something is blocking LCM traffic on macOS Sequoia CI

[rpoyner-tri]

What happened?

https://drake-jenkins.csail.mit.edu/job/mac-arm-sequoia-clang-bazel-continuous-release/1/consoleFull for example.

Victory condition is to determine what config is needed for LCM multicast to work, and to apply it to CI images and/or setup scripts.

Version

v1.36.0

What operating system are you using?

macOS 15 (Sequoia)

What installation option are you using?

compiled from source code using Bazel

Relevant log output

No response

[rpoyner-tri]

I'll do the initial investigation in a few days, then maybe some of the fix application will get delegated to kitware folks.

[ggould256]

The extent of my research:

• https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy#macOS-considerations
  • Afaict the "launchd agent" text there applies to sshd, and I think also to jenkins workers.
  • However it also says "The multicast entitlement isn’t required on macOS."
  • But maybe that's out of date. If so, the relevant iOS instructions probably apply; https://developer.apple.com/forums/thread/663271

If these hypotheses are correct, it is likely that drake works when run from the terminal but not when run by Jenkins or over ssh, and that the remedy probably involves our code signing workflow, or changing something about the relevant user.