Share to Telegram does nothing: TelegramShare.appex is killed by AMFI (keychain-access-groups without a provisioning profile) #48

Activity

1. farhadmohammadi825-lab commented on Oct 27, 2026

   

   farhadmohammadi825-lab

   on Oct 27, 2026

   More actions

   Summary

   In the direct-download build (Developer ID), choosing Telegram in any macOS share menu does nothing. The share window never appears, and the host's share sheet stays on "Sending…" or closes silently. Messages and AirDrop work for the same file.

   The share extension never starts. AMFI kills it on launch because the shipped TelegramShare.appex is signed with keychain-access-groups, and the bundle has no provisioning profile. The entitlement is not in this repository, so it seems to be added when the build is re-signed for distribution.

   Telegram: 13.0 (283305), from telegram.org, signed by Developer ID 6N38VWS5BX
   macOS: 27.0 (26A428), Apple silicon

   Steps to reproduce

   1. Install Telegram 13.0 from telegram.org (not the Mac App Store).
   2. In Finder, right-click any file → Share → Telegram.
   3. Nothing happens.

   Running the extension binary directly shows the cause:

   $ /Applications/Telegram.app/Contents/PlugIns/TelegramShare.appex/Contents/MacOS/TelegramShare; echo "exit=$?"
   exit=137
   
   $ /usr/bin/log show --last 1m --style compact --predicate 'process == "amfid"'
   amfid: /Applications/Telegram.app/Contents/PlugIns/TelegramShare.appex/Contents/MacOS/TelegramShare not valid:
   Error Domain=AppleMobileFileIntegrityError Code=-413 "No matching profile found"
   

   When the share menu launches the extension, the host logs Launch failed (RBSRequestErrorDomain 5, NSPOSIXErrorDomain 163).

   Cause

   The shipped extension has an entitlement that only a provisioning profile can authorize, and no profile is embedded:

   $ codesign -d --entitlements :- /Applications/Telegram.app/Contents/PlugIns/TelegramShare.appex
   com.apple.security.app-sandbox                   = true
   com.apple.security.application-groups            = [6N38VWS5BX.ru.keepcoder.Telegram.TelegramShare, 6N38VWS5BX.ru.keepcoder.Telegram]
   com.apple.security.files.user-selected.read-only = true
   com.apple.security.network.client                = true
   keychain-access-groups                           = [6N38VWS5BX.ru.keepcoder.TelegramShare, 6N38VWS5BX.ru.keepcoder.Telegram]   <-- needs a profile
   
   $ ls /Applications/Telegram.app/Contents/PlugIns/TelegramShare.appex/Contents
   Info.plist  MacOS  Resources  _CodeSignature          (no embedded.provisionprofile)
   

   Telegram.app itself has no embedded.provisionprofile either. It launches because its entitlements don't need one.

   Where the entitlement comes from

   It is not in this repository:

   • TelegramShare/TelegramShare.entitlements on master has only app-sandbox, app groups, files.user-selected.read-only and network.client. It matches the shipped extension except for keychain-access-groups.
   • The shipped Telegram.app entitlements match Telegram-Mac/Telegram-Mac.entitlements exactly.
   • The two keychain groups in the extension are the ones from Telegram-Mac/Telegram-Sandbox.entitlements (the sandboxed App Store app), including ru.keepcoder.TelegramShare without the .Telegram. infix. That string appears nowhere else in the repository.

   Per .gitlab-ci.yml and buildbox/internal.sh, the pipeline runs build-mac.sh (xcodebuild archive), then verify-build.sh, then deploy-$tag.sh from ../deploy. The last step is outside this repository. My guess is that the Developer ID re-sign in that step signs the extension with an entitlements file that contains the App Store keychain groups. I can't see that script, so please check it.

   Possible fixes

   Either of these should work:

   1. Drop keychain-access-groups from the extension in the Developer ID re-sign, so it is signed with TelegramShare/TelegramShare.entitlements as in the repository. Nothing in TelegramShare/ uses a keychain access group.
   2. Keep the entitlement and embed a profile: create a Developer ID provisioning profile for ru.keepcoder.Telegram.TelegramShare with Keychain Sharing, and ship it as TelegramShare.appex/Contents/embedded.provisionprofile.

   To check a fixed build:

   codesign -d --entitlements :- Telegram.app/Contents/PlugIns/TelegramShare.appex
   

   Either keychain-access-groups is gone, or the extension contains embedded.provisionprofile. Then running the extension binary should not get killed, and log show should have no amfid -413 line for it.

   verify-build.sh runs before deploy-$tag.sh, so it checks the archive and not the re-signed app. A check like the one above, run after the re-sign and before upload, would catch this kind of regression. I can send a PR with a small script for that if it would help.

   Not verified

   • I haven't checked whether the Mac App Store build is affected.
   • I haven't checked which earlier version first shipped with this entitlement.