New Optional Key: Pre-warm .apps on macOS Sonoma

[erikng]

/usr/bin/gktool is a new command line tool to assess Gatekeeper Policy on applications. gktool can be called to pre-warm the system cache so users do not see the ‘Verifying…’ dialog on first launch of an application. (109793778)

Apple now has a tool we can use to pre-warm applications and reduce this popup on launches. This might be a desirable feature for admins to have this as an automated post-install action for any .apps.

<key>PreWarm</key>
<true/>

For other .pkg based installations, it would be up to the admin to write a custom script or this could be an array of .app paths

<key>PreWarmPaths</key>
<array>
  <string>/Applications/Foo.app</string>
  <string>/Applications/Bar.app</string>
</array>

This second option could be added to autopkg munki recipes and is my preferred method.

[gregneagle]

I’d need to understand this more. Does it have to be run in a user context? Does it potentially take a long time to run? Have you done a proof-of-concept with postinstall_scripts?

[erikng]

Good questions, I have zero answers for you. I saw it in the beta 2 developer notes just now and thought it was really cool.

[erikng]

Perhaps @nmcspadden will have answers as he said he would try it out.

[vmiller]

I was able to do some testing with this new binary. As @gregneagle suggested, it can be leveraged in a postinstall_script without any modifications to Munki code.

To answer Greg's questions :

• in my testing it did not need to be run in a user context and could be run as root
• While I didn't time it, it appears to take the same amount of time as the "verifying" dialog the user would see on first run. The larger the app the longer it takes (either the user gui or the gktool binary

If others are reading this and interested in testing it for themselves, here is a sample postinstall_script :

    <key>postinstall_script</key>
    <string>#!/bin/sh

if [ -f /usr/bin/gktool ]
then
    /usr/bin/gktool scan /Applications/Foo.app
fi</string> 

[vmiller]

I verified that this also works with no user logged in (munki installing at the login window)

[gregneagle]

The fact that it takes time to run (and I assume the tool doesn't return until it's finished) would lead to some tradeoffs here. if a user is interacting with Managed Software Center and it's installing multiple things, the user now has to wait for these scans to complete before MSC finishes. If it's scanning an app the user doesn't really care about right now, like, say Xcode, but that user really wants the new Zoom to install, now the user is annoyed. I think some thought and discussion will need to happen before any modifications to Munki can be made.