Mac “is damaged and can’t be opened”: Apple’s Official Steps, and xattr Only for Apps You Trust
Apple files this alert under apps macOS found modified or damaged, or whose authorization was revoked. Re-download and verify first, use Open Anyway only where Apple offers it, and use xattr on one app you trust, with the risks spelled out.
bufferAbout the author6 min read
Short answer: when a Mac says an app “is damaged and can’t be opened”, Apple’s support page files it under “the app is damaged”: macOS found that the software was modified or damaged, or that its authorization was revoked, and it tells you the app can’t be opened; for known malware it also moves the app to the Trash. So the first move is not “how do I get around it” but “is this file actually fine?” The order is: re-download and verify the source, then Apple’s official Open Anyway where it applies, and only last xattr on one app you trust. Do not turn off Gatekeeper for the whole Mac just to open one app.
What we could and could not do: our test machine runs Linux and we have no Mac. Every step here follows Apple’s support page (English, Chinese; the English page is dated May 27, 2026 and we read it on November 10) and the documentation of built-in macOS commands. We did not reproduce this on a Mac and have no screenshots.
What Apple says
Apple’s “Safely open apps on your Mac” page separates the alerts:
| What you see | What Apple says | What the page offers |
|---|---|---|
| An app downloaded from the internet, first open, asking to confirm | Normal first-open confirmation | Confirm it is the app you meant to open |
| Apple cannot check the app for malicious software, or the developer cannot be verified | Not notarized, or developer not identified | Contact the developer, look for an updated version or alternative in the App Store; only if you are certain of the source, consider a temporary override (next section) |
| The app will damage your computer, or the app is damaged | Malicious content or revoked authorization; or the software was modified or damaged, so the app might be broken, corrupted or tampered with; known malware is moved to the Trash | The page gives no override for this one |
The dialog wording (the most common search form is "App" is damaged and can't be opened. You should move it to the Trash.) is not quoted from Apple’s page, which only describes this kind of alert. Wording can differ between macOS versions, so trust your own screen; we did not capture it on a Mac.
Step 1: decide whether the file is sound
The commands below are built into macOS; replace the path with your app. We did not run them on a Mac, so what they print depends on your machine.
1. Download again, only from the developer’s site or official GitHub Releases. An interrupted download, or a browser or proxy altering the file, can lead to a “damaged” message (common experience, not an Apple conclusion, and we did not reproduce it).
2. Check the checksum. If the developer publishes a SHA-256, compare:
shasum -a 256 ~/Downloads/some-installer.dmg3. Check the signature. These two show whether the app carries a recognized developer signature and passes Gatekeeper’s assessment:
codesign --verify --deep --strict --verbose=2 /Applications/SomeApp.app
spctl --assess --type execute -vv /Applications/SomeApp.appIf signature verification fails, the app content does not match its signature. Letting it run then means running a modified program; delete it and download again instead of going further.
4. If you are not sure of the source and cannot explain the signature, do not use the app. Apple’s page says running software that is not signed and notarized might expose your computer and personal information to malware.
Step 2: Apple’s Open Anyway
Apple places this only under “not notarized, or from an unidentified developer”, and the button appears only after you have tried to open the app once:
1. Double-click the app and let it be blocked.
2. Open System Settings, click Privacy & Security, scroll down and click Open Anyway.
3. When the warning appears again and you are completely sure, click Open. The app is saved as an exception and opens like any other.
Note: on a Mac managed by an employer or school these settings may be locked. Also, Apple’s page does not say the button works for the “damaged” alert, so not seeing it is not surprising; do not rush to something more drastic.
Step 3 (last resort): xattr on one trusted app only
xattr is not on Apple’s page; it is the most common fix online, so we put it last and spell out the limits.
What it does: it removes the quarantine flag com.apple.quarantine from the file. As macOS works, Gatekeeper’s first-open check applies to files carrying that flag; without it the app is no longer checked. We did not verify this on a Mac.
It does not repair a damaged file; it only stops the system from checking. Use it only when all three hold:
- You are sure of the source: the developer’s site or official repository, not a forum, file-sharing link or cracked-software site.
- You re-downloaded and, if the developer provides one, checked the checksum.
- It is a single app and you know why it is not notarized (for example a small open-source tool by an individual).
Check for the flag, then remove it from this one app only:
xattr -l /Applications/SomeApp.app
xattr -dr com.apple.quarantine /Applications/SomeApp.appRed lines:
- Write the full path of that one app. Do not run it on all of
/Applications, do not use a*wildcard, and do not addsudoto process things in bulk “once and for all”. - When the app updates, the new download carries the flag again and you must decide again; do not make “strip the flag after every download” a habit.
- If the
codesigncheck above already failed, do not use this. - Some guides tell you to turn Gatekeeper off or “allow apps from anywhere”. That disables checks for every download on the whole Mac. Do not follow them; it is not a fair price for opening one app.
FAQ
The alert says to move it to the Trash. Should I?
Apple’s page says that when macOS detects known malware it moves the app to the Trash itself. If that is what you see, listen to it; do not fish the app out and open it.
It is a local-LLM tool such as Ollama or LM Studio. Same steps?
Same order: re-download from the official site, check the checksum, check the signature, then decide. We did not reproduce this on a Mac, so we cannot say which cause applies to a specific app on your machine. For other Ollama setup problems see the Ollama and llama.cpp error list.
Why do I not see Open Anyway?
Apple says the button appears after you try to open the app and applies to apps that are not notarized or come from an unidentified developer; on managed devices the setting may be unavailable. For the “damaged” alert the page gives no override steps.
Related
Rapid-MLX: run Codex locally on a Mac · Mac and Apple category