Pastel for macOS: downloading older IPA versions of iOS apps

The problem Pastel solves: getting an older build of an iOS app onto a device

The App Store serves the current version of an app and nothing else. If a newer release broke a workflow, dropped a feature, or changed a subscription screen you depend on, there is no supported way to ask Apple for the build you were running last month. The version IDs exist, and Apple's servers still hold the binaries, but the storefront UI never exposes them.

Pastel is a macOS front end for that gap. It searches App Store listings by region, resolves historical version IDs, downloads the IPA for the version you pick, and then gets the file onto an iPhone or iPad through the system share sheet or AirDrop. The README frames the audience implicitly: this is a desktop tool for someone who owns a Mac and an iPhone, uses a graphical interface rather than a terminal, and already knows what an IPA file is. It is not a jailbreak tool, not a sideloading utility for arbitrary apps, and not a way to install software you have not obtained through an Apple account.

How the version lookup and download pipeline actually works

Pastel does not maintain its own archive of old builds. The README states that it aggregates version ID information from three external sources, named as Timbrd, Agsy and Bilin, and that it can also pull an app's version record directly from the Apple account. That distinction matters: the third-party sources supply identifiers, while Apple supplies the binary. If a source is wrong or stale, the download step fails rather than silently falling back.

Account handling is region-aware. Pastel selects the storefront based on the region of the Apple account you added, and when you switch regions it matches the corresponding logged-in account, so a US account and a Japanese account do not cross wires. For free apps the account has never owned, the README says Pastel will first try to acquire the app so the version record becomes available; paid apps are excluded from that step.

The authentication layer is the part with the most dependencies. The README states that Pastel's login protocol and security checks follow majd/ipatool, the GSA login flow depends on SideStore, and Device GUID logic references Lakr233/Asspp. Credentials are stored in the system iCloud Keychain. Because the flow relies on macOS's own StoreServices, it has to run on genuine hardware: the README says the new authentication method requires a real Apple Silicon Mac and that virtual machines still cannot log in or download an IPA. Proxy handling is delegated to the system, honouring HTTP, HTTPS, SOCKS5, ALL_PROXY, NO_PROXY and macOS exclusion rules.

Installing Pastel on macOS and completing the first download

The README's first-use path is a DMG install, not a package manager. Download the latest DMG from the GitHub Releases page and drag Pastel into Applications. The system requirements table is strict: macOS 26 or later, Apple Silicon, a real Mac, and network access to Apple services (a proxy is suggested when the connection is unstable).

Once Pastel is open, the Apple account lives under Settings. The README lists the sequence as opening Settings, going to Apple Account, adding an account, and completing two-factor authentication when prompted. On success, Pastel reads the account's region and configures the storefront for it.

From there, search for the app in the storefront for that region, open its detail page, and choose a version. If you already know the target version ID, the README says you can enter the App ID and version ID manually instead of relying on the aggregated sources.

Downloaded IPAs and their app icons appear on the download page, where the share button sends the file onward. AirDrop to an iPhone or iPad is the documented route.

If you would rather build from source, the README gives a two-part procedure. First install the Node.js dependencies in the NodeProject directory:

cd NodeProject
npm install
cd ..

Then open Pastel.xcodeproj in Xcode and build. The repository layout matches this: there are Pastel/, NodeProject/, Scripts/, node/ and release-notes/ directories alongside the Xcode project and an appcast.xml at the top level.

Where Pastel stops being the right tool

The hardware and OS constraints are absolute, not preferences. macOS 26 or later, Apple Silicon, and no virtual machines. The README is explicit that the authentication method requires a real Apple Silicon Mac and that virtualised environments cannot log in or download. Anyone running a VM to isolate an Apple account, or anyone on an Intel Mac, is locked out regardless of how the rest of the app behaves.

Paid apps are the second boundary. The README says Pastel will try to acquire a free app the account has never owned so that a version record becomes available, but explicitly excludes paid apps. If your target is a paid purchase tied to a different account, the version lookup path described in the README does not cover it.

There is also a dependency the project does not control. Version IDs come from Timbrd, Agsy, Bilin and the Apple account. The README does not document what happens when those sources disagree, how current each one is, or whether a failed lookup can be retried against a different source. That is the weakest documented link in the chain, and it sits upstream of every download.

Finally, the release cadence is unusual. Builds are named by date, and the README labels 20260831 a forced update, telling users to download the latest version. A tool that can require you to update before it will authenticate is a poor fit for anyone who needs a frozen, reproducible build.

Pastel compared with ipatool and the command line

The closest reference point is majd/ipatool, which Pastel's own README credits for the login protocol and security checks. The difference is the interface and the surrounding workflow, not the underlying account mechanics. ipatool is a command-line tool: you authenticate, search, and download from a shell, and you script the rest yourself. Pastel wraps that in a SwiftUI app with a searchable storefront browser, app icons, a download list, and a share button that hands the IPA to AirDrop.

The trade-off runs in both directions. Pastel gives you region-aware account switching and a visual version picker without writing anything, and it inherits ipatool's authentication approach rather than inventing its own. In exchange you accept a GUI-only path, a macOS 26 and Apple Silicon floor, and a forced-update policy. A command-line workflow is easier to pin, script, and run on a headless machine, which is precisely what Pastel's real-Mac requirement rules out. If your process is automated, Pastel is the wrong layer. If your process is a person clicking through to get one old build onto one phone, the GUI is the point.

Pastel also credits beer-psi/ipatool.ts for some code and implementation details, SideStore for the GSA login flow, and Lakr233/Asspp for Device GUID logic. Those credits are a useful map of what is original here and what is inherited.

Maintenance cadence, licensing and what an upgrade costs you

The repository is not archived, and its last push was on 2026-09-07. The recent releases are dated builds: Pastel20260907, Pastel20260906 and Pastel20260901, all within the first week of September 2026. Three releases in seven days suggests either rapid iteration or a fix-forward response to Apple's account changes, and the README's 2026-08-31 notice points at the second reading: it describes an adaptation to Apple's latest account login adjustments and calls 20260831 a forced update.

The practical upgrade cost is therefore not zero. Because authentication depends on Apple's StoreServices behaviour and on a protocol mirrored from ipatool, a change on Apple's side can invalidate an installed build, and the project's answer is to publish a new dated release. Budget for updating when login breaks rather than on a schedule you choose. There is no documented rollback path, and the README does not describe what a failed upgrade leaves behind.

On licensing, Pastel is Apache-2.0, which permits commercial and private use and requires preservation of notices; the repository includes a LICENSE file at the top level. That covers Pastel's own code. It does not grant anything around the IPA files you download, which come from Apple under Apple's terms, and the README does not discuss redistribution. Treat the licence question as separate from the download question, and get real advice if you plan to ship anything built on this.

Editorial conclusion

Pastel is for people who already understand what an IPA is and want a GUI over the App Store's version history instead of a command-line tool: the README's flow is download the DMG, add an Apple account in Settings, search, pick a version ID, then AirDrop. It is not for anyone on an Intel Mac, a macOS release below 26, or a virtual machine, because the README states the authentication path depends on macOS StoreServices and that virtualised environments cannot log in or download. Before relying on it, verify three things on your own machine: that the login survives a reboot, that the version IDs returned for your app actually produce a working IPA, and that the paid-app limitation is not in your way. Pastel's own versioning is dated rather than semantic, and the README calls 20260831 a forced update, so check the releases page before you file a bug against an older build.

Frequently asked questions

Official sources

1. EEliberto/Pastel-macOS on GitHub
2. Issues
3. License: Apache-2.0
4. README
5. Releases