10

I'm running macOS Catalina 10.15.4 on a 2018 MacBook Pro 15", which has the T2 chip (if anything else is relevant, let me know and I'll update the question.)

I'm a developer and I'm in the process of writing and debugging a C command-line utility that's supposed to take a few miliseconds to run and exit.

My internet connection went down while I was coding (WiFi was still connected, but my ISP was down), and afterwards I noticed that, after compiling the app, the first time I ran it, it took a few seconds to run rather than the expected fraction of a second.

I turned off WiFi (so there was no active network connection), compiled my app again, and ran it -- this time it ran as quick as I would expect.

Turn on WiFi, compile and run again, first run of the app takes longer than expected.

Maybe I'm paranoid, but it sure sounds like macOS is trying to ask Apple's servers for blessing to run my app. Is this the case, or could there be another explanation? If it's indeed the case, can anyone link to an article explaining what's going on under the hood?

UPDATE: as requested, here are timings for an average of three runs of the following command, under different conditions:

touch file.c && make && time ./file && time ./file

The first measurement is the average time for running file for the first time after compilation (the third command in the chain). The second measurement is the average time for running file for the second time after compilation (the fourth command in the chain).

WiFi on, with internet: 347 ms/3 ms.

WiFi on, without internet: 5024 ms/3 ms.

All network connections offline: 24 ms/2 ms.

3
  • Comments are not for extended discussion; this conversation has been moved to chat. – bmike May 25 '20 at 16:21
  • 1
    I just had this same problem, very upsetting Macs have come to this. What was your solution so far? I know you can notarize but that's an expensive process which we can't do for every single build cycle. They also said I could block the IP from Apple, which sounds appealing. – GenericPtr Jun 12 '20 at 13:39
  • @GenericPtr I haven't, really. Just got used to the delays. – swineone Jun 12 '20 at 13:40
10

Yes, Catalina and Mojave gatekeeper can and will phone home now as part of a layered defense model against malware and privacy protection system violations.

Everyone expects (or tolerates) this on the first run, but ongoing checks for certificate revocation can and will block apps when any trusted Certificate Authority revokes a signing certificate before their expiration dates. When this happens repeatedly, it can be highly frustrating.

If you (or anyoneelse fails to) sign or notarize installers/packages/apps and don’t staple the notarization, this is how gatekeeper and related checks are supposed to work. We would need to know your gatekeeper settings and more about your app to know if this is in play. Also, when the systems online and locally to check revocations change or fail, this may be challenging to troubleshoot.

Notarization specifically is a Catalina-era feature and not anything to do with specific hardware.

Apple recommends that you notarize all of the software that you’ve distributed, including older releases, and even software that doesn’t meet all of these requirements or that is unsigned. Apple’s notary service uses a variety of methods, including telemetry, to determine which of the above rules to relax for preexisting software.

Stapling the ticket generated by your successful notarization should restore the behavior and performance you expect as Gatekeeper can find the ticket while offline in most cases.

3
  • That's what I feared. At least, for the current OS version, they seem to allow me to run my code without Apple's blessing if the computer is offline. I just fear the day when that will no longer happen, and I will be unable to work while my ISP is down. – swineone May 17 '20 at 12:33
  • BTW, in System Preferences -> Security & Privacy, under the General tab, the "Allow apps downloaded from:" settings is set to "Anywhere". – swineone May 17 '20 at 12:35
  • @swineone I’m pretty sure on the os you develop can disable this all to run offline, but I wanted to pause as I already dumped a lot of detail here. @ me if you ask that as a follow on question. – bmike May 17 '20 at 12:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .