mirror of
https://github.com/yattee/yattee.git
synced 2026-10-23 13:12:53 +00:00
2d23820e14
Fifth review pass, which prompted measuring whether SecItemDelete can be conditioned on a value. It cannot: a delete issued with a deliberately wrong kSecValueData still returns 0 and removes the item, so there is no compare-and-delete and every check-then-delete is a race by construction. That measurement decides both fixes here. Adoption no longer rolls back its own write when the verification read comes back empty. The rollback could only ever be a blind delete of whatever occupied the key by then - including a credential synced from another device in the gap - and it would propagate. Nothing is deleted; no marker is written, so the account stays signed out and an ordinary sign-in recovers it. Legacy deletion re-reads immediately before deleting and aborts if the value moved, shrinking the window to a single call gap and catching a replacement that landed while the fingerprint was being computed. A residual race remains and is documented at the call site: closing it is not possible with these APIs, and never deleting would leave a credential the user explicitly removed sitting in their iCloud Keychain. The debug provenance report repeated the same nil-token ambiguity the scope logic was fixed for, reporting "no Apple account signed in" when iCloud Drive is merely off. It now reports the token as unavailable and shows CloudKit's account status separately, so a re-run cannot draw a false conclusion from it.
Yattee
Privacy oriented video player for iOS, tvOS and macOS
Yattee 2 is in the works! A new version of the app is being built with a refreshed experience. It pairs with the new Yattee Server — a self-hosted backend powered by yt-dlp that supports 1000+ sites. Join the TestFlight beta to try early builds, and check the new documentation site at docs.yattee.stream for guides, roadmap and changelog.
Features
- Native user interface built with SwiftUI with customization settings
- Player queue and history
- Player component with custom controls, gestures and support for 4K playback
- Fullscreen, Picture in Picture and background audio playback
- SponsorBlock, configurable categories to skip
License
Yattee and its components is shared on AGPL v3 license.