Sideload & App Group
Why worse_query apps require an App Group entitlement, which sideloaders preserve it, and how to export an off-device MobileGestalt backup.
- Best signers: SideStore / AltStore / Impactor
- Avoid: Sideloadly & wildcard (*)
- Free Apple ID: 7-day refresh
Rule #1: Your signer must provision an App Group
Every tool built on forcequitOS/worse_query, including WQFiles, GestaltX, Regitela, KAMUI, and WorkTweaks, requires a valid com.apple.security.application-groups entitlement. That is because worse_query uses your app’s own writable App Group container (MCM class 7) to obtain sandbox tokens for other containers. The exact group name does not matter: each app reads its own signed entitlements at runtime and uses whichever App Group it received.
| Sideloading Method | worse_query Compatibility | How It Handles App Group Provisioning |
|---|---|---|
| SideStore / AltStore | Supported (Recommended) | Automatically provisions an App Group under your free or paid Apple ID and preserves embedded entitlements for both WQFiles and GestaltX’s Share Extension. Supports WQFiles AltSource automatic updates. |
| Impactor (claration/impactor) | Supported (macOS / Win / Linux) | Explicitly recommended by both kolbicz/WQFiles and ichitaso/Regitela. Creates and retains the required App Group entitlement during Apple ID signing. |
| iLoader (iloader.app) | Supported (macOS / Win / Linux) | Recommended by adnan120hz/WorkTweaks. Registers the team-suffixed App Group under your Apple ID via GrandSlam/anisette and signs the IPA over USB. |
| Signed Apps / SideInstaller | Supported (On-device) | Uses the MIT-licensed isideload Rust core to provision a certificate, explicit App ID, and App Group on-device using your Apple ID. |
| Paid Apple Developer Account | Supported | Create an explicit App ID with the App Groups capability enabled, assign a group (e.g., group.cz.kolbi.wqfiles), and sign with that provisioning profile. |
Feather / ESign / KSign with Wildcard Profile (*) | Fails (No App Group) | Most third-party certificate sellers issue wildcard profiles (App ID *), which Apple does not allow to carry an App Group. Apps launch with No App Group or fail with an entitlement error. |
| Sideloadly | Fails (Strips App Group) | Both WQFiles and Regitela READMEs warn that Sideloadly signs IPAs without the App Group entitlement, causing every container operation to fail with No App Group / handle -1. |
Method A: Install with AltStore or SideStore (iPhone & iPad)
- Install AltStore or SideStore on your iOS 26.0–26.7.2 or iOS 27.0–27.3 Beta 1 device using a wired USB connection to your Mac or Windows PC.
- For WQFiles, either add the repository source URL in Sources:
or downloadhttps://raw.githubusercontent.com/kolbicz/WQFiles/main/source.jsonWQFiles.ipa(715 KB) from Download & SHA-256. - For GestaltX, download
GestaltX_1.0.7.ipa(3.56 MB), verify its SHA-256 hash (226f1a6ceb5267d6…), and open it in SideStore/AltStore. When prompted about app extensions, choose to keep the Share Extension so both the main app and extension receive the shared App Group. - Open WQFiles → Log (top of screen) or GestaltX → Logs to confirm an active App Group identifier is shown instead of
No App Group.
Method B: Install with Impactor or iLoader (Windows, macOS, Linux)
- Download Impactor (
github.com/claration/impactor/releases) or iLoader (iloader.app) on your computer. - Connect your iPhone or iPad with a certified USB data cable and trust the computer.
- Sign in with your Apple ID, select
WQFiles.ipa,GestaltX_1.0.7.ipa, orRegitela_1.0.1.ipa, and start installation. Both tools register an explicit App ID and App Group under your personal team automatically. - Remember that free Apple ID signatures expire after 7 days; refresh before expiration so your local backups inside the app container remain accessible.
Mandatory safety step: Back up MobileGestalt before editing
Critical warning: Never modify com.apple.MobileGestalt.plist without saving an off-device copy of your unmodified original file first. If you delete a sideloaded app after its 7-day certificate expires, any backups stored only inside that app’s container are deleted by iOS along with the app.
- In GestaltX (iOS 27.x): On first launch, GestaltX automatically creates an initial backup before any device write. Open Backups, tap Export on the initial unmodified backup, and save it to iCloud Drive or transfer it to your Mac/PC.
- In WQFiles (iOS 27.x): Open System Groups, navigate to
systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist, long-press the file, and share a copy to Files / AirDrop before making any edits. - In KAMUI: Copy
Documents/OriginalGestalt.plistout of the app container via the Files app or iTunes File Sharing.
Common questions
Why does Sideloadly fail even when I sign in with my Apple ID?
Sideloadly’s default free-account provisioning workflow does not attach an active App Group container to the signed profile for these targets, so SecTaskCopyValueForEntitlement returns no usable group at runtime.
What happens if I get error 7460 when provisioning with Signed Apps or iLoader?
Apple allows only one active development certificate slot per free personal team. As documented in the WorkTweaks README, open the Certificates tab, revoke the existing certificate holding the slot, and create a new one (then re-sign your sideloaded apps).
Can I use a paid certificate (.p12) with Feather or ESign?
Only if the accompanying .mobileprovision file was generated for an explicit App ID that includes the App Groups entitlement. Standard wildcard (*) profiles sold by signing services cannot include App Groups.