macOS Won’t Install an App: Gatekeeper and Notarisation

3 Sep 2026

You download a Mac application, open the installer and expect it to run. Instead, macOS displays a warning such as:

Apple could not verify the app is free of malware.

or:

The developer cannot be verified.

You may also see a stronger message saying the application is damaged, cannot be opened or should be moved to the Bin.

These warnings do not all mean the same thing. Some indicate that the developer has not completed Apple’s signing and notarisation process. Others suggest that the download has been altered, the developer’s certificate has been revoked or Apple has identified a genuine security concern.

The safest response is not to disable macOS security. It is to identify the exact warning, verify where the software came from and use the narrowest supported method to install it.

What Is Gatekeeper?

Gatekeeper is a security feature built into macOS. When you open an application, plugin or installer downloaded from outside the Mac App Store, Gatekeeper checks whether it:

Comes from an identified developer
Has a valid code signature
Has been notarised by Apple where required
Has been altered since it was signed
Is known to contain malicious software
Uses a developer certificate that has been revoked

By default, macOS allows applications from the App Store and software from identified developers that meets Apple’s security requirements.

Gatekeeper is not simply an annoyance designed to block independent software. It helps prevent an application from being launched if its identity cannot be verified or if the package has changed since the developer released it.

What Is App Notarisation?

Notarisation is an automated security process for Mac software distributed outside the App Store.

The developer submits the application or installer to Apple’s notary service. Apple scans it for known malicious content and performs security checks. When the submission passes, Apple issues a notarisation ticket that tells Gatekeeper the software has been checked.

Developers can also attach—or “staple”—the ticket to the app, disk image or installation package. This allows Gatekeeper to verify the notarisation even when the Mac is offline.

Notarisation is not the same as a full App Store review. Apple is checking the package for known malware and security compliance; it is not guaranteeing that the application is useful, reliable or suitable for your organisation.

Code Signing and Notarisation Are Different

Code signing identifies the developer and helps prove that the application has not been altered since it was signed.

Notarisation confirms that a copy of the software was submitted for Apple’s automated malware and security checks and that no known malware was found at that point.

A modern application distributed outside the App Store will normally be:

Signed with an Apple-issued Developer ID certificate.
Submitted to Apple for notarisation.
Distributed with or linked to a valid notarisation ticket.

An app can be signed but not notarised. It can also have been notarised previously but later blocked if Apple revokes its ticket after identifying malicious behaviour.

First, Read the Exact Warning

Do not treat every Gatekeeper message as interchangeable.

The wording gives an important clue about the cause.

“App downloaded from the internet”

This is usually an informational confirmation shown the first time you open downloaded software.

If the application is correctly signed and notarised, macOS normally allows you to continue after confirming that you want to open it.

“Developer cannot be verified”

macOS cannot verify that the application comes from an identified Apple developer, or the software does not meet the normal Gatekeeper requirements.

This may happen with:

Older software
Open-source utilities
Internally developed applications
Abandoned applications
A package that was never signed
A package that was signed incorrectly

Only override the warning after independently verifying the application and its source.

“Apple could not verify it is free of malware”

The app may not have been notarised, or macOS could not validate its notarisation status.

Apple’s current guidance allows a user to create a specific exception through Privacy & Security when they are certain that the software is trustworthy.

“App is damaged and can’t be opened”

This can indicate:

A genuinely incomplete or corrupt download
A modified code signature
A packaging error
A revoked certificate
Malware detection
A compatibility problem
An old application that no longer satisfies modern security requirements

Do not immediately assume the app is harmless and that macOS is wrong. Download a fresh copy from the official source first.

“App will damage your computer”

Treat this as a serious security warning.

Do not bypass it. Remove the application and obtain guidance from the developer or your IT provider.

Confirm Where the App Came From

Before overriding any warning, verify the download source.

Prefer:

The Mac App Store
The developer’s official website
Your organisation’s approved software portal
A trusted software-management platform
A verified GitHub release linked from the developer’s website

Avoid installers obtained through:

Search adverts imitating the developer
Download aggregation websites
Unsolicited email attachments
File-sharing services
Pop-up messages
Software-crack websites
Links sent by unknown contacts

A legitimate-looking filename proves very little. Malicious installers frequently imitate well-known products.

Check the Downloaded File

Downloaded Mac software commonly arrives as:

.dmg

.pkg

.zip

.app

A disk image or ZIP file is a container. The application inside it may still have its own signing or notarisation problem.

Check the file’s:

Name
Download location
File size
Developer
Date
Website source

If the developer publishes a checksum, compare it with the downloaded file before running the installer.

For a file in Downloads, a Terminal command such as this can calculate a SHA-256 checksum:

shasum -a 256 ~/Downloads/InstallerName.dmg

Compare the result carefully with the value published by the developer.

Download a Fresh Copy

A partial or altered download can trigger messages suggesting that the application is damaged.

Delete the current installer and download it again directly from the developer.

Before retrying:

Use a stable internet connection
Avoid third-party download managers
Confirm that enough storage is available
Make sure the file has finished downloading
Do not launch it directly from an incomplete browser-download list

If the replacement copy opens normally, the original file was probably incomplete or damaged.

Check That the App Supports Your macOS Version

An application may be correctly signed but too old for the installed version of macOS.

Compatibility issues commonly involve:

Old 32-bit applications
Deprecated system extensions
Legacy kernel extensions
Older installer formats
Unsupported plugins
Software built only for Intel processors
Software expecting an earlier macOS security model

Check the developer’s system requirements.

On an Apple silicon Mac, an Intel application may require Rosetta. macOS normally prompts to install it when a compatible Intel app is launched.

A very old application may no longer have a supported upgrade path. In that situation, look for a current version or a maintained alternative rather than weakening the Mac’s security.

Try Opening the App Normally Once

Attempt to open the application in the ordinary way before looking for an override:

Open Finder.
Go to Applications or Downloads.
Double-click the app or installer.
Read the full warning.
Close the message.

This initial attempt is important because macOS normally shows the Open Anyway option only after the app has been blocked. Apple indicates that the override remains available for roughly an hour after the attempted launch.

Use “Open Anyway” Only After Verification

When you have confirmed that the application is legitimate:

Open the Apple menu.
Select System Settings.
Choose Privacy & Security.
Scroll down to the Security section.
Find the message stating that the app was blocked.
Select Open Anyway.
Authenticate with Touch ID or an administrator password if requested.
Read the warning again.
Select Open only when you are certain.

The application is then saved as a specific exception and should open normally in future.

This is safer than globally disabling Gatekeeper because the exception applies to that particular application.

Use Finder’s Context Menu

Some blocked applications can also be opened through Finder:

Locate the application.
Control-click or right-click it.
Select Open.
Review the warning.
Select Open again if you trust it.

This does not make every unknown application permanently acceptable. It creates an explicit user-approved exception for the selected software.

The exact behaviour can vary according to the warning, the macOS release and device-management restrictions.

Do Not Disable Gatekeeper Globally

Online instructions may suggest running:

sudo spctl --master-disable

or modifying security settings so that applications can be opened from anywhere.

Do not use this as a routine fix.

Globally disabling Gatekeeper removes an important security check from every downloaded application, not only the one you are trying to install.

It can also:

Violate company security policy
Conflict with device management
Increase malware risk
Hide the real packaging problem
Leave the Mac less protected after troubleshooting

Use Apple’s per-application override only when the software has been verified.

Avoid Removing Quarantine Attributes Blindly

Another commonly recommended Terminal command removes the quarantine marker attached to downloaded software:

xattr -d com.apple.quarantine

Removing this attribute can prevent Gatekeeper from performing its usual first-launch checks.

Do not apply it casually, and never run sweeping commands against an Applications folder or Downloads folder.

If a legitimate developer’s app requires users to strip security attributes manually, the developer should correct its signing, packaging or distribution process.

A per-app Privacy & Security exception is normally clearer and safer.

Check the Security Setting

Open:

System Settings > Privacy & Security

Under Allow applications downloaded from, the normal choices are:

App Store
App Store and identified developers

Apple identifies software from the App Store and identified developers as the standard trusted sources under Gatekeeper.

For most users, App Store and identified developers is the appropriate setting.

These options may be unavailable on a business or education Mac because an administrator controls them.

Managed Macs May Block the Override

On an organisation-owned Mac, Gatekeeper settings may be enforced through:

Mobile device management
Apple Business
A configuration profile
Endpoint-security software
Internal compliance policy

The Open Anyway button may be missing, greyed out or ineffective.

Do not try to bypass the restriction. Provide IT with:

The application name
Version
Publisher
Official download source
Exact warning
Business reason for installing it
Required deadline
A screenshot where appropriate

The organisation may need to approve the app, deploy it through management or request a properly notarised build from the supplier.

Check for a Privacy or Permission Problem

An application may install successfully but fail to start or work correctly because macOS has not granted access to required resources.

Open:

System Settings > Privacy & Security

Review relevant sections such as:

Accessibility
Full Disk Access
Files and Folders
Screen and System Audio Recording
Camera
Microphone
Input Monitoring
Automation
Local Network

Only grant permissions that make sense for the application’s function.

For example, a remote-support application may reasonably request screen recording and accessibility access. A simple calculator should not require Full Disk Access.

A permission problem is different from a Gatekeeper block. Do not disable Gatekeeper to solve missing privacy permissions.

Check Whether the Installer Needs Administrator Rights

A .pkg installer may need an administrator password to place components in protected locations.

Make sure:

You are signed into an administrator account
You know the local administrator credentials
The Mac is not restricted by organisational policy
The installer is not being run from a read-only network location

Do not share administrator passwords with unverified installers or remote callers.

Copy the App to Applications

Some applications are designed to be copied from a mounted disk image into the Applications folder before being opened.

A typical process is:

Open the .dmg.
Drag the application to Applications.
Wait for copying to finish.
Eject the disk image.
Open the application from Applications.

Running the app directly from the mounted disk image can cause:

Update failures
Permission problems
Repeated security prompts
Missing helper components
Read-only file errors

Follow the developer’s installation instructions.

Eject and Remount the Disk Image

If the .dmg appears incomplete or the app will not copy:

Close the application.
Eject the disk image in Finder.
Delete the mounted installer if necessary.
Open the original .dmg again.
Retry the copy.

If it continues to fail, download a new disk image.

Check Available Storage

An installation may fail without a clear Gatekeeper message when storage is nearly full.

Open:

System Settings > General > Storage

Ensure there is enough room for:

The downloaded installer
The extracted application
Temporary installation files
Updates
Application support data

An installer may require substantially more free space than the final installed application.

Restart the Mac

A restart clears stalled installer processes and reloads security and file-management services.

Choose:

Apple menu > Restart

After restarting:

Do not reopen every application.
Download a fresh installer if appropriate.
Try the installation again.
Use the supported per-app override only if needed.

If the warning changes after restart, record the new wording.

Install macOS Updates

Open:

System Settings > General > Software Update

Install supported updates after backing up important data.

Updates may contain changes to:

Gatekeeper
XProtect
Certificate validation
Installer services
Rosetta
Application compatibility
Security databases

Do not update solely to force one unsupported legacy application to work, but ensure the Mac is not missing relevant security and compatibility fixes.

Check the Developer’s Certificate Status

A once-working application can become blocked if the developer’s signing certificate has been revoked.

Possible reasons include:

The certificate was compromised
Apple identified malicious distribution
The application was altered
The developer’s account had a security problem

Do not work around a revoked certificate without investigating the cause.

Contact the developer and request:

A current version
A newly signed build
A notarised installer
Confirmation of the official download location

Apple can use revocation information to prevent known malicious software from launching even when it had previously been notarised.

Check Whether the App Has Been Modified

Applications can be damaged after signing by:

Third-party repackaging
Unofficial patches
Plugins inserted into the application bundle
Antivirus quarantine actions
File corruption
Manual modifications
Pirated licence bypasses

A code-signature failure may therefore be macOS correctly detecting that the package no longer matches the developer’s signed version.

Use a clean installer from the original developer rather than trying to repair the modified copy.

Avoid Pirated or “Cracked” Applications

Modified applications are particularly likely to trigger Gatekeeper and notarisation warnings because their code signatures have been altered.

They may also contain:

Password stealers
Remote-access tools
Cryptocurrency miners
Browser hijackers
Data exfiltration malware
Persistent launch agents

Do not weaken macOS security to run software whose signature was deliberately broken.

Obtain a legitimate licence or choose a trusted alternative.

Use Terminal to Inspect an App—Not to Bypass It

Technical users can inspect an application’s signing information with:

codesign -dv --verbose=4 "/Applications/App Name.app"

Gatekeeper’s assessment can be checked with:

spctl --assess --type execute --verbose=4 "/Applications/App Name.app"

For an installer package:

pkgutil --check-signature ~/Downloads/Installer.pkg

These commands may reveal:

The developer identity
Team identifier
Signing authority
Whether the signature is accepted
Whether Gatekeeper rejects the package

They do not prove that the application is trustworthy. Use the results alongside the official source and developer information.

Check Whether the App Is Universal, Intel or Apple Silicon

An app may fail because it was built for an incompatible processor or relies on unsupported components.

In Finder:

Select the application.
Choose File > Get Info.
Check Kind.

You may see:

Application (Universal)
Application (Apple silicon)
Application (Intel)

An Intel app may run on Apple silicon using Rosetta, provided the software is otherwise compatible.

An Apple-silicon-only app will not run on an Intel Mac.

Processor incompatibility is not fixed by bypassing Gatekeeper.

Legacy System Extensions and Kernel Extensions

Some older applications install low-level extensions for:

Antivirus
VPNs
Audio hardware
Virtualisation
Storage
Network filtering
Specialist peripherals

Modern macOS versions apply stricter rules to these components.

The app may install but then request approval under Privacy & Security, or it may require a newer system extension supplied by the developer.

Do not reduce Startup Security or disable System Integrity Protection simply to keep unsupported software working unless a trusted specialist has assessed the full impact.

For business use, obtain an updated version from the supplier.

Try Safe Mode

Safe Mode can help when an installer conflicts with third-party background software.

Apple silicon

Shut down the Mac.
Hold the power button until startup options appear.
Select the startup disk.
Hold Shift.
Select Continue in Safe Mode.

Intel Mac

Restart the Mac.
Immediately hold Shift.
Release it at the login window.

Try the installation again.

If it succeeds only in Safe Mode, investigate:

Security applications
Existing versions of the software
Login items
Device utilities
File-system extensions
Background services

Restart normally afterwards.

Check for an Existing Version

An older or partially removed copy may prevent installation.

Look in:

Finder > Applications

Also check whether the app has its own uninstaller.

Do not manually delete random folders from Library unless the developer specifically documents which files belong to the application.

For complex software, use the official removal tool and restart before reinstalling.

Scan the Download

Control-click the installer and use the security software available on the Mac where appropriate.

On a business Mac, allow the approved endpoint-security system to inspect the file.

Do not upload confidential internal applications to public scanning websites unless the organisation has approved doing so. The package may contain proprietary code or credentials.

When “Open Anyway” Does Not Appear

The button may be absent because:

You have not attempted to open the app recently
More than about an hour has passed
The warning is considered too serious to override normally
The Mac is managed
You are not an administrator
The app was removed
The installer is blocked by another security product
The issue is compatibility rather than Gatekeeper

Try opening the application normally again, then immediately check Privacy & Security.

Do not assume the missing button means Gatekeeper must be disabled.

When the App Opens but Immediately Closes

The installation may have succeeded while the application itself crashes during launch.

Possible causes include:

Incompatible macOS version
Missing Rosetta
Damaged preferences
Missing frameworks
Expired licensing components
Old plugins
A revoked helper tool
User-profile problems

Open Console from:

Applications > Utilities > Console

Search for the application name and inspect messages created at the time of the crash.

A crash is not necessarily a Gatekeeper failure.

When to Contact the Developer

Contact the software supplier when:

The current download is not notarised
The signature is invalid
The certificate is revoked
The app is incompatible with your macOS version
The installer needs security settings to be globally disabled
The application requires unsupported kernel extensions
Multiple users experience the same warning
The official checksum does not match
The app works only after unsafe Terminal modifications

A responsible developer should provide a properly signed, notarised and supported package for normal distribution outside the App Store.

Apple advises developers distributing outside the App Store to sign with Developer ID and submit their software for notarisation.

A Safe Troubleshooting Order

When macOS refuses to install or open an application, follow this sequence:

Read and record the exact warning.
Confirm that the app came from the official developer.
Check the filename, version and compatibility requirements.
Delete the installer and download a fresh copy.
Verify the checksum if the developer publishes one.
Copy the app to Applications where instructed.
Restart the Mac.
Install supported macOS updates.
Try opening the app once normally.
Use Privacy & Security > Open Anyway only after verification.
Check for required privacy permissions.
Confirm there is enough free storage.
Remove an incomplete older version using the official uninstaller.
Test in Safe Mode if other software may be interfering.
Ask the developer for a signed and notarised replacement.
Do not globally disable Gatekeeper or strip security attributes blindly.

When You Should Not Override the Warning

Do not bypass Gatekeeper when:

The app came from an unknown source
The warning says it will damage the computer
The developer’s website cannot be verified
The package has been modified or cracked
The checksum does not match
The certificate has been revoked
The application requests unrelated security permissions
Your organisation has blocked it
A newer supported version exists
The installer requires disabling multiple macOS protections

Apple warns that overriding security controls for unverified software is a common way for malware to infect a Mac.

Need Help Installing a Trusted Mac Application?

Gatekeeper warnings can indicate anything from an outdated installer to a genuinely unsafe download. Disabling security without identifying the reason can expose the Mac and business data to unnecessary risk.

Hamilton Group can verify the application’s source and signature, review its notarisation status, resolve compatibility or permission problems and help deploy approved Mac software safely.

Call 0330 043 0069 or visit hgmssp.com to speak with one of our IT experts.