What is the exact behavior of Catalina verifying app? By 'verifying' I mean either


an explicit popup of 'Verifying'
or app launch stuck with XProtectService comsuming CPU in background


What I know


An app on local drive with com.apple.quarantine xattr will be verified on the first start, or after something changed in the app.


However I found some app on without the xattr will still be verified, especially app copied from (or directly run on) an external/network drive.


What is the exact behavior?
Anyway to avoid this (without fully disable SIP)?
I’m not sure that anyone knows the full extent of how Apple’s protections work, but if I wanted to understand them better, I would start by reading Howard Oakley’s site at http://eclecticlight.co as he has done the most thorough job writing about it.

I know SE likes answers that aren’t just links, but there's way too much to try to summarize here.

This would be a good place to start reading: https://eclecticlight.co/tag/gatekeeper/