What the message actually means

Anything a browser downloads gets a com.apple.quarantine extended attribute. On first launch Gatekeeper checks for a Developer ID signature and an Apple notarization ticket. Missing signature gives you "cannot be opened because the developer cannot be verified"; a signature or notarization that does not check out gives you the scarier "damaged" wording.

Plenty of Clash clients ship unnotarized builds, and some macOS packages are community-made, so both messages show up regularly. An actually corrupt download is rare, but comparing the dmg size against the release page takes five seconds.

SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes

Allowing it through the UI

  1. Drag the app from the dmg into Applications and eject the dmg. Do not run it from inside the disk image.
  2. Double-click the app once and dismiss the warning. This step matters — the system has to record the block before it can offer to undo it.
  3. Open System Settings, Privacy & Security, scroll down to the Security section. A line will read "… was blocked from use because it is not from an identified developer." Click Open Anyway.
  4. Launch the app again and confirm with Open. You will not be asked a third time.

Since macOS Sequoia, the old Control-click then Open shortcut no longer works for apps that fail notarization; the Privacy & Security route is the only one left. If you are following an older tutorial and right-clicking does nothing, that is why.

Clearing the quarantine flag from the terminal

If that button never appears, or the app came from a plain zip rather than a dmg, remove the attribute directly. Open Terminal and adjust the path:

xattr -dr com.apple.quarantine /Applications/Clash\ Verge.app

No output means it worked. -d deletes the attribute, -r walks everything inside the bundle. To check first, run xattr -l /Applications/yourapp.app.

Still will not launch

  • Check the architecture. Apple silicon needs the aarch64 or arm64 build, Intel needs x64 or amd64. The wrong one usually quits instantly instead of printing an error.
  • TUN mode and system proxy need a privileged helper. The first time you enable them macOS asks for your admin password; cancelling leaves you with no connectivity.
  • If the app runs but the menu bar icon is missing, check System Settings then Control Center for a collapsed menu bar before reinstalling anything.
Security note: xattr -dr switches off a safety check by hand. Use it only on apps you downloaded from the project’s official release channel and verified yourself — never on a dmg of unknown origin.