“Damaged” on a Mac, and how to verify the installer

• The installer is unsigned. Apple’s developer signing and notarization require applying as a company or registered business with identity verification; we are still weighing the cost and trade-offs, so on a Mac the app is from an “unidentified developer”. Gatekeeper blocks exactly that — not the content, but the fact that it doesn’t know who made it.
• Files downloaded from the web get a quarantine flag. When macOS sees it, it checks for a signature and notarization and refuses if they are missing; the message says “damaged” or “cannot verify the developer”, but the cause is the same.
• What we do: the desktop clients are byte-for-byte mirrors of the upstream open-source releases. We don’t modify, repackage or inject anything; we host them only so they are easy to download.

Allowing an app means the system stops checking it, so verify first and allow second — never the other way round. The step below takes a few minutes and needs no special knowledge.

1. Cross-check on VirusTotal. Drop the installer on virustotal.com/gui/home/upload and see how many engines flag it. A handful of (usually heuristic) engines flagging while the major vendors pass it is the classic false-positive pattern; if most major engines flag it, do not install — contact us.
2. Only when the check passes, allow it using the next section. If in doubt, contact support first and we will check the download mirror.

Opening the app may show ““App” is damaged and can’t be opened. You should move it to the Trash”, or “can’t be opened because the developer cannot be verified”. The three steps below go from narrowest to broadest; don’t use the third if the first works.

• Use the xattr command only on files you have verified — see the previous section.
• Don’t run sudo spctl --master-disable to switch Gatekeeper off globally. That removes protection for the whole machine; Control-click → Open affects one app only.
• Since macOS 15 Apple has tightened the Control-click path, so most of the time you’ll need the System Settings step. That’s a system change, not a problem with the installer.

1. In Finder → Applications, Control-click (or right-click) the icon, choose Open, then click Open again in the dialog. This is a one-time exception for this one app.
2. If the context menu offers no usable Open, go to System Settings → Privacy & Security, scroll to the Security section, find ““App” was blocked from use because it is not from an identified developer”, click Open Anyway and confirm with your password.
3. If the message says “damaged”, the first two steps usually don’t help because the system can’t even read a signature. Open Terminal, paste the command below, add a space and the app’s path after it (usually the .app under /Applications/), press Return, enter your login password, then open the app: sudo xattr -dr com.apple.quarantine This removes the download-quarantine flag.
4. On first launch the system asks for your password to install the network extension; approve it or the app can’t route traffic.

We support several connection methods; three of them use clients signed and notarized by their vendors, which open on a Mac with a double-click and never show the prompts above. Same account for all of them.

• Private network (official Tailscale client): vendor-signed, install and go, good for leaving on all day.
• OpenVPN Connect: OpenVPN’s own signed installer; just import the profile.
• Cisco Secure Client: an enterprise client with full signing; many company laptops already have it.
• Setup steps are in “Which connection method” and each method’s guide; the same account works, nothing extra to pay.