Why macOS says this
A lot of small Mac tools are signed and notarised, and a lot of them are only signed, and a few honest ones are neither because the developer is one person with a dmg. macOS uses the same sentence — the app is damaged and can’t be opened — for a file that was actually corrupted and for a file that simply arrived through a browser. The quarantine attribute is the usual culprit. The download is fine. The system is being careful, and the wording is worse than the problem.
I see it most often the first time I install a utility on a fresh macOS, or after I have moved a dmg across from another machine on a USB stick. Safari, Chrome and Firefox all attach the flag. AirDrop sometimes does too.
The right-click Open path
Try this before any terminal. It is the path Apple still documents, and it is enough for most indie builds.
- Move the app into the Applications folder. Don’t run it from the disk image.
- Eject the disk image.
- In Finder, right-click the app and choose Open.
- Read the second dialog. If it offers Open, choose it. A double-click will not show that button.
After that one approval, a normal double-click works. You do not repeat the dance every morning unless the app was replaced.
Privacy and Security
On newer macOS the same approval lives in System Settings, under Privacy & Security, near the bottom, just after you have tried to open the app. The line names the app and offers Open Anyway. That is the same decision as the right-click, written in the settings pane because the dialog itself got stricter.
You will need an administrator password. On a shared studio Mac, that is a conversation, not a click. I don’t bypass it for someone else’s login.
The quarantine flag
If the menus still refuse, the attribute is stuck. This is the command I use for an app I downloaded myself and have already decided to trust. It strips the quarantine flag from that app only. It does not turn Gatekeeper off for the whole Mac.
Open Terminal and run it with the real path:
xattr -dr com.apple.quarantine /Applications/Compresto.app
Swap in the app you actually installed. Then try the right-click Open once more. I keep this for the utilities on this shelf, not as a habit for random disk images from a forum.
When I would not ignore it
If the dmg will not mount, if the file size is a fraction of what the card says, or if the page you downloaded from is not the one you meant, stop. A damaged message is sometimes telling the truth. Download again from the catalogue link, check the size against the card, and only then repeat the steps above.
I also stop if the “app” is a request for your Mac password in a window that does not look like the installer. Nothing on this shelf needs your Apple ID to compress a PNG or to uninstall a trial. Close it, delete it, and tell me which card sent you there.