Does macOS phone home to Apple's servers before running an app for the first time?

Question

I'm running macOS Catalina 10.15.4 on a 2018 MacBook Pro 15", which has the T2 chip (if anything else is relevant, let me know and I'll update the question.)

I'm a developer and I'm in the process of writing and debugging a C command-line utility that's supposed to take a few miliseconds to run and exit.

My internet connection went down while I was coding (WiFi was still connected, but my ISP was down), and afterwards I noticed that, after compiling the app, the first time I ran it, it took a few seconds to run rather than the expected fraction of a second.

I turned off WiFi (so there was no active network connection), compiled my app again, and ran it -- this time it ran as quick as I would expect.

Turn on WiFi, compile and run again, first run of the app takes longer than expected.

Maybe I'm paranoid, but it sure sounds like macOS is trying to ask Apple's servers for blessing to run my app. Is this the case, or could there be another explanation? If it's indeed the case, can anyone link to an article explaining what's going on under the hood?

UPDATE: as requested, here are timings for an average of three runs of the following command, under different conditions:

touch file.c && make && time ./file && time ./file

The first measurement is the average time for running file for the first time after compilation (the third command in the chain). The second measurement is the average time for running file for the second time after compilation (the fourth command in the chain).

WiFi on, with internet: 347 ms/3 ms.

WiFi on, without internet: 5024 ms/3 ms.

All network connections offline: 24 ms/2 ms.

Answer 1

Yes, Catalina and Mojave gatekeeper can and will phone home now as part of a layered defense model against malware and privacy protection system violations.

Everyone expects (or tolerates) this on the first run, but ongoing checks for certificate revocation can and will block apps when any trusted Certificate Authority revokes a signing certificate before their expiration dates. When this happens repeatedly, it can be highly frustrating.

• https://lapcatsoftware.com/articles/catalina-executables.html
• https://developer.apple.com/news/?id=09032019a

If you (or anyoneelse fails to) sign or notarize installers/packages/apps and don’t staple the notarization, this is how gatekeeper and related checks are supposed to work. We would need to know your gatekeeper settings and more about your app to know if this is in play. Also, when the systems online and locally to check revocations change or fail, this may be challenging to troubleshoot.

• https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution

Notarization specifically is a Catalina-era feature and not anything to do with specific hardware.

Apple recommends that you notarize all of the software that you’ve distributed, including older releases, and even software that doesn’t meet all of these requirements or that is unsigned. Apple’s notary service uses a variety of methods, including telemetry, to determine which of the above rules to relax for preexisting software.

Stapling the ticket generated by your successful notarization should restore the behavior and performance you expect as Gatekeeper can find the ticket while offline in most cases.