The dialog is frightening on purpose. Most of the time it is not telling you the bytes are corrupt. It is telling you the file was downloaded, and Gatekeeper has not been introduced to it. I still want you to read the second half of this note before you clear the flag on a file you did not fetch yourself.
The dialog, translated
“App is damaged and can’t be opened” is a stock sentence. It covers a checksum failure, and it covers a quarantine attribute that Gatekeeper refused to bless. Those are different faults. The first one means you should download the file again from the developer, or from the mirror named on the sheet. The second one means the file is intact and unsigned in a way macOS has decided to distrust, or simply that you have not yet done the right-click Open dance.
I see the second case every week on this catalogue, because a lot of small Mac tools are notarised late, or notarised for one build and not the next, or shipped as a dmg that Safari tagged on the way down. The dialog does not distinguish. You have to.
The quarantine bit
macOS writes com.apple.quarantine onto files that arrived from a browser, a mail client, or another app that opts in. The attribute is not a virus scan. It is a note that says “this came from outside”. Gatekeeper reads the note the first time you open the app. If the developer signed and notarised the build, the note is consumed and you get the ordinary “are you sure” prompt, once. If they did not, you get the damaged dialog, which is a worse sentence for the same fact.
You can see the note without removing it:
xattr -l /Applications/Compresto.appIf com.apple.quarantine is in that list, you are in the second case. If it is not, and the app still will not open, stop. The bytes may actually be wrong, or the binary may be for the wrong architecture. Deleting attributes you do not understand is how a genuinely bad file gets a second chance.
Clear it for one app
When you have decided the file is the one you meant to download, clear the attribute on that bundle only. Not on your Downloads folder. Not with a command you pasted from a forum that starts with sudo and a wildcard.
xattr -d com.apple.quarantine /Applications/Compresto.appThen open the app from Applications. If Finder still complains, it is often because you launched the copy inside the disk image. Eject the image. Launch the copy you dragged. I have lost twenty minutes to that, and I write manuals for a living.
The command does not disable Gatekeeper. It removes one attribute from one path. The next download gets a fresh attribute. That is the behaviour you want. A guide that tells you to turn assessment off system-wide is solving a different problem, badly, and I will not repeat the command here.
The right-click Open path
On current macOS you can often avoid the terminal. Control-click the app, choose Open, and read the second dialog. It is worded as a choice, not as “damaged”. Confirm Open. macOS remembers that choice for this bundle.
If the second dialog never appears and you only get “damaged”, the attribute is stuck and the xattr line above is the one I use. I used it on Compresto 1.31 the first time Safari handed it to me, on macOS 15.6. The app opened. The about box said 1.31. I then checked the size against the row on the sheet.
When you should not clear it
Do not clear quarantine on a build you did not mean to fetch. A mirror is a convenience, not a guarantee. If the sheet names MediaFire and you were sent a different host in a comment, treat the comment as untrusted. Comments on this catalogue sit in a queue before I publish them, and I still do not want a comment to be your download source.
- The disk image is smaller than the size on the sheet by more than a rounding error.
- The developer publishes a checksum and yours does not match. I do not print my private sums here, because a replaced image would make them a trap.
- The app asks for an admin password and then a second helper you were not told about.
- You were told to paste a command that disables Gatekeeper for every app. Close the tab.
In those cases, delete the download. Fetch it again from the button on the program sheet, which is the mirror I was willing to name. Then start this note from the top.
After a macOS update
A point release of macOS sometimes re-prompts for apps you had already blessed, and sometimes it does not. I do not try to predict which. If a tool that opened yesterday now claims to be damaged, check whether you are launching a leftover copy from a disk image that remounted, and check the quarantine attribute again. The attribute can be re-applied by a re-download that you forgot you did.
I re-test the install path when I file a new build, on the machines named in that sheet’s side table. I do not re-test every title on the morning Apple ships a new macOS. If the dialog changed its wording, this note will change with it. Until then, the attribute is still the thing I clear, and I still clear it one app at a time.