[Bug]: macOS sandboxed app ships without embedded.provisionprofile — FileProviderExt entitlement rejected, keychain rewrite loop

### ⚠️ Before submitting, please verify the following: ⚠️

- [x] This is a **bug**, not a question or a configuration issue.
- [x] This issue is **not** already reported on Github (I've searched it).
- [x] Nextcloud Server and Desktop Client are **up to date**. See [Server Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule) and [Desktop Releases](https://nextcloud.com/install/#install-clients) for supported versions.
- [x] I agree to follow Nextcloud's [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/)

### Bug description

Version

Nextcloud Desktop Client 33.0.2 (also reproduced on 33.0.1)
macOS build, Developer ID distribution via official .pkg
Environment: macOS 15 (Darwin 25.4.0), Apple Silicon

Summary

Starting with 33.0.0 the macOS client was sandboxed (com.apple.security.app-sandbox=true) and
declares an App Group entitlement
(com.apple.security.application-groups=NKUJUXUJ3B.com.nextcloud.desktopclient). For sandboxed apps
distributed with Developer ID that use App Groups, Apple requires an embedded provisioning profile
(Contents/embedded.provisionprofile) authorizing the team to use that group.

The official .pkg for 33.0.1 and 33.0.2 does not contain embedded.provisionprofile inside the app
bundle. As a result macOS rejects the App Group entitlement, the FileProviderExt fails its internal
checks, retries every ~9 s, and on every retry rewrites ~/Library/Keychains/login.keychain-db
atomically.

This is a regression introduced by the 33.0.0 sandbox transition — the previous line (4.0.8, 3.16.x)
was not sandboxed and did not trigger this failure mode.

Evidence

1. Missing profile in the pkg payload

$ pkgutil --expand-full Nextcloud-33.0.2.pkg extracted
$ ls extracted/Nextcloud.pkg/Payload/Applications/Nextcloud.app/Contents/
_CodeSignature Frameworks Info.plist MacOS PlugIns Resources
# embedded.provisionprofile is NOT there

Same for Nextcloud-33.0.1.pkg.

2. System log com.apple.securityd

Filtered with log stream --predicate 'subsystem == "com.apple.securityd"' --style compact:

FileProviderExt[XXXX] [com.apple.securityd:secitemratelimit] Not internal release, disabling SIRL
secd [com.apple.securityd:SecWarning] Entitlement com.apple.security.application-groups=(
"NKUJUXUJ3B.com.nextcloud.desktopclient"
) is ignored because of invalid application signature or incorrect provisioning profile
secd [com.apple.securityd:SecError] FileProviderExt/1#4 LF=0 copy_matching Error
Domain=NSOSStatusErrorDomain Code=-25303 "attribute srvr not found in class genp"
securityd [com.apple.securityd:clientid] code requirement check failed (-67050), client is not
Apple-signed
FileProviderExt [com.apple.securityd:atomicfile] 0x... commited
/Users//Library/Keychains/login.keychain-db.sb- to
/Users//Library/Keychains/login.keychain-db

This block repeats every ~9 seconds, forever.

3. fs_usage on the keychain file

FileProviderExt WrData[S] B=0x68000 /Users//Library/Keychains/login.keychain-db.sb-
FileProviderExt rename /Users//Library/Keychains/login.keychain-db.sb-

Every ~9 s the temp file is written and renamed over login.keychain-db.

Entitlements declared by the app (33.0.1 / 33.0.2)

$ codesign -d --entitlements - /Applications/Nextcloud.app
[Key] com.apple.security.app-sandbox [Bool] true
[Key] com.apple.security.application-groups [Array]
["NKUJUXUJ3B.com.nextcloud.desktopclient"]
[Key] com.apple.security.files.bookmarks.app-scope [Bool] true
[Key] com.apple.security.files.user-selected.read-write [Bool] true
[Key] com.apple.security.network.client [Bool] true

Signature and notarization are otherwise valid:

$ codesign -dv /Applications/Nextcloud.app
Authority=Developer ID Application: Nextcloud GmbH (NKUJUXUJ3B)
TeamIdentifier=NKUJUXUJ3B
$ pkgutil --check-signature Nextcloud-33.0.2.pkg
Status: signed by a developer certificate issued by Apple for distribution
Notarization: trusted by the Apple notary service

Impact

1. FileProviderExt cannot access its shared container / keychain items, so it retries forever.
2. The continuous atomic rewrite of login.keychain-db invalidates in-memory keychain handles for
other apps. In my case it caused Claude Code (Anthropic CLI) to lose its keychain credential between
sessions — each launch showed "Not logged in". Killing FileProviderExt (pkill -f FileProviderExt)
stops the loop and the problem disappears.
3. Constant disk writes and CPU wake-ups (battery impact, likely audible on fanned Macs).

Suggested fix

Embed a valid embedded.provisionprofile (Developer ID + App Group authorization for
NKUJUXUJ3B.com.nextcloud.desktopclient) in the signed .app before packaging the .pkg. Apple's docs:
https://developer.apple.com/documentation/xcode/distributing-your-app-outside-the-mac-app-store —
section on App Groups for Developer ID apps.

This was likely lost in the pipeline change that introduced sandboxing in 33.0.0.

Workaround until fix is released

Keep the desktop client quit when not syncing. Killing FileProviderExt stops the loop without
affecting the .app itself.

---Diagnosis done with log stream, fs_usage, codesign, pkgutil --expand-full on macOS 15 / Apple
Silicon on 2026-04-18.

### Steps to reproduce

1. Right click on the file
2. Click on Share Options
3. The share dialog does not display the option to share by e-mail
...

### Expected behavior

1. On macOS (tested on 15 / Apple Silicon), download the official
Nextcloud-33.0.2.pkg from
https://github.com/nextcloud-releases/desktop/releases
2. Install it with: sudo installer -pkg Nextcloud-33.0.2.pkg -target /
3. Launch /Applications/Nextcloud.app and log in to any account
(VFS/File Provider mode or classic sync, does not matter).
4. In a Terminal, run:
log stream --predicate 'subsystem == "com.apple.securityd"' --style compact
Observe the following block repeating every ~9 seconds, forever:
- "Entitlement com.apple.security.application-groups=(
\"NKUJUXUJ3B.com.nextcloud.desktopclient\") is ignored because of
invalid application signature or incorrect provisioning profile"
- "code requirement check failed (-67050), client is not Apple-signed"
- "atomicfile commited .../login.keychain-db.sb- to login.keychain-db"
5. Confirm the root cause by inspecting the bundle:
ls /Applications/Nextcloud.app/Contents/embedded.provisionprofile
→ "No such file or directory"
6. Quitting Nextcloud.app and running `pkill -f FileProviderExt`
stops the loop immediately, confirming FileProviderExt as the source.

E per gli altri campi tipici del template, se te li chiede separati:

Expected behavior
FileProviderExt should load its App Group entitlement successfully and
sync files without rejecting the entitlement. The login keychain file
should not be rewritten continuously.

Actual behavior
macOS rejects the App Group entitlement because the app bundle is
sandboxed but ships without embedded.provisionprofile.
FileProviderExt fails and retries every ~9 s, rewriting
~/Library/Keychains/login.keychain-db atomically on every retry. This
invalidates keychain handles held by other apps on the system.

### Which files are affected by this bug

- Missing file inside the distributed .app (root cause): /Applications/Nextcloud.app/Contents/embedded.provisionprofile (also missing in the .pkg payload at Nextcloud.pkg/Payload/Applications/Nextcloud.app/Contents/) - System file continuously rewritten as a side effect: ~/Library/Keychains/login.keychain-db (atomic rewrite via temporary ~/Library/Keychains/login.keychain-db.sb- every ~9 seconds while FileProviderExt is running) - Not a user-data / sync-folder bug: no files inside the user's Nextcloud sync folder or under ~/Library/CloudStorage/ are affected.

### Operating system

macOS

### Which version of the operating system you are running.

macOS 15 / Apple Silicon on 2026-04-18.

### Package

Official macOS 12+ universal pkg

### Nextcloud Server version

32.0.1

### Nextcloud Desktop Client version

33.0.2 (also reproduced on 33.0.1)

### Is this bug present after an update or on a fresh install?

Updated to a major version (ex. 3.16.3 to 3.17.0)

### Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

### Are you using an external user-backend?

- [x] Default internal user-backend
- [ ] LDAP/ Active Directory
- [ ] SSO - SAML
- [ ] Other

### Nextcloud Server logs

```shell
Not applicable — FileProviderExt fails during macOS entitlement
validation on the client, before any request reaches the server.
No corresponding server-side log lines are generated.
```

### Additional info

_No response_