Ldid signs with 3 identical entitlements plist when signing bundle's frameworks

[superrnovae]

Command:

ldid -e 'YouTube.app/Frameworks/CydiaSubstrate.framework/CydiaSubstrate'

Expected result:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.iokit-user-client-class</key>
    <array>
        <string>IOUserClient</string>
    </array>
    <key>platform-application</key>
    <true/>
    <key>get-task-allow</key>
    <true/>
    <key>keychain-access-groups</key>
    <array>
        <string>com.google.ios.youtube</string>
    </array>
    <key>application-identifier</key>
    <string>com.google.ios.youtube</string>
    <key>aps-environment</key>
    <string>production</string>
    <key>com.apple.developer.usernotifications.time-sensitive</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <array>
        <string>group.com.google.ios.youtube</string>
    </array>
</dict>
</plist>

Actual result:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.iokit-user-client-class</key>
    <array>
        <string>IOUserClient</string>
    </array>
    <key>platform-application</key>
    <true/>
    <key>get-task-allow</key>
    <true/>
    <key>keychain-access-groups</key>
    <array>
        <string>com.google.ios.youtube</string>
    </array>
    <key>application-identifier</key>
    <string>com.google.ios.youtube</string>
    <key>aps-environment</key>
    <string>production</string>
    <key>com.apple.developer.usernotifications.time-sensitive</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <array>
        <string>group.com.google.ios.youtube</string>
    </array>
</dict>
</plist>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.iokit-user-client-class</key>
    <array>
        <string>IOUserClient</string>
    </array>
    <key>platform-application</key>
    <true/>
    <key>get-task-allow</key>
    <true/>
    <key>keychain-access-groups</key>
    <array>
        <string>com.google.ios.youtube</string>
    </array>
    <key>application-identifier</key>
    <string>com.google.ios.youtube</string>
    <key>aps-environment</key>
    <string>production</string>
    <key>com.apple.developer.usernotifications.time-sensitive</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <array>
        <string>group.com.google.ios.youtube</string>
    </array>
</dict>
</plist>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.iokit-user-client-class</key>
    <array>
        <string>IOUserClient</string>
    </array>
    <key>platform-application</key>
    <true/>
    <key>get-task-allow</key>
    <true/>
    <key>keychain-access-groups</key>
    <array>
        <string>com.google.ios.youtube</string>
    </array>
    <key>application-identifier</key>
    <string>com.google.ios.youtube</string>
    <key>aps-environment</key>
    <string>production</string>
    <key>com.apple.developer.usernotifications.time-sensitive</key>
    <true/>
    <key>com.apple.security.application-groups</key>
    <array>
        <string>group.com.google.ios.youtube</string>
    </array>
</dict>
</plist>

PlugIns and the main executable don't have this issue.

[CRKatri]

The entitlements from each slice of the FAT binary are listed, if you only want to see one, use ldid -arch arm64 -e.