Ok, thank you.

Thank you Eskimo. So this means that we *must* run the network extension in a sandbox even if we plan to release our app only outside the App Store? I'm asking because it sounds a bit strange to me. We were able to compile, notarize and run a non-sandboxed network extension on both Catalina and Big Sur, on a normal Mac (I mean with SIP activated, and so on). It worked perfectly, aside from the logs entries I already mentioned. Both the sysex and its container app were not sandboxed. Can you please clarify? I'm afraid I'm missing something obvious here...

I am developing a network extension based firewall and I have the same issue. trustd is reporting the same error: entitlement com.apple.application-identifier is ignored because of invalid application signature or incorrect provisioning profile The error disappears as soon as I enable sandbox for the network extension. Are network extensions only supposed to run in a sandbox? If not, why this error?