Fixing “app is damaged and can’t be opened”

A practical note, not a way around macOS.

What the message means

macOS shows “app is damaged and can’t be opened” for more than one reason. The common one, on a file that just came from a browser, is the quarantine flag. The less common one is a file that really did not arrive whole. They look the same in the dialog. They are not the same problem, and I do not treat them the same.

Gatekeeper is doing a job. A catalog page is not a reason to turn it off. If I cannot explain where a build came from, it does not go on an office Mac.

Right-click Open

For a first launch of an app that did not come from the App Store, I Control-click (or right-click) the application in Finder and choose Open, then Open again in the dialog. I do this once. After that the app launches normally, or it doesn't, and if it doesn't I stop.

Dragging the app to Applications first matters. Running it from a disk image, or from the Downloads folder, is how you get a second copy and a confused update later.

When the download itself is the problem

If the file size does not match the mirror, I delete it and download again. I do not clear attributes on a file that is the wrong size. A short file that has been told to ignore quarantine is worse than a short file that macOS refused.

There is a Terminal command, xattr, that people paste under this error. I know it exists. I do not put it in the office instructions. On my own Mac, if the size matched, the source is one I already use, and Right-click Open was not enough, I may clear the quarantine attribute on that one application and then open it. I do not do that on the bookkeeping machines, and I do not do it for a file I am already suspicious of. If you do not know what the command changes, do not run it because a forum told you the dialog was a nuisance.

How I update a program

1. Read what changed, at least the parts that touch files we already have.
2. Download the new image and check the size.
3. Install it on my own Mac and open a real file.
4. Only then replace it on the other machines, and not on a Friday.

I keep the previous disk image until the new one has lived through a normal week. The "Previous versions" list on a program page is that habit, written down.

What I will not do

• Turn off Gatekeeper, or SIP, to finish an install.
• Run a cleaner across an account that holds the books, to "make space" for an update.
• Install the extra offer that rides along in some disk images. Decline it. If the image will not let you decline it, that image does not get used.

If a program still will not open after a clean download and Right-click Open, it waits. The office can survive without it for a day. That is the whole policy.