Fixing the “app is damaged” warning

You download a program, you double-click it, and macOS says the app is damaged and should be moved to the Bin. Or it says the app cannot be opened because the developer cannot be verified. The wording changes between versions. The feeling in the room is the same: people assume the Mac has caught a virus, or that I have sent them something broken. Often neither is true. Sometimes the file really did not survive the download. This page is how I tell those two apart before anyone starts changing security settings they will not remember how to put back.

What the message is saying

macOS checks programs that arrived from the internet. If it cannot satisfy itself about the signature, it stops and uses a severe sentence. “Damaged” sounds like a corrupted file. It can mean that. It can also mean “I have not been introduced.” Those are different problems, and the button that moves the app to the Bin does not diagnose which one you have. Read the sentence, then look at the file, then decide. Do not let the Bin be the first step.

A partial download is a real thing. A laptop sleeps, a café connection drops, a browser says it finished when the last slice never arrived. That file can be damaged in the ordinary sense: it will not open because it is not all there. The cure is a fresh download, ideally somewhere with a boring, stable connection, and a look at the size. If the site said about 11 MB and you have 4 MB, you do not have the program. You have a stump.

The doorman, not a broken door

Gatekeeper is a doorman with a list. If the program’s name is not on it, you wait in the lobby. That is not the same thing as the door being broken, and it is not the same thing as the band having forgotten their instruments. The doorman is doing the job you would want done when a stranger turns up. The trouble is the sign on the desk, which sometimes says “damaged” when it means “not on the list.”

When you download a file, macOS can mark it with a quarantine flag. The flag is a note: this came from outside. On the next open, Gatekeeper reads the note and makes the introduction. Clearing that note by guesswork, because a stranger on a forum told you a spell, is how a cautious system gets switched off for a file you did not mean to trust. I am not going to print the spell here. Beginners copy it onto the wrong thing. If you already live in Terminal and you understand the flag, you already know where the documentation is. If you do not, use the slower door below, or download the file again from the developer.

Opening it once, on purpose

For an application you meant to install, from a developer you can name, the ordinary introduction is enough. Find the app in Finder. Hold Control and click it, or use the right-hand click if you have that mouse. Choose Open. macOS asks a second time, in plainer words, whether you meant it. If you did, confirm. You should only need that once for that copy of the app.

1. Leave the disk image or the installer where it downloaded. Do not fish an app out of a folder you do not recognise.
2. If it is a disk image, open it and drag the application to the Applications folder. Eject the image afterwards.
3. Control-click the copy in Applications and choose Open. Read the second dialog. It should name the app you expect.
4. If the name is wrong, or the icon is a document you did not download, stop. That is not a warning to click through.

This is not a trick to silence the Mac. It is you, a person, saying you recognise the thing. If you do not recognise it, the doorman was the one having a good day.

When the file really is damaged

Control-click will not repair a file that is missing its ending. If Open still fails, or the app quits before it draws a window, treat it as a bad download.

• Move that copy to the Bin. Emptying the Bin can wait until you have a replacement.
• Download it again. If the browser offers to “resume”, decline. Resuming is how a stump stays a stump.
• Compare the size with the size written on the page. They will not match to the last byte every time, but they should be in the same neighbourhood.
• Install the new copy. Do not keep both and then wonder, next Thursday, which one is the good one.

If a second download from the same place fails the same way, try another mirror only if the catalogue page lists one, and still check the size. Two stumps are not better than one. A program that opens and then immediately says your documents are corrupted is a different problem; that is no longer the download. Stop, and do not point it at the folder of masters while you experiment.

What I will not tell you to do

I will not tell you to turn Gatekeeper off for the whole Mac. That is like dismissing the doorman because one guest was annoying. Every later download walks in unchecked, including the one you did not mean to make.

I will not tell you to run a block of Terminal commands you found under a video. If you cannot say what each word does, it does not belong in a class I am teaching. The Mac already has a way for you to approve one app. Use that, or fetch a clean copy. Both are slower than a pasted command. Both leave you able to explain what you did.

And I will not tell you that a warning is always a false alarm. Sometimes the file is rubbish. Sometimes it is not the program you think it is. The whole habit of this site is the sentence on the masthead: understand it, then install it. The warning is part of the understanding.

Terms used on this site

Sample rate

How many snapshots of a sound you keep each second. 44.1 kHz is the CD habit: 44,100 pictures of the air pressure, every second. A higher rate is more paper. It is not automatically a better recording.

Bit depth

How finely each snapshot measures the level. 16-bit is the CD. 24-bit is the usual session. More bits, more headroom for a quiet room, not more “warmth.”

VST

Virtual Studio Technology. A plug-in format. The instrument or the effect runs inside a host such as REAPER. If the host does not load that format, the installer can succeed and the plug-in can still be invisible.

AU

Audio Units. Apple’s own plug-in format. A lot of Mac hosts prefer it. A plug-in can exist as AU, as VST, or as both. Install the one your host asked for.

DAW

Digital audio workstation. The program where the song is built: REAPER, Logic, Ableton, and the rest. Plug-ins live inside it. They do not replace it.

Bounce

Mixing the session down to a single file you can play outside the DAW. A bounce is a copy of a decision. It is not the session.

Bitrate

How much data a compressed video or audio file may spend each second. A tighter budget, a smaller file, and usually a softer result.

Lossy

Compression that throws some of the original away to save space. You cannot unfold it back into the exact file you started with.

Lossless

Compression, or a conversion, that keeps every bit and can be undone. Smaller is not guaranteed. Faithful is the point.

Plug-in

A piece of software that only runs inside another program. A compressor plug-in does nothing on its own. It needs a host.