[cfarm-users] New Apple Mac M1 machine (gcc304)
j-gccfarm at watlock.be
Wed Mar 24 15:48:44 CET 2021
On 23/03/2021 01:31, Assaf Gordon via cfarm-users wrote:
> - will it compromise SIP (
> https://en.wikipedia.org/wiki/System_Integrity_Protection ) ?
Note that keeping SIP enabled completely decimates compiler regression
testing performance, because it means that every time you execute a
compiled binary for the first time,
1) it gets checked for malware (XprotectService)
2) its code signature gets checked (syspolicyd, trustd, tccd) 
Both 1) and 2) happen in single-threaded processes that handle only a
single binary at a time. Moreover, if a network connection is available,
checking a code signature involves checking with Apple's root
certificate servers (to verify that the used certificate has not been
revoked) . The combination of these points is that the system spends
way more time checking for malware and verifying certificates than
executing test programs.
See https://developer.apple.com/forums/thread/673057 for some more details.
 On macOS/ARM64, all binaries must have a code signature. If you
don't specify a signing certificate, the linker adds one anyway using a
dummy certificate that's local to the current machine, but even these
dummy signatures get verified.
More information about the cfarm-users