCertificate,
+                    let localCertificate = ALTCertificate(p12Data: data, password: nil),
+                    let certificate = certificates.first(where: { $0.serialNumber == localCertificate.serialNumber })
+                {
+                    // We have a certificate stored in the keychain and it hasn't been revoked.
+                    localCertificate.machineIdentifier = certificate.machineIdentifier
+                    completionHandler(.success(localCertificate))
+                }
+                else if
+                    let serialNumber = Keychain.shared.signingCertificateSerialNumber,
+                    let privateKey = Keychain.shared.signingCertificatePrivateKey,
+                    let certificate = certificates.first(where: { $0.serialNumber == serialNumber })
+                {
+                    // LEGACY
+                    // We have the private key for one of the certificates, so add it to certificate and use it.
+                    certificate.privateKey = privateKey
+                    completionHandler(.success(certificate))
+                }
+                else if
+                    let serialNumber = Bundle.main.object(forInfoDictionaryKey: Bundle.Info.certificateID) as? String,
+                    let certificate = certificates.first(where: { $0.serialNumber == serialNumber }),
+                    let machineIdentifier = certificate.machineIdentifier,
+                    FileManager.default.fileExists(atPath: Bundle.main.certificateURL.path),
+                    let data = try? Data(contentsOf: Bundle.main.certificateURL),
+                    let localCertificate = ALTCertificate(p12Data: data, password: machineIdentifier)
+                {
+                    // We have an embedded certificate that hasn't been revoked.
+                    localCertificate.machineIdentifier = machineIdentifier
+                    completionHandler(.success(localCertificate))
+                }
+                else if certificates.isEmpty
+                {
+                    // No certificates, so request a new one.
+                    requestCertificate()
+                }
+                else
+                {
+                    // We don't have private keys for any of the certificates,
+                    // so we need to revoke one and create a new one.
+                    replaceCertificate(from: certificates)
+                }
+            }
+            catch
+            {
+                completionHandler(.failure(error))
+            }
+        }
+    }
+    
+    func registerCurrentDevice(for team: ALTTeam, session: ALTAppleAPISession, completionHandler: @escaping (Result<ALTDevice, Error>) -> Void)
+    {
+        guard let udid = Bundle.main.object(forInfoDictionaryKey: Bundle.Info.deviceID) as? String else {
+            return completionHandler(.failure(OperationError.unknownUDID))
+        }
+        
+        ALTAppleAPI.shared.fetchDevices(for: team, session: session) { (devices, error) in
+            do
+            {
+                let devices = try Result(devices, error).get()
+                
+                if let device = devices.first(where: { $0.identifier == udid })
+                {
+                    completionHandler(.success(device))
+                }
+                else
+                {
+                    ALTAppleAPI.shared.registerDevice(name: UIDevice.current.name, identifier: udid, team: team, session: session) { (device, error) in
+                        completionHandler(Result(device, error))
+                    }
+                }
+            }
+            catch
+            {
+                completionHandler(.failure(error))
+            }
+        }
+    }
+    
+    func cacheAppIDs(team: ALTTeam, session: ALTAppleAPISession, completionHandler: @escaping (Result<Void, Error>) -> Void)
+    {
+        let fetchAppIDsOperation = FetchAppIDsOperation(context: self.context)
+        fetchAppIDsOperation.resultHandler = { (result) in
+            do
+            {
+                let (_, context) = try result.get()
+                try context.save()
+                
+                completionHandler(.success(()))
+            }
+            catch
+            {
+                completionHandler(.failure(error))
+            }
+        }
+        
+        self.operationQueue.addOperation(fetchAppIDsOperation)
+    }
+    
+    func showInstructionsIfNecessary(completionHandler: @escaping (Bool) -> Void)
+    {
+        guard self.shouldShowInstructions else { return completionHandler(false) }
+        
+        DispatchQueue.main.async {
+            let instructionsViewController = self.storyboard.instantiateViewController(withIdentifier: "instructionsViewController") as! InstructionsViewController
+            instructionsViewController.showsBottomButton = true
+            instructionsViewController.completionHandler = {
+                completionHandler(true)
+            }
+            
+            if !self.present(instructionsViewController)
+            {
+                completionHandler(false)
+            }
+        }
+    }
+    
+    func showRefreshScreenIfNecessary(signer: ALTSigner, session: ALTAppleAPISession, completionHandler: @escaping (Bool) -> Void)
+    {
+        guard let application = ALTApplication(fileURL: Bundle.main.bundleURL), let provisioningProfile = application.provisioningProfile else { return completionHandler(false) }
+        
+        // If we're not using the same certificate used to install AltStore, warn user that they need to refresh.
+        guard !provisioningProfile.certificates.contains(signer.certificate) else { return completionHandler(false) }
+        
+#if DEBUG
+        completionHandler(false)
+#else
+        DispatchQueue.main.async {
+            let context = AuthenticatedOperationContext(context: self.context)
+            context.operations.removeAllObjects() // Prevent deadlock due to endless waiting on previous operations to finish.
+            
+            let refreshViewController = self.storyboard.instantiateViewController(withIdentifier: "refreshAltStoreViewController") as! RefreshAltStoreViewController
+            refreshViewController.context = context
+            refreshViewController.completionHandler = { _ in
+                completionHandler(true)
+            }
+            
+            if !self.present(refreshViewController)
+            {
+                completionHandler(false)
+            }
+        }
+#endif
+    }
+}
+
+extension AuthenticationOperation
+{
+    @objc func textFieldTextDidChange(_ notification: Notification)
+    {
+        guard let textField = notification.object as? UITextField else { return }
+        
+        self.submitCodeAction?.isEnabled = (textField.text ?? "").count == 6
+    }
+}

source-code/ALTs/AltStore/Operations/BackupAppOperation.swift

@@ -0,0 +1,183 @@
+//
+//  BackupAppOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 5/12/20.
+//  Copyright © 2020 Riley Testut. All rights reserved.
+//
+
+import Foundation
+
+import AltKit
+import AltSign
+
+extension BackupAppOperation
+{
+    enum Action: String
+    {
+        case backup
+        case restore
+    }
+}
+
+@objc(BackupAppOperation)
+class BackupAppOperation: ResultOperation<Void>
+{
+    let action: Action
+    let context: InstallAppOperationContext
+    
+    private var appName: String?
+    private var timeoutTimer: Timer?
+    
+    init(action: Action, context: InstallAppOperationContext)
+    {
+        self.action = action
+        self.context = context
+        
+        super.init()
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        do
+        {
+            if let error = self.context.error
+            {
+                throw error
+            }
+            
+            guard let installedApp = self.context.installedApp, let context = installedApp.managedObjectContext else { throw OperationError.invalidParameters }
+            context.perform {
+                do
+                {
+                    let appName = installedApp.name
+                    self.appName = appName
+                    
+                    guard let altstoreApp = InstalledApp.fetchAltStore(in: context) else { throw OperationError.appNotFound }
+                    let altstoreOpenURL = altstoreApp.openAppURL
+                    
+                    var returnURLComponents = URLComponents(url: altstoreOpenURL, resolvingAgainstBaseURL: false)
+                    returnURLComponents?.host = "appBackupResponse"
+                    guard let returnURL = returnURLComponents?.url else { throw OperationError.openAppFailed(name: appName) }
+                    
+                    var openURLComponents = URLComponents()
+                    openURLComponents.scheme = installedApp.openAppURL.scheme
+                    openURLComponents.host = self.action.rawValue
+                    openURLComponents.queryItems = [URLQueryItem(name: "returnURL", value: returnURL.absoluteString)]
+                    
+                    guard let openURL = openURLComponents.url else { throw OperationError.openAppFailed(name: appName) }
+                    
+                    DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
+                        let currentTime = CFAbsoluteTimeGetCurrent()
+                        
+                        UIApplication.shared.open(openURL, options: [:]) { (success) in
+                            let elapsedTime = CFAbsoluteTimeGetCurrent() - currentTime
+                            
+                            if success
+                            {
+                                self.registerObservers()
+                            }
+                            else if elapsedTime < 0.5
+                            {
+                                // Failed too quickly for human to respond to alert, possibly still finalizing installation.
+                                // Try again in a couple seconds.
+                                
+                                print("Failed too quickly, retrying after a few seconds...")
+                                
+                                DispatchQueue.main.asyncAfter(deadline: .now() + 2.0) {
+                                    UIApplication.shared.open(openURL, options: [:]) { (success) in
+                                        if success
+                                        {
+                                            self.registerObservers()
+                                        }
+                                        else
+                                        {
+                                            self.finish(.failure(OperationError.openAppFailed(name: appName)))
+                                        }
+                                    }
+                                }
+                            }
+                            else
+                            {
+                                self.finish(.failure(OperationError.openAppFailed(name: appName)))
+                            }
+                        }
+                    }
+                }
+                catch
+                {
+                    self.finish(.failure(error))
+                }
+            }
+        }
+        catch
+        {
+            self.finish(.failure(error))
+        }
+    }
+    
+    override func finish(_ result: Result<Void, Error>)
+    {
+        let result = result.mapError { (error) -> Error in
+            let appName = self.appName ?? self.context.bundleIdentifier
+            
+            switch (error, self.action)
+            {
+            case (let error as NSError, _) where (self.context.error as NSError?) == error: fallthrough
+            case (OperationError.cancelled, _):
+                return error
+                
+            case (let error as NSError, .backup):
+                let localizedFailure = String(format: NSLocalizedString("Could not back up “%@”.", comment: ""), appName)
+                return error.withLocalizedFailure(localizedFailure)
+                
+            case (let error as NSError, .restore):
+                let localizedFailure = String(format: NSLocalizedString("Could not restore “%@”.", comment: ""), appName)
+                return error.withLocalizedFailure(localizedFailure)
+            }
+        }
+        
+        switch result
+        {
+        case .success: self.progress.completedUnitCount += 1
+        case .failure: break
+        }
+        
+        super.finish(result)
+    }
+}
+
+private extension BackupAppOperation
+{
+    func registerObservers()
+    {
+        var applicationWillReturnObserver: NSObjectProtocol!
+        applicationWillReturnObserver = NotificationCenter.default.addObserver(forName: UIApplication.willEnterForegroundNotification, object: nil, queue: .main) { [weak self] (notification) in
+            guard let self = self, !self.isFinished else { return }
+            
+            self.timeoutTimer = Timer.scheduledTimer(withTimeInterval: 5, repeats: false) { [weak self] (timer) in
+                // Final delay to ensure we don't prematurely return failure
+                // in case timer expired while we were in background, but
+                // are now returning to app with success response.
+                DispatchQueue.main.asyncAfter(deadline: .now() + 1.0) {
+                    guard let self = self, !self.isFinished else { return }
+                    self.finish(.failure(OperationError.timedOut))
+                }
+            }
+            
+            NotificationCenter.default.removeObserver(applicationWillReturnObserver!)
+        }
+        
+        var backupResponseObserver: NSObjectProtocol!
+        backupResponseObserver = NotificationCenter.default.addObserver(forName: AppDelegate.appBackupDidFinish, object: nil, queue: nil) { [weak self] (notification) in
+            self?.timeoutTimer?.invalidate()
+            
+            let result = notification.userInfo?[AppDelegate.appBackupResultKey] as? Result<Void, Error> ?? .failure(OperationError.unknownResult)
+            self?.finish(result)
+            
+            NotificationCenter.default.removeObserver(backupResponseObserver!)
+        }
+    }
+}

source-code/ALTs/AltStore/Operations/DeactivateAppOperation.swift

@@ -0,0 +1,90 @@
+//
+//  DeactivateAppOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 3/4/20.
+//  Copyright © 2020 Riley Testut. All rights reserved.
+//
+
+import Foundation
+
+import AltSign
+import AltKit
+
+import Roxas
+
+@objc(DeactivateAppOperation)
+class DeactivateAppOperation: ResultOperation<InstalledApp>
+{
+    let app: InstalledApp
+    let context: OperationContext
+    
+    init(app: InstalledApp, context: OperationContext)
+    {
+        self.app = app
+        self.context = context
+        
+        super.init()
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        if let error = self.context.error
+        {
+            self.finish(.failure(error))
+            return
+        }
+        
+        guard let server = self.context.server else { return self.finish(.failure(OperationError.invalidParameters)) }
+        guard let udid = Bundle.main.object(forInfoDictionaryKey: Bundle.Info.deviceID) as? String else { return self.finish(.failure(OperationError.unknownUDID)) }
+        
+        ServerManager.shared.connect(to: server) { (result) in
+            switch result
+            {
+            case .failure(let error): self.finish(.failure(error))
+            case .success(let connection):
+                print("Sending deactivate app request...")
+                
+                DatabaseManager.shared.persistentContainer.performBackgroundTask { (context) in
+                    let installedApp = context.object(with: self.app.objectID) as! InstalledApp
+                    
+                    let appExtensionProfiles = installedApp.appExtensions.map { $0.resignedBundleIdentifier }
+                    let allIdentifiers = [installedApp.resignedBundleIdentifier] + appExtensionProfiles
+                    
+                    let request = RemoveProvisioningProfilesRequest(udid: udid, bundleIdentifiers: Set(allIdentifiers))
+                    connection.send(request) { (result) in
+                        print("Sent deactive app request!")
+                        
+                        switch result
+                        {
+                        case .failure(let error): self.finish(.failure(error))
+                        case .success:
+                            print("Waiting for deactivate app response...")
+                            connection.receiveResponse() { (result) in
+                                print("Receiving deactivate app response:", result)
+                                
+                                switch result
+                                {
+                                case .failure(let error): self.finish(.failure(error))
+                                case .success(.error(let response)): self.finish(.failure(response.error))
+                                case .success(.removeProvisioningProfiles):
+                                    DatabaseManager.shared.persistentContainer.performBackgroundTask { (context) in
+                                        self.progress.completedUnitCount += 1
+                                        
+                                        let installedApp = context.object(with: self.app.objectID) as! InstalledApp
+                                        installedApp.isActive = false
+                                        self.finish(.success(installedApp))
+                                    }
+                                    
+                                case .success: self.finish(.failure(ALTServerError(.unknownResponse)))
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

source-code/ALTs/AltStore/Operations/DownloadAppOperation.swift

@@ -0,0 +1,132 @@
+//
+//  DownloadAppOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 6/10/19.
+//  Copyright © 2019 Riley Testut. All rights reserved.
+//
+
+import Foundation
+import Roxas
+
+import AltSign
+
+@objc(DownloadAppOperation)
+class DownloadAppOperation: ResultOperation<ALTApplication>
+{
+    let app: AppProtocol
+    let context: AppOperationContext
+    
+    private let bundleIdentifier: String
+    private let sourceURL: URL
+    private let destinationURL: URL
+    
+    private let session = URLSession(configuration: .default)
+    
+    init(app: AppProtocol, destinationURL: URL, context: AppOperationContext)
+    {
+        self.app = app
+        self.context = context
+        
+        self.bundleIdentifier = app.bundleIdentifier
+        self.sourceURL = app.url
+        self.destinationURL = destinationURL
+        
+        super.init()
+        
+        self.progress.totalUnitCount = 1
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        if let error = self.context.error
+        {
+            self.finish(.failure(error))
+            return
+        }
+        
+        print("Downloading App:", self.bundleIdentifier)
+        
+        func finishOperation(_ result: Result<URL, Error>)
+        {
+            do
+            {
+                let fileURL = try result.get()
+                
+                var isDirectory: ObjCBool = false
+                guard FileManager.default.fileExists(atPath: fileURL.path, isDirectory: &isDirectory) else { throw OperationError.appNotFound }
+                
+                let temporaryDirectory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+                try FileManager.default.createDirectory(at: temporaryDirectory, withIntermediateDirectories: true, attributes: nil)
+                defer { try? FileManager.default.removeItem(at: temporaryDirectory) }
+                
+                let appBundleURL: URL
+                
+                if isDirectory.boolValue
+                {
+                    // Directory, so assuming this is .app bundle.
+                    guard Bundle(url: fileURL) != nil else { throw OperationError.invalidApp }
+                    
+                    appBundleURL = fileURL
+                }
+                else
+                {
+                    // File, so assuming this is a .ipa file.
+                    appBundleURL = try FileManager.default.unzipAppBundle(at: fileURL, toDirectory: temporaryDirectory)
+                }
+                
+                guard let application = ALTApplication(fileURL: appBundleURL) else { throw OperationError.invalidApp }
+                
+                guard ProcessInfo.processInfo.isOperatingSystemAtLeast(application.minimumiOSVersion) else { throw OperationError.iOSVersionNotSupported(application) }
+                
+                try FileManager.default.copyItem(at: appBundleURL, to: self.destinationURL, shouldReplace: true)
+                
+                if self.context.bundleIdentifier == StoreApp.dolphinAppID, self.context.bundleIdentifier != application.bundleIdentifier
+                {
+                    let infoPlistURL = self.destinationURL.appendingPathComponent("Info.plist")
+
+                    if var infoPlist = NSDictionary(contentsOf: infoPlistURL) as? [String: Any]
+                    {
+                        // Manually update the app's bundle identifier to match the one specified in the source.
+                        // This allows people who previously installed the app to still update and refresh normally.
+                        infoPlist[kCFBundleIdentifierKey as String] = StoreApp.dolphinAppID
+                        (infoPlist as NSDictionary).write(to: infoPlistURL, atomically: true)
+                    }
+                }
+                
+                guard let copiedApplication = ALTApplication(fileURL: self.destinationURL) else { throw OperationError.invalidApp }
+                self.finish(.success(copiedApplication))
+            }
+            catch
+            {
+                self.finish(.failure(error))
+            }
+        }
+        
+        if self.sourceURL.isFileURL
+        {
+            finishOperation(.success(self.sourceURL))
+            
+            self.progress.completedUnitCount += 1
+        }
+        else
+        {
+            let downloadTask = self.session.downloadTask(with: self.sourceURL) { (fileURL, response, error) in
+                do
+                {
+                    let (fileURL, _) = try Result((fileURL, response), error).get()
+                    finishOperation(.success(fileURL))
+                }
+                catch
+                {
+                    finishOperation(.failure(error))
+                }
+            }
+            self.progress.addChild(downloadTask.progress, withPendingUnitCount: 1)
+            
+            downloadTask.resume()
+        }
+    }
+}

source-code/ALTs/AltStore/Operations/FetchAnisetteDataOperation.swift

@@ -0,0 +1,71 @@
+//
+//  FetchAnisetteDataOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 1/7/20.
+//  Copyright © 2020 Riley Testut. All rights reserved.
+//
+
+import Foundation
+
+import AltSign
+import AltKit
+
+import Roxas
+
+@objc(FetchAnisetteDataOperation)
+class FetchAnisetteDataOperation: ResultOperation<ALTAnisetteData>
+{
+    let context: OperationContext
+    
+    init(context: OperationContext)
+    {
+        self.context = context
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        if let error = self.context.error
+        {
+            self.finish(.failure(error))
+            return
+        }
+        
+        guard let server = self.context.server else { return self.finish(.failure(OperationError.invalidParameters)) }
+        
+        ServerManager.shared.connect(to: server) { (result) in
+            switch result
+            {
+            case .failure(let error):
+                self.finish(.failure(error))
+            case .success(let connection):
+                print("Sending anisette data request...")
+                
+                let request = AnisetteDataRequest()
+                connection.send(request) { (result) in
+                    print("Sent anisette data request!")
+                    
+                    switch result
+                    {
+                    case .failure(let error): self.finish(.failure(error))
+                    case .success:
+                        print("Waiting for anisette data...")
+                        connection.receiveResponse() { (result) in
+                            print("Receiving anisette data:", result.error?.localizedDescription ?? "success")
+                            
+                            switch result
+                            {
+                            case .failure(let error): self.finish(.failure(error))
+                            case .success(.error(let response)): self.finish(.failure(response.error))
+                            case .success(.anisetteData(let response)): self.finish(.success(response.anisetteData))
+                            case .success: self.finish(.failure(ALTServerError(.unknownRequest)))
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

source-code/ALTs/AltStore/Operations/FetchAppIDsOperation.swift

@@ -0,0 +1,73 @@
+//
+//  FetchAppIDsOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 1/27/20.
+//  Copyright © 2020 Riley Testut. All rights reserved.
+//
+
+import Foundation
+
+import AltSign
+import AltKit
+
+import Roxas
+
+@objc(FetchAppIDsOperation)
+class FetchAppIDsOperation: ResultOperation<([AppID], NSManagedObjectContext)>
+{
+    let context: AuthenticatedOperationContext
+    let managedObjectContext: NSManagedObjectContext
+    
+    init(context: AuthenticatedOperationContext, managedObjectContext: NSManagedObjectContext = DatabaseManager.shared.persistentContainer.newBackgroundContext())
+    {
+        self.context = context
+        self.managedObjectContext = managedObjectContext
+        
+        super.init()
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        if let error = self.context.error
+        {
+            self.finish(.failure(error))
+            return
+        }
+        
+        guard
+            let team = self.context.team,
+            let session = self.context.session
+        else { return self.finish(.failure(OperationError.invalidParameters)) }
+                
+        ALTAppleAPI.shared.fetchAppIDs(for: team, session: session) { (appIDs, error) in
+            self.managedObjectContext.perform {
+                do
+                {
+                    let fetchedAppIDs = try Result(appIDs, error).get()
+                    
+                    guard let team = Team.first(satisfying: NSPredicate(format: "%K == %@", #keyPath(Team.identifier), team.identifier), in: self.managedObjectContext) else { throw OperationError.notAuthenticated }
+                    
+                    let fetchedIdentifiers = fetchedAppIDs.map { $0.identifier }
+                    
+                    let deletedAppIDsRequest = AppID.fetchRequest() as NSFetchRequest<AppID>
+                    deletedAppIDsRequest.predicate = NSPredicate(format: "%K == %@ AND NOT (%K IN %@)",
+                                                                 #keyPath(AppID.team), team,
+                                                                 #keyPath(AppID.identifier), fetchedIdentifiers)
+                    
+                    let deletedAppIDs = try self.managedObjectContext.fetch(deletedAppIDsRequest)
+                    deletedAppIDs.forEach { self.managedObjectContext.delete($0) }
+                    
+                    let appIDs = fetchedAppIDs.map { AppID($0, team: team, context: self.managedObjectContext) }
+                    self.finish(.success((appIDs, self.managedObjectContext)))
+                }
+                catch
+                {
+                    self.finish(.failure(error))
+                }
+            }
+        }
+    }
+}

source-code/ALTs/AltStore/Operations/FetchProvisioningProfilesOperation.swift

@@ -0,0 +1,485 @@
+//
+//  FetchProvisioningProfilesOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 2/27/20.
+//  Copyright © 2020 Riley Testut. All rights reserved.
+//
+
+import Foundation
+import Roxas
+
+import AltSign
+
+@objc(FetchProvisioningProfilesOperation)
+class FetchProvisioningProfilesOperation: ResultOperation<[String: ALTProvisioningProfile]>
+{
+    let context: AppOperationContext
+    
+    var additionalEntitlements: [ALTEntitlement: Any]?
+    
+    private let appGroupsLock = NSLock()
+    
+    init(context: AppOperationContext)
+    {
+        self.context = context
+        
+        super.init()
+        
+        self.progress.totalUnitCount = 1
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        if let error = self.context.error
+        {
+            self.finish(.failure(error))
+            return
+        }
+        
+        guard
+            let team = self.context.team,
+            let session = self.context.session
+        else { return self.finish(.failure(OperationError.invalidParameters)) }
+        
+        guard let app = self.context.app else { return self.finish(.failure(OperationError.appNotFound)) }
+        
+        self.progress.totalUnitCount = Int64(1 + app.appExtensions.count)
+        
+        self.prepareProvisioningProfile(for: app, parentApp: nil, team: team, session: session) { (result) in
+            do
+            {
+                self.progress.completedUnitCount += 1
+                
+                let profile = try result.get()
+                
+                var profiles = [app.bundleIdentifier: profile]
+                var error: Error?
+                
+                let dispatchGroup = DispatchGroup()
+                
+                for appExtension in app.appExtensions
+                {
+                    dispatchGroup.enter()
+                    
+                    self.prepareProvisioningProfile(for: appExtension, parentApp: app, team: team, session: session) { (result) in
+                        switch result
+                        {
+                        case .failure(let e): error = e
+                        case .success(let profile): profiles[appExtension.bundleIdentifier] = profile
+                        }
+                        
+                        dispatchGroup.leave()
+                        
+                        self.progress.completedUnitCount += 1
+                    }
+                }
+                
+                dispatchGroup.notify(queue: .global()) {
+                    if let error = error
+                    {
+                        self.finish(.failure(error))
+                    }
+                    else
+                    {
+                        self.finish(.success(profiles))
+                    }
+                }
+            }
+            catch
+            {
+                self.finish(.failure(error))
+            }
+        }
+    }
+    
+    func process<T>(_ result: Result<T, Error>) -> T?
+    {
+        switch result
+        {
+        case .failure(let error):
+            self.finish(.failure(error))
+            return nil
+            
+        case .success(let value):
+            guard !self.isCancelled else {
+                self.finish(.failure(OperationError.cancelled))
+                return nil
+            }
+            
+            return value
+        }
+    }
+}
+
+extension FetchProvisioningProfilesOperation
+{
+    func prepareProvisioningProfile(for app: ALTApplication, parentApp: ALTApplication?, team: ALTTeam, session: ALTAppleAPISession, completionHandler: @escaping (Result<ALTProvisioningProfile, Error>) -> Void)
+    {
+        DatabaseManager.shared.persistentContainer.performBackgroundTask { (context) in
+            
+            let preferredBundleID: String?
+            
+            // Check if we have already installed this app with this team before.
+            let predicate = NSPredicate(format: "%K == %@", #keyPath(InstalledApp.bundleIdentifier), app.bundleIdentifier)
+            if let installedApp = InstalledApp.first(satisfying: predicate, in: context)
+            {
+                // Teams match if installedApp.team has same identifier as team,
+                // or if installedApp.team is nil but resignedBundleIdentifier contains the team's identifier.
+                let teamsMatch = installedApp.team?.identifier == team.identifier || (installedApp.team == nil && installedApp.resignedBundleIdentifier.contains(team.identifier))
+                
+                #if DEBUG
+                
+                if app.bundleIdentifier == StoreApp.altstoreAppID || StoreApp.alternativeAltStoreAppIDs.contains(app.bundleIdentifier)
+                {
+                    // Use legacy bundle ID format for AltStore.
+                    preferredBundleID = "com.\(team.identifier).\(app.bundleIdentifier)"
+                }
+                else
+                {
+                    preferredBundleID = teamsMatch ? installedApp.resignedBundleIdentifier : nil
+                }
+                
+                #else
+                
+                if teamsMatch
+                {
+                    // This app is already installed with the same team, so use the same resigned bundle identifier as before.
+                    // This way, if we change the identifier format (again), AltStore will continue to use
+                    // the old bundle identifier to prevent it from installing as a new app.
+                    preferredBundleID = installedApp.resignedBundleIdentifier
+                }
+                else
+                {
+                    preferredBundleID = nil
+                }
+                
+                #endif
+            }
+            else
+            {
+                preferredBundleID = nil
+            }
+            
+            let bundleID: String
+            
+            if let preferredBundleID = preferredBundleID
+            {
+                bundleID = preferredBundleID
+            }
+            else
+            {
+                // This app isn't already installed, so create the resigned bundle identifier ourselves.
+                // Or, if the app _is_ installed but with a different team, we need to create a new
+                // bundle identifier anyway to prevent collisions with the previous team.
+                let parentBundleID = parentApp?.bundleIdentifier ?? app.bundleIdentifier
+                let updatedParentBundleID = parentBundleID + "." + team.identifier // Append just team identifier to make it harder to track.
+                
+                if app.bundleIdentifier == StoreApp.altstoreAppID || StoreApp.alternativeAltStoreAppIDs.contains(app.bundleIdentifier)
+                {
+                    // Use legacy bundle ID format for AltStore.
+                    bundleID = "com.\(team.identifier).\(app.bundleIdentifier)"
+                }
+                else
+                {
+                    bundleID = app.bundleIdentifier.replacingOccurrences(of: parentBundleID, with: updatedParentBundleID)
+                }
+            }
+            
+            let preferredName: String
+            
+            if let parentApp = parentApp
+            {
+                preferredName = parentApp.name + " " + app.name
+            }
+            else
+            {
+                preferredName = app.name
+            }
+            
+            // Register
+            self.registerAppID(for: app, name: preferredName, bundleIdentifier: bundleID, team: team, session: session) { (result) in
+                switch result
+                {
+                case .failure(let error): completionHandler(.failure(error))
+                case .success(let appID):
+                    
+                    // Update features
+                    self.updateFeatures(for: appID, app: app, team: team, session: session) { (result) in
+                        switch result
+                        {
+                        case .failure(let error): completionHandler(.failure(error))
+                        case .success(let appID):
+                            
+                            // Update app groups
+                            self.updateAppGroups(for: appID, app: app, team: team, session: session) { (result) in
+                                switch result
+                                {
+                                case .failure(let error): completionHandler(.failure(error))
+                                case .success(let appID):
+                                    
+                                    // Fetch Provisioning Profile
+                                    self.fetchProvisioningProfile(for: appID, team: team, session: session) { (result) in
+                                        completionHandler(result)
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    
+    func registerAppID(for application: ALTApplication, name: String, bundleIdentifier: String, team: ALTTeam, session: ALTAppleAPISession, completionHandler: @escaping (Result<ALTAppID, Error>) -> Void)
+    {
+        ALTAppleAPI.shared.fetchAppIDs(for: team, session: session) { (appIDs, error) in
+            do
+            {
+                let appIDs = try Result(appIDs, error).get()
+                
+                if let appID = appIDs.first(where: { $0.bundleIdentifier.lowercased() == bundleIdentifier.lowercased() })
+                {
+                    completionHandler(.success(appID))
+                }
+                else
+                {
+                    let requiredAppIDs = 1 + application.appExtensions.count
+                    let availableAppIDs = max(0, Team.maximumFreeAppIDs - appIDs.count)
+                    
+                    let sortedExpirationDates = appIDs.compactMap { $0.expirationDate }.sorted(by: { $0 < $1 })
+                    
+                    if team.type == .free
+                    {
+                        if requiredAppIDs > availableAppIDs
+                        {
+                            if let expirationDate = sortedExpirationDates.first
+                            {
+                                throw OperationError.maximumAppIDLimitReached(application: application, requiredAppIDs: requiredAppIDs, availableAppIDs: availableAppIDs, nextExpirationDate: expirationDate)
+                            }
+                            else
+                            {
+                                throw ALTAppleAPIError(.maximumAppIDLimitReached)
+                            }
+                        }
+                    }
+                    
+                    ALTAppleAPI.shared.addAppID(withName: name, bundleIdentifier: bundleIdentifier, team: team, session: session) { (appID, error) in
+                        do
+                        {
+                            do
+                            {
+                                let appID = try Result(appID, error).get()
+                                completionHandler(.success(appID))
+                            }
+                            catch ALTAppleAPIError.maximumAppIDLimitReached
+                            {
+                                if let expirationDate = sortedExpirationDates.first
+                                {
+                                    throw OperationError.maximumAppIDLimitReached(application: application, requiredAppIDs: requiredAppIDs, availableAppIDs: availableAppIDs, nextExpirationDate: expirationDate)
+                                }
+                                else
+                                {
+                                    throw ALTAppleAPIError(.maximumAppIDLimitReached)
+                                }
+                            }
+                        }
+                        catch
+                        {
+                            completionHandler(.failure(error))
+                        }
+                    }
+                }
+            }
+            catch
+            {
+                completionHandler(.failure(error))
+            }
+        }
+    }
+    
+    func updateFeatures(for appID: ALTAppID, app: ALTApplication, team: ALTTeam, session: ALTAppleAPISession, completionHandler: @escaping (Result<ALTAppID, Error>) -> Void)
+    {
+        var entitlements = app.entitlements
+        for (key, value) in additionalEntitlements ?? [:]
+        {
+            entitlements[key] = value
+        }
+        
+        let requiredFeatures = entitlements.compactMap { (entitlement, value) -> (ALTFeature, Any)? in
+            guard let feature = ALTFeature(entitlement: entitlement) else { return nil }
+            return (feature, value)
+        }
+        
+        var features = requiredFeatures.reduce(into: [ALTFeature: Any]()) { $0[$1.0] = $1.1 }
+        
+        if let applicationGroups = entitlements[.appGroups] as? [String], !applicationGroups.isEmpty
+        {
+            features[.appGroups] = true
+        }
+        
+        var updateFeatures = false
+        
+        // Determine whether the required features are already enabled for the AppID.
+        for (feature, value) in features
+        {
+            if let appIDValue = appID.features[feature] as AnyObject?, (value as AnyObject).isEqual(appIDValue)
+            {
+                // AppID already has this feature enabled and the values are the same.
+                continue
+            }
+            else
+            {
+                // AppID either doesn't have this feature enabled or the value has changed,
+                // so we need to update it to reflect new values.
+                updateFeatures = true
+                break
+            }
+        }
+        
+        if updateFeatures
+        {
+            let appID = appID.copy() as! ALTAppID
+            appID.features = features
+            
+            ALTAppleAPI.shared.update(appID, team: team, session: session) { (appID, error) in
+                completionHandler(Result(appID, error))
+            }
+        }
+        else
+        {
+            completionHandler(.success(appID))
+        }
+    }
+    
+    func updateAppGroups(for appID: ALTAppID, app: ALTApplication, team: ALTTeam, session: ALTAppleAPISession, completionHandler: @escaping (Result<ALTAppID, Error>) -> Void)
+    {
+        var entitlements = app.entitlements
+        for (key, value) in additionalEntitlements ?? [:]
+        {
+            entitlements[key] = value
+        }
+                
+        var applicationGroups = entitlements[.appGroups] as? [String] ?? []
+        if applicationGroups.isEmpty
+        {
+            guard let isAppGroupsEnabled = appID.features[.appGroups] as? Bool, isAppGroupsEnabled else {
+                // No app groups, and we also haven't enabled the feature, so don't continue.
+                // For apps with no app groups but have had the feature enabled already
+                // we'll continue and assign the app ID to an empty array
+                // in case we need to explicitly remove them.
+                return completionHandler(.success(appID))
+            }
+        }
+        
+        if app.bundleIdentifier == StoreApp.altstoreAppID
+        {
+            // Updating app groups for this specific AltStore.
+            // Find the (unique) AltStore app group, then replace it
+            // with the correct "base" app group ID.
+            // Otherwise, we may append a duplicate team identifier to the end.
+            if let index = applicationGroups.firstIndex(where: { $0.contains(Bundle.baseAltStoreAppGroupID) })
+            {
+                applicationGroups[index] = Bundle.baseAltStoreAppGroupID
+            }
+            else
+            {
+                applicationGroups.append(Bundle.baseAltStoreAppGroupID)
+            }
+        }
+        
+        // Dispatch onto global queue to prevent appGroupsLock deadlock.
+        DispatchQueue.global().async {
+            
+            // Ensure we're not concurrently fetching and updating app groups,
+            // which can lead to race conditions such as adding an app group twice.
+            self.appGroupsLock.lock()
+            
+            func finish(_ result: Result<ALTAppID, Error>)
+            {
+                self.appGroupsLock.unlock()
+                completionHandler(result)
+            }
+            
+            ALTAppleAPI.shared.fetchAppGroups(for: team, session: session) { (groups, error) in
+                switch Result(groups, error)
+                {
+                case .failure(let error): finish(.failure(error))
+                case .success(let fetchedGroups):
+                    let dispatchGroup = DispatchGroup()
+                    
+                    var groups = [ALTAppGroup]()
+                    var errors = [Error]()
+                    
+                    for groupIdentifier in applicationGroups
+                    {
+                        let adjustedGroupIdentifier = groupIdentifier + "." + team.identifier
+                        
+                        if let group = fetchedGroups.first(where: { $0.groupIdentifier == adjustedGroupIdentifier })
+                        {
+                            groups.append(group)
+                        }
+                        else
+                        {
+                            dispatchGroup.enter()
+                            
+                            // Not all characters are allowed in group names, so we replace periods with spaces (like Apple does).
+                            let name = "AltStore " + groupIdentifier.replacingOccurrences(of: ".", with: " ")
+                            
+                            ALTAppleAPI.shared.addAppGroup(withName: name, groupIdentifier: adjustedGroupIdentifier, team: team, session: session) { (group, error) in
+                                switch Result(group, error)
+                                {
+                                case .success(let group): groups.append(group)
+                                case .failure(let error): errors.append(error)
+                                }
+                                
+                                dispatchGroup.leave()
+                            }
+                        }
+                    }
+                    
+                    dispatchGroup.notify(queue: .global()) {
+                        if let error = errors.first
+                        {
+                            finish(.failure(error))
+                        }
+                        else
+                        {
+                            ALTAppleAPI.shared.assign(appID, to: Array(groups), team: team, session: session) { (success, error) in
+                                let result = Result(success, error)
+                                finish(result.map { _ in appID })
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    
+    func fetchProvisioningProfile(for appID: ALTAppID, team: ALTTeam, session: ALTAppleAPISession, completionHandler: @escaping (Result<ALTProvisioningProfile, Error>) -> Void)
+    {
+        ALTAppleAPI.shared.fetchProvisioningProfile(for: appID, team: team, session: session) { (profile, error) in
+            switch Result(profile, error)
+            {
+            case .failure(let error): completionHandler(.failure(error))
+            case .success(let profile):
+                
+                // Delete existing profile
+                ALTAppleAPI.shared.delete(profile, for: team, session: session) { (success, error) in
+                    switch Result(success, error)
+                    {
+                    case .failure(let error): completionHandler(.failure(error))
+                    case .success:
+                        
+                        // Fetch new provisiong profile
+                        ALTAppleAPI.shared.fetchProvisioningProfile(for: appID, team: team, session: session) { (profile, error) in
+                            completionHandler(Result(profile, error))
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

source-code/ALTs/AltStore/Operations/FetchSourceOperation.swift

@@ -0,0 +1,94 @@
+//
+//  FetchSourceOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 7/30/19.
+//  Copyright © 2019 Riley Testut. All rights reserved.
+//
+
+import Foundation
+import CoreData
+
+import Roxas
+
+@objc(FetchSourceOperation)
+class FetchSourceOperation: ResultOperation<Source>
+{
+    let sourceURL: URL
+    let managedObjectContext: NSManagedObjectContext
+    
+    private let session: URLSession
+    
+    private lazy var dateFormatter: ISO8601DateFormatter = {
+        let dateFormatter = ISO8601DateFormatter()
+        return dateFormatter
+    }()
+    
+    init(sourceURL: URL, managedObjectContext: NSManagedObjectContext = DatabaseManager.shared.persistentContainer.newBackgroundContext())
+    {
+        self.sourceURL = sourceURL
+        self.managedObjectContext = managedObjectContext
+        
+        let configuration = URLSessionConfiguration.default
+        configuration.requestCachePolicy = .reloadIgnoringLocalCacheData
+        configuration.urlCache = nil
+        
+        self.session = URLSession(configuration: configuration)
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        let dataTask = self.session.dataTask(with: self.sourceURL) { (data, response, error) in
+            self.managedObjectContext.perform {
+                do
+                {
+                    let (data, _) = try Result((data, response), error).get()
+                    
+                    let decoder = JSONDecoder()
+                    decoder.dateDecodingStrategy = .custom({ (decoder) -> Date in
+                        let container = try decoder.singleValueContainer()
+                        let text = try container.decode(String.self)
+                        
+                        // Full ISO8601 Format.
+                        self.dateFormatter.formatOptions = [.withFullDate, .withFullTime, .withTimeZone]
+                        if let date = self.dateFormatter.date(from: text)
+                        {
+                            return date
+                        }
+                        
+                        // Just date portion of ISO8601.
+                        self.dateFormatter.formatOptions = [.withFullDate]
+                        if let date = self.dateFormatter.date(from: text)
+                        {
+                            return date
+                        }
+                        
+                        throw DecodingError.dataCorruptedError(in: container, debugDescription: "Date is in invalid format.")
+                    })
+                    
+                    decoder.managedObjectContext = self.managedObjectContext
+                    decoder.sourceURL = self.sourceURL
+                    
+                    let source = try decoder.decode(Source.self, from: data)
+                    
+                    if source.identifier == Source.altStoreIdentifier, let patreonAccessToken = source.userInfo?[.patreonAccessToken]
+                    {
+                        Keychain.shared.patreonCreatorAccessToken = patreonAccessToken
+                    }
+                    
+                    self.finish(.success(source))
+                }
+                catch
+                {
+                    self.finish(.failure(error))
+                }
+            }
+        }
+        
+        self.progress.addChild(dataTask.progress, withPendingUnitCount: 1)
+        
+        dataTask.resume()
+    }
+}

source-code/ALTs/AltStore/Operations/FindServerOperation.swift

@@ -0,0 +1,115 @@
+//
+//  FindServerOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 9/8/19.
+//  Copyright © 2019 Riley Testut. All rights reserved.
+//
+
+import Foundation
+import AltKit
+import Roxas
+
+private let ReceivedServerConnectionResponse: @convention(c) (CFNotificationCenter?, UnsafeMutableRawPointer?, CFNotificationName?, UnsafeRawPointer?, CFDictionary?) -> Void =
+{ (center, observer, name, object, userInfo) in
+    guard let name = name, let observer = observer else { return }
+    
+    let operation = unsafeBitCast(observer, to: FindServerOperation.self)
+    operation.handle(name)
+}
+
+@objc(FindServerOperation)
+class FindServerOperation: ResultOperation<Server>
+{
+    let context: OperationContext
+    
+    private var isWiredServerConnectionAvailable = false
+    private var isLocalServerConnectionAvailable = false
+    
+    init(context: OperationContext = OperationContext())
+    {
+        self.context = context
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        if let error = self.context.error
+        {
+            self.finish(.failure(error))
+            return
+        }
+        
+        if let server = self.context.server
+        {
+            self.finish(.success(server))
+            return
+        }
+        
+        let notificationCenter = CFNotificationCenterGetDarwinNotifyCenter()
+        let observer = Unmanaged.passUnretained(self).toOpaque()
+        
+        // Prepare observers to receive callback from wired connection or background daemon (if available).
+        CFNotificationCenterAddObserver(notificationCenter, observer, ReceivedServerConnectionResponse, CFNotificationName.wiredServerConnectionAvailableResponse.rawValue, nil, .deliverImmediately)
+        CFNotificationCenterAddObserver(notificationCenter, observer, ReceivedServerConnectionResponse, CFNotificationName.localServerConnectionAvailableResponse.rawValue, nil, .deliverImmediately)
+        
+        // Post notifications.
+        CFNotificationCenterPostNotification(notificationCenter, .wiredServerConnectionAvailableRequest, nil, nil, true)
+        CFNotificationCenterPostNotification(notificationCenter, .localServerConnectionAvailableRequest, nil, nil, true)
+        
+        // Wait for either callback or timeout.
+        DispatchQueue.global().asyncAfter(deadline: .now() + 1.0) {
+            if self.isLocalServerConnectionAvailable
+            {
+                // Prefer background daemon, if it exists and is running.
+                let server = Server(connectionType: .local)
+                self.finish(.success(server))
+            }
+            else if self.isWiredServerConnectionAvailable
+            {
+                let server = Server(connectionType: .wired)
+                self.finish(.success(server))
+            }
+            else if let server = ServerManager.shared.discoveredServers.first(where: { $0.isPreferred })
+            {
+                // Preferred server.
+                self.finish(.success(server))
+            }
+            else if let server = ServerManager.shared.discoveredServers.first
+            {
+                // Any available server.
+                self.finish(.success(server))
+            }
+            else
+            {
+                // No servers.
+                self.finish(.failure(ConnectionError.serverNotFound))
+            }
+        }
+    }
+    
+    override func finish(_ result: Result<Server, Error>)
+    {
+        super.finish(result)
+        
+        let notificationCenter = CFNotificationCenterGetDarwinNotifyCenter()
+        let observer = Unmanaged.passUnretained(self).toOpaque()
+        
+        CFNotificationCenterRemoveObserver(notificationCenter, observer, .wiredServerConnectionAvailableResponse, nil)
+        CFNotificationCenterRemoveObserver(notificationCenter, observer, .localServerConnectionAvailableResponse, nil)
+    }
+}
+
+fileprivate extension FindServerOperation
+{
+    func handle(_ notification: CFNotificationName)
+    {
+        switch notification
+        {
+        case .wiredServerConnectionAvailableResponse: self.isWiredServerConnectionAvailable = true
+        case .localServerConnectionAvailableResponse: self.isLocalServerConnectionAvailable = true
+        default: break
+        }
+    }
+}

source-code/ALTs/AltStore/Operations/InstallAppOperation.swift

@@ -0,0 +1,247 @@
+//
+//  InstallAppOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 6/19/19.
+//  Copyright © 2019 Riley Testut. All rights reserved.
+//
+
+import Foundation
+import Network
+
+import AltKit
+import AltSign
+import Roxas
+
+@objc(InstallAppOperation)
+class InstallAppOperation: ResultOperation<InstalledApp>
+{
+    let context: InstallAppOperationContext
+    
+    private var didCleanUp = false
+    
+    init(context: InstallAppOperationContext)
+    {
+        self.context = context
+        
+        super.init()
+        
+        self.progress.totalUnitCount = 100
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        if let error = self.context.error
+        {
+            self.finish(.failure(error))
+            return
+        }
+        
+        guard
+            let certificate = self.context.certificate,
+            let resignedApp = self.context.resignedApp,
+            let connection = self.context.installationConnection
+        else { return self.finish(.failure(OperationError.invalidParameters)) }
+        
+        let backgroundContext = DatabaseManager.shared.persistentContainer.newBackgroundContext()
+        backgroundContext.perform {
+            
+            /* App */
+            let installedApp: InstalledApp
+            
+            // Fetch + update rather than insert + resolve merge conflicts to prevent potential context-level conflicts.
+            if let app = InstalledApp.first(satisfying: NSPredicate(format: "%K == %@", #keyPath(InstalledApp.bundleIdentifier), self.context.bundleIdentifier), in: backgroundContext)
+            {
+                installedApp = app
+            }
+            else
+            {
+                installedApp = InstalledApp(resignedApp: resignedApp, originalBundleIdentifier: self.context.bundleIdentifier, certificateSerialNumber: certificate.serialNumber, context: backgroundContext)
+            }
+            
+            installedApp.update(resignedApp: resignedApp, certificateSerialNumber: certificate.serialNumber)
+
+            if let team = DatabaseManager.shared.activeTeam(in: backgroundContext)
+            {
+                installedApp.team = team
+            }
+            
+            /* App Extensions */
+            var installedExtensions = Set<InstalledExtension>()
+            
+            if
+                let bundle = Bundle(url: resignedApp.fileURL),
+                let directory = bundle.builtInPlugInsURL,
+                let enumerator = FileManager.default.enumerator(at: directory, includingPropertiesForKeys: nil, options: [.skipsSubdirectoryDescendants])
+            {
+                for case let fileURL as URL in enumerator
+                {
+                    guard let appExtensionBundle = Bundle(url: fileURL) else { continue }
+                    guard let appExtension = ALTApplication(fileURL: appExtensionBundle.bundleURL) else { continue }
+                    
+                    let parentBundleID = self.context.bundleIdentifier
+                    let resignedParentBundleID = resignedApp.bundleIdentifier
+                    
+                    let resignedBundleID = appExtension.bundleIdentifier
+                    let originalBundleID = resignedBundleID.replacingOccurrences(of: resignedParentBundleID, with: parentBundleID)
+                    
+                    let installedExtension: InstalledExtension
+                    
+                    if let appExtension = installedApp.appExtensions.first(where: { $0.bundleIdentifier == originalBundleID })
+                    {
+                        installedExtension = appExtension
+                    }
+                    else
+                    {
+                        installedExtension = InstalledExtension(resignedAppExtension: appExtension, originalBundleIdentifier: originalBundleID, context: backgroundContext)
+                    }
+                    
+                    installedExtension.update(resignedAppExtension: appExtension)
+                    
+                    installedExtensions.insert(installedExtension)
+                }
+            }
+            
+            installedApp.appExtensions = installedExtensions
+            
+            // Temporary directory and resigned .ipa no longer needed, so delete them now to ensure AltStore doesn't quit before we get the chance to.
+            self.cleanUp()
+            
+            self.context.beginInstallationHandler?(installedApp)
+            
+            var activeProfiles: Set<String>?
+            if let sideloadedAppsLimit = UserDefaults.standard.activeAppsLimit
+            {
+                // When installing these new profiles, AltServer will remove all non-active profiles to ensure we remain under limit.
+                
+                let fetchRequest = InstalledApp.activeAppsFetchRequest()
+                fetchRequest.includesPendingChanges = false
+                
+                var activeApps = InstalledApp.fetch(fetchRequest, in: backgroundContext)
+                if !activeApps.contains(installedApp)
+                {
+                    let activeAppsCount = activeApps.map { $0.requiredActiveSlots }.reduce(0, +)
+                    
+                    let availableActiveApps = max(sideloadedAppsLimit - activeAppsCount, 0)
+                    if installedApp.requiredActiveSlots <= availableActiveApps
+                    {
+                        // This app has not been explicitly activated, but there are enough slots available,
+                        // so implicitly activate it.
+                        installedApp.isActive = true
+                        activeApps.append(installedApp)
+                    }
+                    else
+                    {
+                        installedApp.isActive = false
+                    }
+                }
+
+                activeProfiles = Set(activeApps.flatMap { (installedApp) -> [String] in
+                    let appExtensionProfiles = installedApp.appExtensions.map { $0.resignedBundleIdentifier }
+                    return [installedApp.resignedBundleIdentifier] + appExtensionProfiles
+                })
+            }
+            
+            let request = BeginInstallationRequest(activeProfiles: activeProfiles, bundleIdentifier: installedApp.resignedBundleIdentifier)
+            connection.send(request) { (result) in
+                switch result
+                {
+                case .failure(let error): self.finish(.failure(error))
+                case .success:
+                    
+                    self.receive(from: connection) { (result) in
+                        switch result
+                        {
+                        case .success:
+                            backgroundContext.perform {
+                                installedApp.refreshedDate = Date()
+                                self.finish(.success(installedApp))
+                            }
+                            
+                        case .failure(let error):
+                            self.finish(.failure(error))
+                        }
+                    }
+                }
+            }
+        }
+    }
+    
+    override func finish(_ result: Result<InstalledApp, Error>)
+    {
+        self.cleanUp()
+        
+        // Only remove refreshed IPA when finished.
+        if let app = self.context.app
+        {
+            let fileURL = InstalledApp.refreshedIPAURL(for: app)
+            
+            do
+            {
+                try FileManager.default.removeItem(at: fileURL)
+            }
+            catch
+            {
+                print("Failed to remove refreshed .ipa:", error)
+            }
+        }
+        
+        super.finish(result)
+    }
+}
+
+private extension InstallAppOperation
+{
+    func receive(from connection: ServerConnection, completionHandler: @escaping (Result<Void, Error>) -> Void)
+    {
+        connection.receiveResponse() { (result) in
+            do
+            {
+                let response = try result.get()
+                print(response)
+                
+                switch response
+                {
+                case .installationProgress(let response):
+                    if response.progress == 1.0
+                    {
+                        self.progress.completedUnitCount = self.progress.totalUnitCount
+                        completionHandler(.success(()))
+                    }
+                    else
+                    {
+                        self.progress.completedUnitCount = Int64(response.progress * 100)
+                        self.receive(from: connection, completionHandler: completionHandler)
+                    }
+                    
+                case .error(let response):
+                    completionHandler(.failure(response.error))
+                    
+                default:
+                    completionHandler(.failure(ALTServerError(.unknownRequest)))
+                }
+            }
+            catch
+            {
+                completionHandler(.failure(ALTServerError(error)))
+            }
+        }
+    }
+    
+    func cleanUp()
+    {
+        guard !self.didCleanUp else { return }
+        self.didCleanUp = true
+        
+        do
+        {
+            try FileManager.default.removeItem(at: self.context.temporaryDirectory)
+        }
+        catch
+        {
+            print("Failed to remove temporary directory.", error)
+        }
+    }
+}

source-code/ALTs/AltStore/Operations/Operation.swift

@@ -0,0 +1,93 @@
+//
+//  Operation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 6/7/19.
+//  Copyright © 2019 Riley Testut. All rights reserved.
+//
+
+import Foundation
+import Roxas
+
+class ResultOperation<ResultType>: Operation
+{
+    var resultHandler: ((Result<ResultType, Error>) -> Void)?
+    
+    @available(*, unavailable)
+    override func finish()
+    {
+        super.finish()
+    }
+
+    func finish(_ result: Result<ResultType, Error>)
+    {
+        guard !self.isFinished else { return }
+        
+        if self.isCancelled
+        {
+            self.resultHandler?(.failure(OperationError.cancelled))
+        }
+        else
+        {
+            self.resultHandler?(result)
+        }
+        
+        super.finish()
+    }
+}
+
+class Operation: RSTOperation, ProgressReporting
+{
+    let progress = Progress.discreteProgress(totalUnitCount: 1)
+    
+    private var backgroundTaskID: UIBackgroundTaskIdentifier?
+    
+    override var isAsynchronous: Bool {
+        return true
+    }
+    
+    override init()
+    {
+        super.init()
+        
+        self.progress.cancellationHandler = { [weak self] in self?.cancel() }
+    }
+    
+    override func cancel()
+    {
+        super.cancel()
+        
+        if !self.progress.isCancelled
+        {
+            self.progress.cancel()
+        }
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        let name = "com.altstore." + NSStringFromClass(type(of: self))
+        self.backgroundTaskID = UIApplication.shared.beginBackgroundTask(withName: name) { [weak self] in
+            guard let backgroundTask = self?.backgroundTaskID else { return }
+            
+            self?.cancel()
+            
+            UIApplication.shared.endBackgroundTask(backgroundTask)
+            self?.backgroundTaskID = .invalid
+        }        
+    }
+    
+    override func finish()
+    {
+        guard !self.isFinished else { return }
+        
+        super.finish()
+        
+        if let backgroundTaskID = self.backgroundTaskID
+        {
+            UIApplication.shared.endBackgroundTask(backgroundTaskID)
+            self.backgroundTaskID = .invalid
+        }
+    }
+}

source-code/ALTs/AltStore/Operations/OperationContexts.swift

@@ -0,0 +1,116 @@
+//
+//  Contexts.swift
+//  AltStore
+//
+//  Created by Riley Testut on 6/20/19.
+//  Copyright © 2019 Riley Testut. All rights reserved.
+//
+
+import Foundation
+import CoreData
+import Network
+
+import AltSign
+
+class OperationContext
+{
+    var server: Server?
+    var error: Error?
+    
+    var presentingViewController: UIViewController?
+    
+    let operations: NSHashTable<Foundation.Operation>
+    
+    init(server: Server? = nil, error: Error? = nil, operations: [Foundation.Operation] = [])
+    {
+        self.server = server
+        self.error = error
+        
+        self.operations = NSHashTable<Foundation.Operation>.weakObjects()
+        for operation in operations
+        {
+            self.operations.add(operation)
+        }
+    }
+    
+    convenience init(context: OperationContext)
+    {
+        self.init(server: context.server, error: context.error, operations: context.operations.allObjects)
+    }
+}
+
+class AuthenticatedOperationContext: OperationContext
+{
+    var session: ALTAppleAPISession?
+    
+    var team: ALTTeam?
+    var certificate: ALTCertificate?
+    
+    weak var authenticationOperation: AuthenticationOperation?
+    
+    convenience init(context: AuthenticatedOperationContext)
+    {
+        self.init(server: context.server, error: context.error, operations: context.operations.allObjects)
+        
+        self.session = context.session
+        self.team = context.team
+        self.certificate = context.certificate
+        self.authenticationOperation = context.authenticationOperation
+    }
+}
+
+@dynamicMemberLookup
+class AppOperationContext
+{
+    let bundleIdentifier: String
+    let authenticatedContext: AuthenticatedOperationContext
+    
+    var app: ALTApplication?
+    var provisioningProfiles: [String: ALTProvisioningProfile]?
+    
+    var isFinished = false
+    
+    var error: Error? {
+        get {
+            return _error ?? self.authenticatedContext.error
+        }
+        set {
+            _error = newValue
+        }
+    }
+    private var _error: Error?
+    
+    init(bundleIdentifier: String, authenticatedContext: AuthenticatedOperationContext)
+    {
+        self.bundleIdentifier = bundleIdentifier
+        self.authenticatedContext = authenticatedContext
+    }
+    
+    subscript<T>(dynamicMember keyPath: WritableKeyPath<AuthenticatedOperationContext, T>) -> T
+    {
+        return self.authenticatedContext[keyPath: keyPath]
+    }
+}
+
+class InstallAppOperationContext: AppOperationContext
+{
+    lazy var temporaryDirectory: URL = {
+        let temporaryDirectory = FileManager.default.uniqueTemporaryURL()
+        
+        do { try FileManager.default.createDirectory(at: temporaryDirectory, withIntermediateDirectories: true, attributes: nil) }
+        catch { self.error = error }
+        
+        return temporaryDirectory
+    }()
+    
+    var resignedApp: ALTApplication?
+    var installationConnection: ServerConnection?
+    var installedApp: InstalledApp? {
+        didSet {
+            self.installedAppContext = self.installedApp?.managedObjectContext
+        }
+    }
+    private var installedAppContext: NSManagedObjectContext?
+    
+    var beginInstallationHandler: ((InstalledApp) -> Void)?
+}

source-code/ALTs/AltStore/Operations/OperationError.swift

@@ -0,0 +1,105 @@
+//
+//  OperationError.swift
+//  AltStore
+//
+//  Created by Riley Testut on 6/7/19.
+//  Copyright © 2019 Riley Testut. All rights reserved.
+//
+
+import Foundation
+import AltSign
+
+enum OperationError: LocalizedError
+{
+    case unknown
+    case unknownResult
+    case cancelled
+    case timedOut
+    
+    case notAuthenticated
+    case appNotFound
+    
+    case unknownUDID
+    
+    case invalidApp
+    case invalidParameters
+    
+    case iOSVersionNotSupported(ALTApplication)
+    case maximumAppIDLimitReached(application: ALTApplication, requiredAppIDs: Int, availableAppIDs: Int, nextExpirationDate: Date)
+    
+    case noSources
+    
+    case openAppFailed(name: String)
+    case missingAppGroup
+    
+    var failureReason: String? {
+        switch self {
+        case .unknown: return NSLocalizedString("An unknown error occured.", comment: "")
+        case .unknownResult: return NSLocalizedString("The operation returned an unknown result.", comment: "")
+        case .cancelled: return NSLocalizedString("The operation was cancelled.", comment: "")
+        case .timedOut: return NSLocalizedString("The operation timed out.", comment: "")
+        case .notAuthenticated: return NSLocalizedString("You are not signed in.", comment: "")
+        case .appNotFound: return NSLocalizedString("App not found.", comment: "")
+        case .unknownUDID: return NSLocalizedString("Unknown device UDID.", comment: "")
+        case .invalidApp: return NSLocalizedString("The app is invalid.", comment: "")
+        case .invalidParameters: return NSLocalizedString("Invalid parameters.", comment: "")
+        case .noSources: return NSLocalizedString("There are no AltStore sources.", comment: "")
+        case .openAppFailed(let name): return String(format: NSLocalizedString("AltStore was denied permission to launch %@.", comment: ""), name)
+        case .missingAppGroup: return NSLocalizedString("AltStore's shared app group could not be found.", comment: "")
+        case .iOSVersionNotSupported(let app):
+            let name = app.name
+            
+            var version = "iOS \(app.minimumiOSVersion.majorVersion).\(app.minimumiOSVersion.minorVersion)"
+            if app.minimumiOSVersion.patchVersion > 0
+            {
+                version += ".\(app.minimumiOSVersion.patchVersion)"
+            }
+            
+            let localizedDescription = String(format: NSLocalizedString("%@ requires %@.", comment: ""), name, version)
+            return localizedDescription
+            
+        case .maximumAppIDLimitReached: return NSLocalizedString("Cannot register more than 10 App IDs.", comment: "")
+        }
+    }
+    
+    var recoverySuggestion: String? {
+        switch self
+        {
+        case .maximumAppIDLimitReached(let application, let requiredAppIDs, let availableAppIDs, let date):
+            let baseMessage = NSLocalizedString("Delete sideloaded apps to free up App ID slots.", comment: "")
+            let message: String
+            
+            if requiredAppIDs > 1
+            {
+                let availableText: String
+                
+                switch availableAppIDs
+                {
+                case 0: availableText = NSLocalizedString("none are available", comment: "")
+                case 1: availableText = NSLocalizedString("only 1 is available", comment: "")
+                default: availableText = String(format: NSLocalizedString("only %@ are available", comment: ""), NSNumber(value: availableAppIDs))
+                }
+                
+                let prefixMessage = String(format: NSLocalizedString("%@ requires %@ App IDs, but %@.", comment: ""), application.name, NSNumber(value: requiredAppIDs), availableText)
+                message = prefixMessage + " " + baseMessage
+            }
+            else
+            {
+                let dateComponents = Calendar.current.dateComponents([.day, .hour, .minute], from: Date(), to: date)
+                
+                let dateComponentsFormatter = DateComponentsFormatter()
+                dateComponentsFormatter.maximumUnitCount = 1
+                dateComponentsFormatter.unitsStyle = .full
+                
+                let remainingTime = dateComponentsFormatter.string(from: dateComponents)!
+                
+                let remainingTimeMessage = String(format: NSLocalizedString("You can register another App ID in %@.", comment: ""), remainingTime)
+                message = baseMessage + " " + remainingTimeMessage
+            }
+            
+            return message
+            
+        default: return nil
+        }
+    }
+}

source-code/ALTs/AltStore/Operations/RefreshAppOperation.swift

@@ -0,0 +1,121 @@
+//
+//  RefreshAppOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 2/27/20.
+//  Copyright © 2020 Riley Testut. All rights reserved.
+//
+
+import Foundation
+
+import AltSign
+import AltKit
+
+import Roxas
+
+@objc(RefreshAppOperation)
+class RefreshAppOperation: ResultOperation<InstalledApp>
+{
+    let context: AppOperationContext
+    
+    // Strong reference to managedObjectContext to keep it alive until we're finished.
+    let managedObjectContext: NSManagedObjectContext
+    
+    init(context: AppOperationContext)
+    {
+        self.context = context
+        self.managedObjectContext = DatabaseManager.shared.persistentContainer.newBackgroundContext()
+        
+        super.init()
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        do
+        {
+            if let error = self.context.error
+            {
+                throw error
+            }
+            
+            guard let server = self.context.server, let profiles = self.context.provisioningProfiles else { throw OperationError.invalidParameters }
+            
+            guard let app = self.context.app else { throw OperationError.appNotFound }
+            guard let udid = Bundle.main.object(forInfoDictionaryKey: Bundle.Info.deviceID) as? String else { throw OperationError.unknownUDID }
+            
+            ServerManager.shared.connect(to: server) { (result) in
+                switch result
+                {
+                case .failure(let error): self.finish(.failure(error))
+                case .success(let connection):
+                    DatabaseManager.shared.persistentContainer.performBackgroundTask { (context) in
+                        print("Sending refresh app request...")
+                        
+                        var activeProfiles: Set<String>?
+                        if UserDefaults.standard.activeAppsLimit != nil
+                        {
+                            // When installing these new profiles, AltServer will remove all non-active profiles to ensure we remain under limit.
+                            let activeApps = InstalledApp.fetchActiveApps(in: context)
+                            activeProfiles = Set(activeApps.flatMap { (installedApp) -> [String] in
+                                let appExtensionProfiles = installedApp.appExtensions.map { $0.resignedBundleIdentifier }
+                                return [installedApp.resignedBundleIdentifier] + appExtensionProfiles
+                            })
+                        }
+                        
+                        let request = InstallProvisioningProfilesRequest(udid: udid, provisioningProfiles: Set(profiles.values), activeProfiles: activeProfiles)
+                        connection.send(request) { (result) in
+                            print("Sent refresh app request!")
+                            
+                            switch result
+                            {
+                            case .failure(let error): self.finish(.failure(error))
+                            case .success:
+                                print("Waiting for refresh app response...")
+                                connection.receiveResponse() { (result) in
+                                    print("Receiving refresh app response:", result)
+                                    
+                                    switch result
+                                    {
+                                    case .failure(let error): self.finish(.failure(error))
+                                    case .success(.error(let response)): self.finish(.failure(response.error))
+                                        
+                                    case .success(.installProvisioningProfiles):
+                                        self.managedObjectContext.perform {
+                                            let predicate = NSPredicate(format: "%K == %@", #keyPath(InstalledApp.bundleIdentifier), app.bundleIdentifier)
+                                            guard let installedApp = InstalledApp.first(satisfying: predicate, in: self.managedObjectContext) else {
+                                                return self.finish(.failure(OperationError.appNotFound))
+                                            }
+                                            
+                                            self.progress.completedUnitCount += 1
+                                            
+                                            if let provisioningProfile = profiles[app.bundleIdentifier]
+                                            {
+                                                installedApp.update(provisioningProfile: provisioningProfile)
+                                            }
+                                            
+                                            for installedExtension in installedApp.appExtensions
+                                            {
+                                                guard let provisioningProfile = profiles[installedExtension.bundleIdentifier] else { continue }
+                                                installedExtension.update(provisioningProfile: provisioningProfile)
+                                            }
+                                            
+                                            self.finish(.success(installedApp))
+                                        }
+                                        
+                                    case .success: self.finish(.failure(ALTServerError(.unknownRequest)))
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        catch
+        {
+            self.finish(.failure(error))
+        }
+    }
+}

source-code/ALTs/AltStore/Operations/RefreshGroup.swift

@@ -0,0 +1,91 @@
+//
+//  RefreshGroup.swift
+//  AltStore
+//
+//  Created by Riley Testut on 6/20/19.
+//  Copyright © 2019 Riley Testut. All rights reserved.
+//
+
+import Foundation
+import CoreData
+
+import AltSign
+
+class RefreshGroup: NSObject
+{
+    let context: AuthenticatedOperationContext
+    let progress = Progress.discreteProgress(totalUnitCount: 0)
+    
+    var completionHandler: (([String: Result<InstalledApp, Error>]) -> Void)?
+    var beginInstallationHandler: ((InstalledApp) -> Void)?
+        
+    private(set) var results = [String: Result<InstalledApp, Error>]()
+    
+    // Keep strong references to managed object contexts
+    // so they don't die out from under us.
+    private(set) var _contexts = Set<NSManagedObjectContext>()
+    
+    private var isFinished = false
+    
+    private let dispatchGroup = DispatchGroup()
+    private var operations: [Foundation.Operation] = []
+    
+    init(context: AuthenticatedOperationContext = AuthenticatedOperationContext())
+    {
+        self.context = context
+        
+        super.init()
+    }
+    
+    /// Used to keep track of which operations belong to this group.
+    /// This does _not_ add them to any operation queue.
+    func add(_ operations: [Foundation.Operation])
+    {
+        for operation in operations
+        {
+            self.dispatchGroup.enter()
+            
+            operation.completionBlock = { [weak self] in
+                self?.dispatchGroup.leave()
+            }
+        }
+        
+        if self.operations.isEmpty && !operations.isEmpty
+        {
+            self.dispatchGroup.notify(queue: .global()) { [weak self] in
+                self?.finish()
+            }
+        }
+        
+        self.operations.append(contentsOf: operations)
+    }
+    
+    func set(_ result: Result<InstalledApp, Error>, forAppWithBundleIdentifier bundleIdentifier: String)
+    {
+        self.results[bundleIdentifier] = result
+        
+        switch result
+        {
+        case .failure: break
+        case .success(let installedApp):
+            guard let context = installedApp.managedObjectContext else { break }
+            self._contexts.insert(context)
+        }
+    }
+    
+    func cancel()
+    {
+        self.operations.forEach { $0.cancel() }
+    }
+}
+
+private extension RefreshGroup
+{
+    func finish()
+    {
+        guard !self.isFinished else { return }
+        self.isFinished = true
+        
+        self.completionHandler?(self.results)
+    }
+}

source-code/ALTs/AltStore/Operations/RemoveAppBackupOperation.swift

@@ -0,0 +1,79 @@
+//
+//  RemoveAppBackupOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 5/13/20.
+//  Copyright © 2020 Riley Testut. All rights reserved.
+//
+
+import Foundation
+
+import AltKit
+
+@objc(RemoveAppBackupOperation)
+class RemoveAppBackupOperation: ResultOperation<Void>
+{
+    let context: InstallAppOperationContext
+    
+    private let coordinator = NSFileCoordinator()
+    private let coordinatorQueue = OperationQueue()
+    
+    init(context: InstallAppOperationContext)
+    {
+        self.context = context
+        
+        super.init()
+        
+        self.coordinatorQueue.name = "AltStore - RemoveAppBackupOperation Queue"
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        if let error = self.context.error
+        {
+            self.finish(.failure(error))
+            return
+        }
+        
+        guard let installedApp = self.context.installedApp else { return self.finish(.failure(OperationError.invalidParameters)) }
+        installedApp.managedObjectContext?.perform {
+            guard let backupDirectoryURL = FileManager.default.backupDirectoryURL(for: installedApp) else { return self.finish(.failure(OperationError.missingAppGroup)) }
+            
+            let intent = NSFileAccessIntent.writingIntent(with: backupDirectoryURL, options: [.forDeleting])
+            self.coordinator.coordinate(with: [intent], queue: self.coordinatorQueue) { (error) in
+                do
+                {
+                    if let error = error
+                    {
+                        throw error
+                    }
+                    
+                    try FileManager.default.removeItem(at: intent.url)
+                    
+                    self.finish(.success(()))
+                }
+                catch let error as CocoaError where error.code == CocoaError.Code.fileNoSuchFile
+                {
+                    #if DEBUG
+                    
+                    // When debugging, it's expected that app groups don't match, so ignore.
+                    self.finish(.success(()))
+                    
+                    #else
+                    
+                    print("Failed to remove app backup directory:", error)
+                    self.finish(.failure(error))
+                    
+                    #endif
+                }
+                catch
+                {
+                    print("Failed to remove app backup directory:", error)
+                    self.finish(.failure(error))
+                }
+            }
+        }
+    }
+}

source-code/ALTs/AltStore/Operations/RemoveAppOperation.swift

@@ -0,0 +1,83 @@
+//
+//  RemoveAppOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 5/12/20.
+//  Copyright © 2020 Riley Testut. All rights reserved.
+//
+
+import Foundation
+
+import AltKit
+
+@objc(RemoveAppOperation)
+class RemoveAppOperation: ResultOperation<InstalledApp>
+{
+    let context: InstallAppOperationContext
+    
+    init(context: InstallAppOperationContext)
+    {
+        self.context = context
+        
+        super.init()
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        if let error = self.context.error
+        {
+            self.finish(.failure(error))
+            return
+        }
+        
+        guard let server = self.context.server, let installedApp = self.context.installedApp else { return self.finish(.failure(OperationError.invalidParameters)) }
+        guard let udid = Bundle.main.object(forInfoDictionaryKey: Bundle.Info.deviceID) as? String else { return self.finish(.failure(OperationError.unknownUDID)) }
+        
+        installedApp.managedObjectContext?.perform {
+            let resignedBundleIdentifier = installedApp.resignedBundleIdentifier
+            
+            ServerManager.shared.connect(to: server) { (result) in
+                switch result
+                {
+                case .failure(let error): self.finish(.failure(error))
+                case .success(let connection):
+                    print("Sending remove app request...")
+                    
+                    let request = RemoveAppRequest(udid: udid, bundleIdentifier: resignedBundleIdentifier)
+                    connection.send(request) { (result) in
+                        print("Sent remove app request!")
+                        
+                        switch result
+                        {
+                        case .failure(let error): self.finish(.failure(error))
+                        case .success:
+                            print("Waiting for remove app response...")
+                            connection.receiveResponse() { (result) in
+                                print("Receiving remove app response:", result)
+                                
+                                switch result
+                                {
+                                case .failure(let error): self.finish(.failure(error))
+                                case .success(.error(let response)): self.finish(.failure(response.error))
+                                case .success(.removeApp):
+                                    DatabaseManager.shared.persistentContainer.performBackgroundTask { (context) in
+                                        self.progress.completedUnitCount += 1
+                                        
+                                        let installedApp = context.object(with: installedApp.objectID) as! InstalledApp
+                                        installedApp.isActive = false
+                                        self.finish(.success(installedApp))
+                                    }
+                                    
+                                case .success: self.finish(.failure(ALTServerError(.unknownResponse)))
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+

source-code/ALTs/AltStore/Operations/ResignAppOperation.swift

@@ -0,0 +1,226 @@
+//
+//  ResignAppOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 6/7/19.
+//  Copyright © 2019 Riley Testut. All rights reserved.
+//
+
+import Foundation
+import Roxas
+
+import AltSign
+
+@objc(ResignAppOperation)
+class ResignAppOperation: ResultOperation<ALTApplication>
+{
+    let context: InstallAppOperationContext
+    
+    init(context: InstallAppOperationContext)
+    {
+        self.context = context
+        
+        super.init()
+        
+        self.progress.totalUnitCount = 3
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        if let error = self.context.error
+        {
+            self.finish(.failure(error))
+            return
+        }
+        
+        guard
+            let app = self.context.app,
+            let profiles = self.context.provisioningProfiles,
+            let team = self.context.team,
+            let certificate = self.context.certificate
+        else { return self.finish(.failure(OperationError.invalidParameters)) }
+        
+        // Prepare app bundle
+        let prepareAppProgress = Progress.discreteProgress(totalUnitCount: 2)
+        self.progress.addChild(prepareAppProgress, withPendingUnitCount: 3)
+        
+        let prepareAppBundleProgress = self.prepareAppBundle(for: app, profiles: profiles) { (result) in
+            guard let appBundleURL = self.process(result) else { return }
+            
+            print("Resigning App:", self.context.bundleIdentifier)
+            
+            // Resign app bundle
+            let resignProgress = self.resignAppBundle(at: appBundleURL, team: team, certificate: certificate, profiles: Array(profiles.values)) { (result) in
+                guard let resignedURL = self.process(result) else { return }
+                
+                // Finish
+                do
+                {
+                    let destinationURL = InstalledApp.refreshedIPAURL(for: app)
+                    try FileManager.default.copyItem(at: resignedURL, to: destinationURL, shouldReplace: true)
+                    
+                    // Use appBundleURL since we need an app bundle, not .ipa.
+                    guard let resignedApplication = ALTApplication(fileURL: appBundleURL) else { throw OperationError.invalidApp }
+                    self.finish(.success(resignedApplication))
+                }
+                catch
+                {
+                    self.finish(.failure(error))
+                }
+            }
+            prepareAppProgress.addChild(resignProgress, withPendingUnitCount: 1)
+        }
+        prepareAppProgress.addChild(prepareAppBundleProgress, withPendingUnitCount: 1)
+    }
+    
+    func process<T>(_ result: Result<T, Error>) -> T?
+    {
+        switch result
+        {
+        case .failure(let error):
+            self.finish(.failure(error))
+            return nil
+            
+        case .success(let value):
+            guard !self.isCancelled else {
+                self.finish(.failure(OperationError.cancelled))
+                return nil
+            }
+            
+            return value
+        }
+    }
+}
+
+private extension ResignAppOperation
+{
+    func prepareAppBundle(for app: ALTApplication, profiles: [String: ALTProvisioningProfile], completionHandler: @escaping (Result<URL, Error>) -> Void) -> Progress
+    {
+        let progress = Progress.discreteProgress(totalUnitCount: 1)
+        
+        let bundleIdentifier = app.bundleIdentifier
+        let openURL = InstalledApp.openAppURL(for: app)
+        
+        let fileURL = app.fileURL
+        
+        func prepare(_ bundle: Bundle, additionalInfoDictionaryValues: [String: Any] = [:]) throws
+        {
+            guard let identifier = bundle.bundleIdentifier else { throw ALTError(.missingAppBundle) }
+            guard let profile = profiles[identifier] else { throw ALTError(.missingProvisioningProfile) }
+            guard var infoDictionary = bundle.infoDictionary else { throw ALTError(.missingInfoPlist) }
+            
+            infoDictionary[kCFBundleIdentifierKey as String] = profile.bundleIdentifier
+            infoDictionary[Bundle.Info.altBundleID] = identifier
+            
+            for (key, value) in additionalInfoDictionaryValues
+            {
+                infoDictionary[key] = value
+            }
+            
+            if let appGroups = profile.entitlements[.appGroups] as? [String]
+            {
+                infoDictionary[Bundle.Info.appGroups] = appGroups
+            }
+            
+            // Add app-specific exported UTI so we can check later if this app (extension) is installed or not.
+            let installedAppUTI = ["UTTypeConformsTo": [],
+                                   "UTTypeDescription": "AltStore Installed App",
+                                   "UTTypeIconFiles": [],
+                                   "UTTypeIdentifier": InstalledApp.installedAppUTI(forBundleIdentifier: profile.bundleIdentifier),
+                                   "UTTypeTagSpecification": [:]] as [String : Any]
+            
+            var exportedUTIs = infoDictionary[Bundle.Info.exportedUTIs] as? [[String: Any]] ?? []
+            exportedUTIs.append(installedAppUTI)
+            infoDictionary[Bundle.Info.exportedUTIs] = exportedUTIs
+            
+            try (infoDictionary as NSDictionary).write(to: bundle.infoPlistURL)
+        }
+        
+        DispatchQueue.global().async {
+            do
+            {
+                let appBundleURL = self.context.temporaryDirectory.appendingPathComponent("App.app")
+                try FileManager.default.copyItem(at: fileURL, to: appBundleURL)
+                
+                // Become current so we can observe progress from unzipAppBundle().
+                progress.becomeCurrent(withPendingUnitCount: 1)
+                
+                guard let appBundle = Bundle(url: appBundleURL) else { throw ALTError(.missingAppBundle) }
+                guard let infoDictionary = appBundle.infoDictionary else { throw ALTError(.missingInfoPlist) }
+                
+                var allURLSchemes = infoDictionary[Bundle.Info.urlTypes] as? [[String: Any]] ?? []
+                
+                let altstoreURLScheme = ["CFBundleTypeRole": "Editor",
+                                         "CFBundleURLName": bundleIdentifier,
+                                         "CFBundleURLSchemes": [openURL.scheme!]] as [String : Any]
+                allURLSchemes.append(altstoreURLScheme)
+                
+                var additionalValues: [String: Any] = [Bundle.Info.urlTypes: allURLSchemes]
+
+                if self.context.bundleIdentifier == StoreApp.altstoreAppID || StoreApp.alternativeAltStoreAppIDs.contains(self.context.bundleIdentifier)
+                {
+                    guard let udid = Bundle.main.object(forInfoDictionaryKey: Bundle.Info.deviceID) as? String else { throw OperationError.unknownUDID }
+                    additionalValues[Bundle.Info.deviceID] = udid
+                    additionalValues[Bundle.Info.serverID] = UserDefaults.standard.preferredServerID
+                    
+                    if
+                        let data = Keychain.shared.signingCertificate,
+                        let signingCertificate = ALTCertificate(p12Data: data, password: nil),
+                        let encryptingPassword = Keychain.shared.signingCertificatePassword
+                    {
+                        additionalValues[Bundle.Info.certificateID] = signingCertificate.serialNumber
+                        
+                        let encryptedData = signingCertificate.encryptedP12Data(withPassword: encryptingPassword)
+                        try encryptedData?.write(to: appBundle.certificateURL, options: .atomic)
+                    }
+                    else
+                    {
+                        // The embedded certificate + certificate identifier are already in app bundle, no need to update them.
+                    }
+                }
+                
+                // Prepare app
+                try prepare(appBundle, additionalInfoDictionaryValues: additionalValues)
+                
+                if let directory = appBundle.builtInPlugInsURL, let enumerator = FileManager.default.enumerator(at: directory, includingPropertiesForKeys: nil, options: [.skipsSubdirectoryDescendants])
+                {
+                    for case let fileURL as URL in enumerator
+                    {
+                        guard let appExtension = Bundle(url: fileURL) else { throw ALTError(.missingAppBundle) }
+                        try prepare(appExtension)
+                    }
+                }
+                
+                completionHandler(.success(appBundleURL))
+            }
+            catch
+            {
+                completionHandler(.failure(error))
+            }
+        }
+        
+        return progress
+    }
+    
+    func resignAppBundle(at fileURL: URL, team: ALTTeam, certificate: ALTCertificate, profiles: [ALTProvisioningProfile], completionHandler: @escaping (Result<URL, Error>) -> Void) -> Progress
+    {
+        let signer = ALTSigner(team: team, certificate: certificate)
+        let progress = signer.signApp(at: fileURL, provisioningProfiles: profiles) { (success, error) in
+            do
+            {
+                try Result(success, error).get()
+                
+                let ipaURL = try FileManager.default.zipAppBundle(at: fileURL)
+                completionHandler(.success(ipaURL))
+            }
+            catch
+            {
+                completionHandler(.failure(error))
+            }
+        }
+        
+        return progress
+    }
+}

source-code/ALTs/AltStore/Operations/SendAppOperation.swift

@@ -0,0 +1,124 @@
+//
+//  SendAppOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 6/7/19.
+//  Copyright © 2019 Riley Testut. All rights reserved.
+//
+
+import Foundation
+import Network
+
+import AltKit
+
+@objc(SendAppOperation)
+class SendAppOperation: ResultOperation<ServerConnection>
+{
+    let context: AppOperationContext
+    
+    private let dispatchQueue = DispatchQueue(label: "com.altstore.SendAppOperation")
+    
+    private var serverConnection: ServerConnection?
+    
+    init(context: AppOperationContext)
+    {
+        self.context = context
+        
+        super.init()
+        
+        self.progress.totalUnitCount = 1
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        if let error = self.context.error
+        {
+            self.finish(.failure(error))
+            return
+        }
+        
+        guard let app = self.context.app, let server = self.context.server else { return self.finish(.failure(OperationError.invalidParameters)) }
+        
+        // self.context.resignedApp.fileURL points to the app bundle, but we want the .ipa.
+        let fileURL = InstalledApp.refreshedIPAURL(for: app)
+        
+        // Connect to server.
+        ServerManager.shared.connect(to: server) { (result) in
+            switch result
+            {
+            case .failure(let error): self.finish(.failure(error))
+            case .success(let serverConnection):
+                self.serverConnection = serverConnection
+                
+                // Send app to server.
+                self.sendApp(at: fileURL, via: serverConnection) { (result) in
+                    switch result
+                    {
+                    case .failure(let error): self.finish(.failure(error))
+                    case .success:
+                        self.progress.completedUnitCount += 1
+                        self.finish(.success(serverConnection))
+                    }
+                }
+            }
+        }
+    }
+}
+
+private extension SendAppOperation
+{
+    func sendApp(at fileURL: URL, via connection: ServerConnection, completionHandler: @escaping (Result<Void, Error>) -> Void)
+    {
+        do
+        {
+            guard let appData = try? Data(contentsOf: fileURL) else { throw OperationError.invalidApp }
+            guard let udid = Bundle.main.object(forInfoDictionaryKey: Bundle.Info.deviceID) as? String else { throw OperationError.unknownUDID }
+            
+            var request = PrepareAppRequest(udid: udid, contentSize: appData.count)
+            
+            if connection.server.connectionType == .local
+            {
+                // Background daemons have low memory limit (~6MB as of 13.5),
+                // so send just the file URL rather than the app data itself.
+                request.fileURL = fileURL
+            }
+            
+            connection.send(request) { (result) in
+                switch result
+                {
+                case .failure(let error): completionHandler(.failure(error))
+                case .success:
+                    
+                    if connection.server.connectionType == .local
+                    {
+                        // Sent file URL, so don't need to send any more.
+                        completionHandler(.success(()))
+                    }
+                    else
+                    {
+                        print("Sending app data (\(appData.count) bytes)...")
+                        
+                        connection.send(appData, prependSize: false) { (result) in
+                            switch result
+                            {
+                            case .failure(let error):
+                                print("Failed to send app data (\(appData.count) bytes)")
+                                completionHandler(.failure(error))
+                                
+                            case .success:
+                                print("Successfully sent app data (\(appData.count) bytes)")
+                                completionHandler(.success(()))
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        catch
+        {
+            completionHandler(.failure(error))
+        }
+    }
+}

source-code/ALTs/AltStore/Operations/VerifyAppOperation.swift

@@ -0,0 +1,144 @@
+//
+//  VerifyAppOperation.swift
+//  AltStore
+//
+//  Created by Riley Testut on 5/2/20.
+//  Copyright © 2020 Riley Testut. All rights reserved.
+//
+
+import Foundation
+
+import AltSign
+import AltKit
+
+import Roxas
+
+enum VerificationError: ALTLocalizedError
+{
+    case privateEntitlements(ALTApplication, entitlements: [String: Any])
+    case mismatchedBundleIdentifiers(ALTApplication, sourceBundleID: String)
+    
+    var app: ALTApplication {
+        switch self
+        {
+        case .privateEntitlements(let app, _): return app
+        case .mismatchedBundleIdentifiers(let app, _): return app
+        }
+    }
+    
+    var errorFailure: String? {
+        return String(format: NSLocalizedString("“%@” could not be installed.", comment: ""), app.name)
+    }
+    
+    var failureReason: String? {
+        switch self
+        {
+        case .privateEntitlements(let app, _):
+            return String(format: NSLocalizedString("“%@” requires private permissions.", comment: ""), app.name)
+            
+        case .mismatchedBundleIdentifiers(let app, let sourceBundleID):
+            return String(format: NSLocalizedString("The bundle ID “%@” does not match the one specified by the source (“%@”).", comment: ""), app.bundleIdentifier, sourceBundleID)
+        }
+    }
+}
+
+@objc(VerifyAppOperation)
+class VerifyAppOperation: ResultOperation<Void>
+{
+    let context: AppOperationContext
+    var verificationHandler: ((VerificationError) -> Bool)?
+    
+    init(context: AppOperationContext)
+    {
+        self.context = context
+        
+        super.init()
+    }
+    
+    override func main()
+    {
+        super.main()
+        
+        do
+        {
+            if let error = self.context.error
+            {
+                throw error
+            }
+            
+            guard let app = self.context.app else { throw OperationError.invalidParameters }
+            
+            guard app.bundleIdentifier == self.context.bundleIdentifier else {
+                throw VerificationError.mismatchedBundleIdentifiers(app, sourceBundleID: self.context.bundleIdentifier)
+            }
+                        
+            // Make sure this goes last, since once user responds to alert we don't do any more app verification.
+            if let commentStart = app.entitlementsString.range(of: "<!---><!-->"), let commentEnd = app.entitlementsString.range(of: "<!-- -->")
+            {
+                // Psychic Paper private entitlements.
+                
+                let entitlementsStart = app.entitlementsString.index(after: commentStart.upperBound)
+                let rawEntitlements = String(app.entitlementsString[entitlementsStart ..< commentEnd.lowerBound])
+                
+                let plistTemplate = """
+                    <?xml version="1.0" encoding="UTF-8"?>
+                    <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+                    <plist version="1.0">
+                        <dict>
+                        %@
+                        </dict>
+                    </plist>
+                    """
+                let entitlementsPlist = String(format: plistTemplate, rawEntitlements)
+                let entitlements = try PropertyListSerialization.propertyList(from: entitlementsPlist.data(using: .utf8)!, options: [], format: nil) as! [String: Any]
+                
+                let error = VerificationError.privateEntitlements(app, entitlements: entitlements)
+                self.process(error) { (result) in
+                    self.finish(result.mapError { $0 as Error })
+                }
+                
+                return
+            }
+            
+            self.finish(.success(()))
+        }
+        catch
+        {
+            self.finish(.failure(error))
+        }
+    }
+}
+
+private extension VerifyAppOperation
+{
+    func process(_ error: VerificationError, completion: @escaping (Result<Void, VerificationError>) -> Void)
+    {
+        guard let presentingViewController = self.context.presentingViewController else { return completion(.failure(error)) }
+        
+        DispatchQueue.main.async {
+            switch error
+            {
+            case .privateEntitlements(_, let entitlements):
+                let permissions = entitlements.keys.sorted().joined(separator: "\n")
+                let message = String(format: NSLocalizedString("""
+                    You must allow access to these private permissions before continuing:
+
+                    %@
+
+                    Private permissions allow apps to do more than normally allowed by iOS, including potentially accessing sensitive private data. Make sure to only install apps from sources you trust.
+                    """, comment: ""), permissions)
+                
+                let alertController = UIAlertController(title: error.failureReason ?? error.localizedDescription, message: message, preferredStyle: .alert)
+                alertController.addAction(UIAlertAction(title: NSLocalizedString("Allow Access", comment: ""), style: .destructive) { (action) in
+                    completion(.success(()))
+                })
+                alertController.addAction(UIAlertAction(title: NSLocalizedString("Deny Access", comment: ""), style: .default, handler: { (action) in
+                    completion(.failure(error))
+                }))
+                presentingViewController.present(alertController, animated: true, completion: nil)
+                
+            case .mismatchedBundleIdentifiers: return completion(.failure(error))
+            }
+        }
+    }
+}