@unbound-app/loader-ios

Tweak to inject Unbound into Discord and perform various utility tasks.

Installation

Builds can be found in the Releases tab.

Jailbroken

• Either add the apt repo to your package manager: https://repo.unbound.rip
• Or install Unbound by downloading the appropriate Debian package (or by building your own, see Building) and adding it to your package manager.

Jailed

     

Warning

Trying to use non-ellekit tweak runtimes will likely break functionality. Ideally always use the pre-patched ipa when sideloading.

• Either add the altsource to your on-device sideloading tool: https://repo.unbound.rip/app-repo.json
• Or download and install Unbound.ipa using your preferred sideloading method.

Building

Note

Unless you plan on modifying source code you should fork this repository and use the provided workflow.

Instructions

These steps assume you use macOS.

1. Install Xcode from the App Store. If you've previously installed the Command Line Utilities package, you will need to run sudo xcode-select -switch /Applications/Xcode.app/Contents/Developer to make sure you're using the Xcode tools instead.

If you want to revert the xcode-select change, run sudo xcode-select -switch /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk

2. Install the required dependencies. You can do this by running brew install make ldid in your terminal. If you do not have brew installed, follow the instructions at the Homebrew installation page.

3. Setup your gnu make path:

export PATH="$(brew --prefix make)/libexec/gnubin:$PATH"

4. Setup theos by running the script provided by theos.

bash -c "$(curl -fsSL https://raw.githubusercontent.com/theos/theos/master/bin/install-theos)"

If you've already installed theos, you can run $THEOS/bin/update-theos to make sure it's up to date.

5. Clone this repository via git clone git@github.com:unbound-app/loader-ios.git and cd into it.

6. To build, you can run make package.

The resulting .deb file will be in the packages folder.

Embedded attestation

Release builds embed a P-256/SHA-256 attestation in each architecture slice of the injected dylib. The runtime verifier uses iOS SecKey APIs and canonicalizes the Mach-O image so the outer iOS code signature can be replaced without invalidating the attestation. Debug builds intentionally omit the attestation.

The release signer reads ATTESTATION_PK in CI or the ignored local attestation_private.pem file. The matching public key is pinned in tools/attestation_public_key.b64; the private key must never be committed. The build workflow creates GitHub Sigstore provenance attestations for the Debian package, injected IPA, and Simulator archive. Verify a downloaded GitHub artifact with gh attestation verify <artifact> --repo unbound-app/loader-ios.

Live reload (HMR)

When working on the JavaScript client you can have the app reload automatically whenever you rebuild the bundle, instead of relaunching by hand.

1. Run the client's dev server (bun scripts/dev in the client repo). It serves the bundle and a Server-Sent Events stream at /__hot.
2. In Unbound's settings, set:
   • loader.update.url to your dev server's bundle URL, e.g. http://<your-LAN-ip>:3000/unbound.bundle
   • loader.update.hmr to true
3. Launch Discord. The loader connects to <origin>/__hot; when you edit a file and the dev server rebuilds, the app re-fetches the bundle and reloads automatically.

loader.update.hmr is off by default, so this never runs for normal users. The HMR endpoint is derived from loader.update.url's origin — no separate setting needed.

Contributors