Network extension authorization dialog not appearing

"This" is: our app runs, activates the extension, it has to get user approval, and... the system dialogue window never appears. The extension stays waiting for user approval. I've got sysdiagnose from one of the systems, and I see the system log about it going into the user approval needed state, and... nothing else.

It's there in Settings, and can be approved then.

Has anyone run into this? Ever?

I'm not sure I've seen the EXACT case you're describing, but I've certainly seen similar kinds of failures/glitches. In general, they loosely fall into three broad categories:

1. External factors. In practice, macOS is sufficiently complicated and flexible that there is nearly always "something" that can change or disrupt the normal system logic. In most cases this involves some kind of 3rd party app/component, though can sometimes be internal to the system itself.

2. Development "weirdness". The nature of software development means that developers routinely do things that are WELL outside what "normal" system usage looks like. For example, very few users have dozens or hundreds of copies of the "same app" laying around on their system (collections of older builds), nor does any user routinely delete/update/install the same app dozens of times per day (the build/run/build cycle).

3. System bugs. This is generally the least common case but, yes, the system does have bugs and things do break.

Note that #1 in particular is the most critical are to watch for. It's both the one your most likely to be able to actually fix and, more importantly, it's more likely to hurt your product in a "systemic" way. Putting that point in more concrete terms, an issue that only effects 100 users is a much bigger problem when those are the 100 users you want to sell your app to.

Moving to the specific issue:

"This" is: our app runs, activates the extension, it has to get user approval, and... the system dialogue window never appears. The extension stays waiting for user approval.

What extension point are you trying to activate and what's the market/environment you're selling to/seeing issues with? If you're targeting the business/enterprise market, one component I would watch for are EndpointSecurity apps/extensions. They're much more common on enterprise machines and, by design, they basically have an unbounded ability to disrupt the system's "normal" operation.

I've got sysdiagnose from one of the systems, and I see the system log about it going into the user approval needed state, and... nothing else.

Since you have a sysdiagnose, if you file a bug on this and then post the bug number back here, I will try and take a look at the log (as well as ensuring it get to the right team). I can't promise I'll find anything, but I've stared at enough of them to have gotten reasonably good at finding clues that were otherwise hidden.

__
Kevin Elliott
DTS Engineer, CoreOS/Hardware

The extension is a Transparent Proxy Provider, so that's the authorization that should come up. We've had this happen occasionally on our automated tests, which run in a VM with no other extensions installed, so I think I can rule that out. (The automated software expects the window to appear, so it can then "click" it; it doesn't, so the test fails. Intermittently.)

I just filed FB17948001, with the sysdiagnose attached.

I know it's WWDC so honestly I'm not expecting anyone to have a lot of spare cycles. 😄