Ok, so in
TIMOB-23908 we fixed the missing APS-environment key in our entitlements file by grabbing the correct keys from the provisioning profiles. And as of TIMOB-23897, we suggested to create a custom entitlements file to add the keychain access to the entitlements.
Unfortunately, those two are concurring, causing the generated entitlements to be overwritten by the own one (which is I guess the intended behavior like we used to do with our Info.plist).
So we need to come up with a solution that a) merged the two files properly or b) generates the keychain-access-groups key whenever the ti.facebook module is used. I could think of a CLI-hook that is part of the plugin, like we recently did with the appcelerator.encrypteddatabase module.