I have items written to the keychain by an XPC service. On disk, it's just a plain binary. There are times when this service shows a system authentication dialog via LAContext. By default, the application icon is a tiny version of a terminal. We found that if we wrap the binary in a bundle, we can include an icon and it will show up in the authentication dialog. The problem is that this new bundle seems to be different, as updates to an existing keychain item (created by the old, standalone binary) fail with errSecInvalidOwnerEdit. The bundle ID of the embedded binary has not changed. How does the system decide who is the owner of a keychain item and is there any way to do a migration like this without affecting item ownership?

I have an update for an app that includes a new app clip and I'm having trouble getting through review. According to runtime logging, my scene delegate never receives any NSUserActivity instances in scene(_:willConnectTo:options:). scene(_:continue:) is never called at all. App review is rejecting the build because the app clip appears to load indefinitely, but without an invocation URL, there is nothing to display. I've asked for detail about how they're invoking the app clip and they can't (or won't) provide it. Has anyone else experienced this during review?