macOS 13.5 installer weirdness

[AVmcclint]

I've been seeing some extremely odd behaviors with the 13.5 installer involving internet connectivity during the installation. I use Download Full Installer to grab the whole shebang as a single installer so I'm not working with deltas or snub installers. I've done this for the past couple years without any problems. Reports are kinda scattered, but it appears that when the installer is running before the initial restart, it is trying to download additional bits from Apple. I only discovered this when a user was getting this error 

 I triple checked that the installer that was pushed to his Mac worked on a couple of my test Macs. The installer was not broken. After deleting and reinstalling the installer on his Mac 3 times with the same result, I asked him to disable Wifi and unplug from ethernet.. same problem, The I had him reconnect to the network and then disable ZScaler. The installer worked instantly!

Another sign was that a user's Mac was on our guest network but he forgot to authenticate properly to it... so it was kinda connected but had no connectivity. During one of the restarts after he ran the installer it told him "Authentication is required to verify startup disk" but it would never move past that point after authenticating properly. When the tech working on the issue plugged the computer into ethernet, it worked instantly!

This new installer for 13.5 is doing some crazy internet chatter but I'll be damned if I can find what it's looking for and why the FULL installer still needs to download more stuff from Apple. I've never had any full OS installer need to be connected to the internet to do its job. In fact, I've installed many OS versions without any network connection at all...  and now it's required?

[sdagley]

@AVmcclint With x86 Macs using the T2 processor there is often a BridgeOS update that's required and downloaded during the macOS install process. I'm not 100% sure if something similar applies for Apple Silicon Macs, but I'm pretty sure it does. If you're doing SSL inspection (i.e. ZScalar) and haven't exempted the Apple update servers (see https://support.apple.com/en-us/HT210060) it will cause the download to fail because of certificate pinning.

[AVmcclint]

I forgot about the Touch Bar BridgeOS and how it needs unhindered access to Apple's servers, but these aren't Touch Bar Macs. The 2 that I can recall off the top of my head are M1 MBPs. And like I said we've never had a problem with any other version of the installer until 13.5. This is a very new situation.

[sdagley]

I'd say you've just been lucky. We've long had issues with installing macOS updates on x86 or Apple Silicon Macs while connected to our corporate network. We don't use Zscaler but we are doing SSL inspection, and what we've discovered from painful experience is that Apple's "Use Apple products on enterprise networks" KB isn't always up to date. Rather than chasing down what's changed/missing we just tell users they should not update while connected to the corporate network.