Gatekeeper explained: why a Mac blocks an app you downloaded
· 5 min read
You download an application, double-click, and macOS refuses. The wording varies and the difference between the variants is the entire point, because one of them means “this is unsigned” and another means “this is known malware”.
The three messages
“cannot be opened because it is from an unidentified developer” or “Apple could not verify [app] is free of malware”
The software is not signed by a developer registered with Apple, or not notarised. Common for independent utilities, open-source tools, and anything from a developer who has not paid for a certificate. Not evidence of anything malicious, and not evidence of safety either.
“[app] will damage your computer. You should move it to the Bin.”
Different message entirely. macOS has identified this as known malware. Do not override this. Delete it.
“[app] is damaged and can’t be opened.”
Usually a broken or incomplete download, or a signature that does not validate. Download it again from the developer’s own site. If it happens twice, be suspicious.
The first is a caution. The second is a verdict. Reading which one you have is the whole skill.
Opening software you trust
For the unidentified-developer case, when you know where the software came from.
Right-click the application and choose Open, then confirm. This registers your explicit consent for that app.
Or after the block: System Settings, Privacy & Security, scroll to Security, and there will be an “Open Anyway” button for the application you just tried.
That is the supported route and it is deliberately a few steps, so it is a decision rather than a reflex.
What Gatekeeper is checking
Three things, layered.
Code signature. Is the app signed by a developer with an Apple-issued certificate? That ties it to an identity Apple can revoke.
Notarisation. Has Apple scanned this build for known malware? Notarised software carries a ticket confirming it.
Quarantine. Files downloaded from the internet get an attribute marking them as such, which is what triggers the check on first launch.
You can see the quarantine attribute:
xattr -l /Applications/Something.app
com.apple.quarantine in the output is why the warning appeared.
The command that goes too far
Advice circulating online suggests:
sudo xattr -rd com.apple.quarantine /Applications/Something.app
or turning Gatekeeper off entirely with spctl --master-disable.
The first strips the quarantine flag so the check never happens. The second disables the protection system-wide.
Neither is necessary. Right-click and Open achieves the same result for the one application you decided to trust, without removing the check for everything else you download later. Reach for the command line version only when a legitimate installer genuinely requires it, and turn nothing off globally.
The judgement that actually matters
Gatekeeper tells you whether software is signed. It does not tell you whether it is trustworthy. Plenty of malicious software has been signed with certificates that were later revoked, and a great deal of excellent open-source software is unsigned.
So the real question is where you got it.
From the developer’s own site, typed directly: reasonable. From the App Store: checked more thoroughly. From a search advertisement: be careful. Lookalike sites for popular Mac applications are a known and active problem, and the download will run and look correct. From a download aggregator: frequently repackaged with adware.
The single most useful habit is typing the developer’s address rather than searching for it.
Applications that stop working after an update
Occasionally a macOS update revokes a certificate or tightens a requirement, and something that ran yesterday will not today.
Usually the developer ships a fixed build. Check for an update before working around the block, since the block may be correct.
Questions
Should I turn Gatekeeper off? No. It costs you a right-click on the rare occasions it gets in the way, and it stops a real category of problem the rest of the time.
Why does the App Store version not warn me? App Store software is reviewed and sandboxed, so the check has already happened.
I get the warning for an app I have used for years. Usually because you re-downloaded it, so the quarantine flag is fresh. Right-click and Open.
Does notarised mean Apple vouches for it? No. It means an automated scan found no known malware. It is a floor, not an endorsement.