macOS "App is damaged and can't be opened": what it really means, and the safe fix
Fix macOS "App is damaged and can't be opened. You should move it to the Trash": check the signature, remove the quarantine attribute with xattr, and know when not to.
by OhSudo ··
"MyApp" is damaged and can't be opened. You should move it to the Trash.Reinstalling doesn’t help, and the same file works on a colleague’s Mac, or used to work on yours. That’s because the app usually isn’t damaged at all. Gatekeeper, the part of macOS that checks downloaded apps, can’t verify this one, and “damaged” is what it says in that case.
Often the reason is simple: the app wasn’t properly signed and notarized by its developer. It can also really be corrupted or tampered with, and you should check before you override anything.
- Downloaded appmarked as downloaded (quarantine)opened
- Gatekeeperchecks signature and notarizationverification fails(fails)
- "is damaged"can't be verified(breaks here)
TL;DR
Only for an app you got from a source you trust:
codesign -dv --verbose=2 /Applications/MyApp.app # who signed it?xattr -l /Applications/MyApp.app # is it quarantined?xattr -dr com.apple.quarantine /Applications/MyApp.app1. Check before you override
The warning might be right, so spend a minute on this. Is the download from the developer’s own site? Does the checksum they publish match?
shasum -a 256 ~/Downloads/MyApp.dmgThen see what macOS thinks of the app:
codesign -dv --verbose=2 /Applications/MyApp.appcodesign --verify --deep --strict --verbose=2 /Applications/MyApp.appspctl --assess --verbose=2 /Applications/MyApp.app| You see | Means |
|---|---|
accepted, source=Notarized Developer ID |
The app passes. Something else is wrong: download it again |
rejected |
Gatekeeper refuses it. Common with unsigned open-source builds |
code object is not signed at all |
No signature, so nobody vouches for it |
Signature=adhoc |
Signed without an identity. It says nothing about who made it |
a sealed resource is missing or invalid |
Files changed after signing. It’s corrupted or tampered with: download it again |
If the last one shows on a signed app, don’t override it. Get a fresh copy.
2. The quarantine attribute
When a browser or a chat app saves a file, macOS marks it with an extended attribute, com.apple.quarantine, and Gatekeeper checks marked apps the first time they open:
xattr -l /Applications/MyApp.appcom.apple.quarantine: 0083;6a2f1c00;Safari;5F2C...That also explains why the same app may run for someone else: files that come through curl or git aren’t marked, so Gatekeeper doesn’t stop them.
3. Remove it
xattr -dr com.apple.quarantine /Applications/MyApp.app-d deletes the attribute and -r does it for everything inside the app. A file that’s still in Downloads has the same mark, so move it first, or use its path there. Try opening the app again. You may need sudo if another user installed it.
Installing from a disk image? Clear the .dmg before you mount it, or the app inside only after you copy it out:
xattr -d com.apple.quarantine ~/Downloads/MyApp.dmg4. Apple silicon: it needs some signature
On an M-series Mac, native code has to be signed, even if only ad hoc. An unsigned app or binary doesn’t get a helpful message: it just doesn’t run, or the shell prints killed. Sign it for your own machine:
codesign --force --deep --sign - /Applications/MyApp.appThe - means an ad hoc signature, and it’s valid only on this Mac. It replaces any signature the app had, so don’t use it on an app that has a valid one.
5. The official way: Open Anyway
For the milder message, "MyApp" can't be opened because Apple cannot check it for malicious software, there’s a way without Terminal. Try to open the app, then go to System Settings → Privacy & Security, scroll to Security, and press Open Anyway.
Since macOS 15 Sequoia, the old trick of Control-clicking the app and choosing Open no longer gets past Gatekeeper, so this page is the route.
The setting is only there for apps Gatekeeper blocked for not being verified. The “damaged” message doesn’t always offer it, and that’s when you need xattr.
Warning
Removing quarantine turns off a check for this one app. Malware often comes with instructions to do exactly this, in a README or on a “fix it” page. Do it only for software whose source you trust, and never run a command you were sent by someone you can’t identify. Also avoid sudo spctl --master-disable, which turns Gatekeeper off for every app.
Shell, we have a problem!
Similar, but different: "MyApp" will damage your computer is a stronger warning: macOS has identified known malware, so delete it. Operation not permitted from Terminal is a privacy permission: add Terminal under Privacy & Security → Full Disk Access, and see that article. And xcrun: error: invalid active developer path is about developer tools, not Gatekeeper: see the xcrun fix. If Homebrew itself can’t be found, see command not found: brew.
Found this useful? Share it.
Found a mistake? Let us know at contact@ohsudo.com.