What is the minimum supported macOS?

[scrutinizer11]

Hello,

I run several macOS, and it fails to start on macOS 10.9 even before reaching the authentication barrier. What is the minimum? I checked, and I have Py 3.10 (pip3.10) installed. Is it not enough?

[AndreyNikiforov]

What error do you see? How do you start icloudpd?

Each release comes with compatibility chart and for the latest one icloudpd ran "fine" on macos 12 through 14. Prior versions of MacOS are not available for testing, so compatibility is not guaranteed.

icloudpd is available as binary and does not require python. It is also available through package manages, including pip (python). When installing with pip, icloudpd will try to use binary distribution and min python version for that is 2.x. Pip can also install source package and for that 3.8+ is supported.

[scrutinizer11]

This is a sequence in which the run terminates:

$ icloudpd -u *************@gmail.com -p ************* --list-albums
2024-10-14 15:49:51 DEBUG    Authenticating...
Traceback (most recent call last):
  File "starters/icloudpd.py", line 6, in <module>
  File "click/core.py", line 1157, in __call__
  File "click/core.py", line 1078, in main
  File "click/core.py", line 1434, in invoke
  File "click/core.py", line 783, in invoke
  File "icloudpd/base.py", line 745, in main
  File "icloudpd/base.py", line 1179, in core
  File "icloudpd/authentication.py", line 53, in authenticate_
  File "pyicloud_ipd/base.py", line 157, in __init__
  File "pyicloud_ipd/base.py", line 211, in authenticate
  File "requests/sessions.py", line 637, in post
  File "pyicloud_ipd/session.py", line 65, in request
  File "requests/sessions.py", line 589, in request
  File "requests/sessions.py", line 703, in send
  File "requests/adapters.py", line 454, in send
  File "requests/adapters.py", line 346, in get_connection
requests.exceptions.InvalidProxyURL: Please check proxy URL. It is malformed and could be missing the host.
[61884] Failed to execute script 'icloudpd' due to unhandled exception!

[AndreyNikiforov]

The error suggests that you have proxy configured for your OS. Is that correct?

[scrutinizer11]

Yes. But I cannot go without it, or 99% of online services, including browsing, won't be accessible to a system that old. Is there a workaround?

[AndreyNikiforov]

Yes. But I cannot go without it, or 99% of online services, including browsing, won't be accessible to a system that old. Is there a workaround?

Just curious how proxy helps making services/browsing accessible. IIUC proxy can help with limiting access and/or caching, not "modernizing" the environment.

[scrutinizer11]

Just curious how proxy helps making services/browsing accessible. IIUC proxy can help with limiting access and/or caching, not "modernizing" the environment.

It was configured so that tweaking its parameters isn't possible. As such, I can't modify that variable. A MacRumors forum thread about the proxy for old systems:

https://forums.macrumors.com/threads/a-proxy-to-fix-https-issues-on-old-versions-of-os-x.2281326

The developer's Github profile if interested:
https://github.com/Wowfunhappy

[AndreyNikiforov]

found old issue #772. I assume your issue may be related to the format of the proxy url (as error suggests). Light googling brought discussion about unsupported schemaless proxy urls...

[AndreyNikiforov]

example of the proxy env var HTTP_PROXY="http://10.10.1.10:3128"

[scrutinizer11]

Per the system attribute command of the Standard Additions osax, the form of my proxy is localhost:3128. I don't desire to delve into developer stuff, as I'm just a user. I want it to be fixed. Can you do anything about that, for example, by adding an option to respect/ignore the proxy?

[AndreyNikiforov]

try specifying proxy with schema, e.g. "http://localhost:3128"

[scrutinizer11]

Could you be more elaborative? I don't know how to do it. I use the static binary.

[AndreyNikiforov]

Could you be more elaborative? I don't know how to do it. I use the static binary.

When you use proxy, you have to do two things:

1. setup proxy itself
2. let every app know that they have to use proxy

The second part is done with setting environmental variable, e.g. HTTP_PROXY. If you set that var to url without schema (just "localhost:3128"), then icloudpd throws the error you see, so, you need to use url with schema, e.g. "http://localhost:3128". This is just an idea to try as I do not use proxy and simply googled your problem.

[AndreyNikiforov]

try in shell

$ HTTPS_PROXY=http://localhost:3128 icloudpd --auth-only

[scrutinizer11]

It gets crashed with the message:

$ HTTPS_PROXY=http://localhost:3128 icloudpd --auth-only
iCloud username/email: **************@gmail.com
2024-10-16 22:39:13 DEBUG    Authenticating...
iCloud Password: 
Traceback (most recent call last):
  File "urllib3/connectionpool.py", line 711, in urlopen
  File "urllib3/connectionpool.py", line 1007, in _prepare_proxy
  File "urllib3/connection.py", line 419, in connect
  File "urllib3/util/ssl_.py", line 449, in ssl_wrap_socket
  File "urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl
  File "ssl.py", line 455, in wrap_socket
  File "ssl.py", line 1042, in _create
  File "ssl.py", line 1320, in do_handshake
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1000)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "requests/adapters.py", line 486, in send
  File "urllib3/connectionpool.py", line 798, in urlopen
  File "urllib3/util/retry.py", line 592, in increment
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='idmsa.apple.com', port=443): Max retries exceeded with url: /appleauth/auth/signin?isRememberMeEnabled=true (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1000)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "starters/icloudpd.py", line 6, in <module>
  File "click/core.py", line 1157, in __call__
  File "click/core.py", line 1078, in main
  File "click/core.py", line 1434, in invoke
  File "click/core.py", line 783, in invoke
  File "icloudpd/base.py", line 745, in main
  File "icloudpd/base.py", line 1179, in core
  File "icloudpd/authentication.py", line 53, in authenticate_
  File "pyicloud_ipd/base.py", line 157, in __init__
  File "pyicloud_ipd/base.py", line 211, in authenticate
  File "requests/sessions.py", line 637, in post
  File "pyicloud_ipd/session.py", line 65, in request
  File "requests/sessions.py", line 589, in request
  File "requests/sessions.py", line 703, in send
  File "requests/adapters.py", line 517, in send
requests.exceptions.SSLError: HTTPSConnectionPool(host='idmsa.apple.com', port=443): Max retries exceeded with url: /appleauth/auth/signin?isRememberMeEnabled=true (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1000)')))
[71783] Failed to execute script 'icloudpd' due to unhandled exception!

The same message with a verification code appended (this is a 2FA account). I want to add that the proxy I run tends to break some Apple domains, so it could be the culprit. Can icloudpd set exclusions to proxying?

[AndreyNikiforov]

That confirmed that proxy config was used and icloudpd connected through proxy. I don't know how that specific proxy of yours is supposed to tweak certificates and how apps are supposed to work with them.

icloudpd uses TLS for connecting to Apple, so HTTPS_PROXY seems to be the correct one to use, but you can try HTTP_PROXY (not httpS) as well.

[AndreyNikiforov]

Can icloudpd set exclusions to proxying?

IIUC You set up proxy for fixing outdated OS-level certificates, so bypassing proxy for icloudpd traffic seems against your goals. To try, you can just shut down proxy and see if icloudpd works, right? If works without proxy, you can experiment with using empty value for/unset HTTPS_PROXY var.

[scrutinizer11]

It still fails. Ok, so a huge thank you for your patience and suggestions, trying to sort it out. I think all the options are exhausted by now, but the recurring motive in the messages appears to be SSL certificates. Apple may have deliberately cut off all connection attempts from the systems below a predefined threshold. They've done that with Facetime on macOS 10.9 recently where the app connects successfully, but a server rejects authorization. I believe this involves cypher suites and cert pinning – two vectors over which Apple exerts unlimited control.

[AndreyNikiforov]

I wonder if amount of time/effort of running outdated macos is more than standing up a separate linux, even if for icloudpd alone, - anything from old laptop to raspbery pi/etc... (I did not explore rpi path, just an idea)

[scrutinizer11]

I don't want Linux. Old OSX, such as 10.9, proved more cost-effective for more than 90% of the demands from many people, including me. I can use newer macOSes but I find them limiting. Already some aspects of 10.9 look bothersome. I can live without Facetime, iTunes and App Store on 10.9.

Speaking about a proxy, the yt-dlp utility has the option to switch it on and off.

[AndreyNikiforov]

good luck