title: Entilements not matching provisioning
body: <p>Lately I've been having issues deploying my applications in-house
  (enterprise developer program) with reports that some entitlement
  values were not the ones specified in the provisioning profile.
  I started looking into the issue, and found that, of course, the
  values weren't a match:</p>
  
  <p>Contents of the .mobileprovision file:
  (as extracted by running <code>security cms -D -i &lt;mobileprovision file&gt;</code>)</p>
  
  <pre><code>           &lt;key&gt;application-identifier&lt;/key&gt;
             &lt;string&gt;M7X5D8MA6U.some.masked.Identifier&lt;/string&gt;
             &lt;key&gt;com.apple.developer.ubiquity-container-identifiers&lt;/key&gt;
             &lt;array&gt;
                     &lt;string&gt;KNHHJPPHR7.*&lt;/string&gt;
             &lt;/array&gt;
             &lt;key&gt;com.apple.developer.ubiquity-kvstore-identifier&lt;/key&gt;
             &lt;string&gt;KNHHJPPHR7.*&lt;/string&gt;
             &lt;key&gt;get-task-allow&lt;/key&gt;
             &lt;false/&gt;
             &lt;key&gt;keychain-access-groups&lt;/key&gt;
             &lt;array&gt;
                     &lt;string&gt;M7X5D8MA6U.*&lt;/string&gt;
             &lt;/array&gt;
  </code></pre>
  
  <p>And the entitlements are (as extracted running: <code>codesign -d --entitlements - &lt;app bundle&gt;</code>)</p>
  
  <pre><code>   &lt;key&gt;application-identifier&lt;/key&gt;
     &lt;string&gt;5R678HMG35.some.masked.Identifier&lt;/string&gt;
     &lt;key&gt;get-task-allow&lt;/key&gt;
     &lt;false/&gt;
     &lt;key&gt;keychain-access-groups&lt;/key&gt;
     &lt;array&gt;
             &lt;string&gt;5R678HMG35.some.masked.Identifier&lt;/string&gt;
     &lt;/array&gt;
  </code></pre>
  
  <p>I'm not specifying any entitlements file in my project, and the
  mobileprovision file was downloaded fresh from the Portal.</p>
  
  <p>Should I create an Entitlements.plist with those values just to make
  the installer happy or is there a less hackish way of solving this?
  And more importantly, why is this happening only with some builds of
  my app? (Some other builds are fine)</p>
  
  <p>Any other tips on how to solve and/or avoid this problem?</p>
  
  <p>I have already tried the usual suspects: deleting all profiles, recreating profiles, re-downloading the certificate, etc...</p>
  
  <p>Thanks!</p>