https://blog.margrop.net/en/tag/gatekeeper/ Recent content in Gatekeeper on Margrop Blog Hugo en-US Mon, 01 Jun 2026 07:35:00 +0800 https://blog.margrop.net/en/post/macos-gatekeeper-unsigned-app-fix/ Mon, 01 Jun 2026 07:35:00 +0800 https://blog.margrop.net/en/post/macos-gatekeeper-unsigned-app-fix/ <blockquote> <p><strong>The short version</strong></p> <p>When a macOS utility refuses to launch after being downloaded, the first conclusion should not be “the app is broken.” A very common cause is a combination of two facts: the app still has the <code>com.apple.quarantine</code> extended attribute that marks it as downloaded from the internet, and the app bundle does not have a usable signature that Gatekeeper can trust. For first launch, “downloaded from the web + no usable signature” is enough for macOS to block it.</p> <p>For a tool whose source you understand and trust, the smallest local repair is straightforward: inspect the quarantine attribute, verify the signing state, apply a local ad-hoc signature to that one app bundle, remove quarantine from that one app, and then verify the result. The point is not to turn off macOS security globally. The point is to fix one known local tool while keeping the safety boundary clear.</p> </blockquote> <p>This post is based on a real local troubleshooting session, but all private details have been removed. There are no real internal addresses, usernames, tokens, private download locations, hostnames, or machine-specific paths. The examples use placeholders such as <code>/Applications/&lt;App&gt;.app</code> and <code>&lt;App&gt;</code>. The goal is to share a repeatable diagnostic method, not to expose an environment.</p>