How to let iOS/macOS update our app while its NetworkExtension is running?

Question

We have an app that registers and runs a NetworkExtension (specifically NEPacketTunnelProvider) on both iOS and macOS. This works fine (although not in the iOS simulator, of course, known limitation). However, when the network extension is running, the App Store on macOS/iOS, and TestFlight on iOS, fail to update the app. It looks like they're waiting for the NetworkExtension to terminate, but not actually asking the VPN to disconnect.

We don't want our users to have to think about killing our VPN (which should stay connected whenever possible), but we don't want them to have to think about updates either - they should happen automatically.

Are we missing something? Is there an event we should be listening on to detect that the store is trying to install an app update? Conditions when we should arrange for the VPN to terminate, safe in the knowledge that it will be restarted again after being updated?

Answer 1

Apple had bugs regarding this issue. It was supposed to be ok since iOS 11 (and macOS 10.13 or 10.14), but then users reported that the problem still exists. Several bugs regarding this are still probably open at Apple's bugs reports, but we can't check their status. You can ask again at their forum, and open another bug regarding this issue. Probably there's nothing else you can do.

Those are only some of the reports related to this issue: https://forums.developer.apple.com/message/174708#174708 https://forums.developer.apple.com/thread/92603

https://forums.developer.apple.com/thread/126471

https://forums.developer.apple.com/message/149563#149563 https://forums.developer.apple.com/message/183927#183927

Edit: Someone just posted a question regarding this at Apple's forum. It might be you who posted to question, but maybe it's someone else, so there's another reference: https://forums.developer.apple.com/thread/128894