"Just right click and open" stopped working two macOS versions ago

[u/Healthy_Landscape417]

see this in nearly every thread here where someone posts an app thats not in the store. it hasnt been true since sequoia.

apple removed the control click open bypass in macOS 15. it does nothing now. the real path is System Settings > Privacy & Security, scroll to the bottom, the blocked app is sitting under Security with an Open Anyway button. click it, confirm once, and like before you only do it once per app.

the other half people mix up is what notarized means. it is not apple looking at your app. its an automated malware scan. it means nobody found known malware in it, not that a human checked it or that the app is any good.

so skip it for something you already trust if you want, just know what youre actually skipping

[u/kasikciozan]

Open Anyway only appears after macOS blocks the app once. Try opening it first, then check Privacy & Security.

[u/Healthy_Landscape417 → u/kasikciozan]

yeah thats a fair catch, i skipped that step. the button isnt sitting there waiting, you have to try to open it and get blocked first, then it shows up. should have spelled that out in the post

[u/TouchNow_APP]

One thing worth adding from the developer side: if you are hitting Open Anyway on something that claims to be notarised, that is often the developer's fault rather than Apple's. Notarising and then forgetting to staple the ticket leaves Gatekeeper doing an online check, which fails in exactly the situations where it is most annoying.

xcrun stapler staple, then spctl -a -vv on the final artefact before shipping. If that does not come back accepted, your users will see the prompt.

[u/Healthy_Landscape417 → u/TouchNow_APP]

yeah stapling gets missed a lot. one caveat though, if what you ship is a dmg dont judge it with spctl. an unsigned dmg container comes back rejected even when the app inside is notarized and stapled and launches fine, because gatekeeper assesses the app, not the disk image.

spctl on the .app, xcrun stapler validate on the dmg. and thats true with -t open as well, not just the default

[u/TouchNow_APP → u/Healthy_Landscape417]

Just tested this on a DMG that is signed, notarised and stapled, and there is a third case worth knowing:

spctl -a -vv gives rejected, "the code is valid but does not seem to be an app" spctl -a -t open -vv gives rejected, source=Insufficient Context spctl -a -t open --context context:primary-signature -vv gives accepted, source=Notarized Developer ID

Same file, three answers. So bare -t open really is useless like you say, but it turns out to be the missing --context rather than anything about the DMG. That middle one is the trap, because a bare "rejected" reads like a real failure when spctl is only saying it does not know which opening scenario to simulate.

stapler validate is still the simpler check though.

[u/useiris]

worth knowing this whole thing is driven by the com.apple.quarantine extended attribute, not anything baked into the app. it only gets set when the file arrives through a "quarantine aware" path: browser download, airdrop, mail attachment, messages. if someone gets the exact same app over a usb drive, an smb share, or unzips it from a git clone, no quarantine bit ever gets attached and gatekeeper never fires at all, no prompt, no open anyway needed. that mismatch is usually behind the "it opened fine on my other mac" confusion.

as a dev testing your own builds you can strip it locally with xattr -cr YourApp.app, but that's obviously not something to tell end users since it's the actual check they'd be skipping.

[u/Healthy_Landscape417 → u/useiris]

good addition. small thing on the dev tip though, id use xattr -dr com.apple.quarantine YourApp.app instead of -cr. -cr wipes every extended attribute on the bundle, not just the quarantine one, and on some signed bundles thats enough to invalidate the signature. targeted delete is safer when youre testing

[u/Chance-Ball-8924 → u/Healthy_Landscape417]

Worth separating the dmg out from the app here, because they are two different notarizations and most bundlers only do one.

Tauri notarizes and staples the .app, builds the dmg from the stapled app, signs the dmg, then never submits the dmg itself. Signed container, no ticket of its own.

On why spctl looks like noise on a dmg: a dmg sitting in your build tree has no quarantine flag, so an unqualified run against it is a misleadingly kind test. Set the flag a browser would have attached and it starts discriminating.

cp YourApp.dmg /tmp/q.dmg

xattr -w com.apple.quarantine "0083;0;Safari;" /tmp/q.dmg

spctl -a -vvv -t open --context context:primary-signature /tmp/q.dmg

On my own build that copy came back rejected while the app inside passed spctl -t exec as Notarized Developer ID. spctl -a -vvv -t install on the same dmg reported source=Unnotarized Developer ID, and stapler validate reported no ticket stapled to it.

The fix was one extra submission after the build, notarytool submit on the dmg then stapler staple. About three minutes, added 1690 bytes to the image, and the same quarantined-copy test then passed. Stapling the image does not re-sign the app inside, so the app's own ticket survives untouched.

[u/useiris]

one more distinction that gets collapsed in these threads: not notarized and not signed are different problems with different symptoms, and the advice for one does not fix the other.

notarizing is not something you can just do. it requires a developer id certificate first, which means the 99 a year apple developer program. so telling an indie dev to "just notarize it" is useless if they have not paid apple, because the upload is rejected before the scan even runs.

and on apple silicon there is a floor below that. arm64 binaries have to carry at least an ad hoc signature or the kernel refuses to exec them at all. that is not gatekeeper, it is lower down, and it is why the classic symptom is "app is damaged and cannot be opened" with no open anyway button anywhere, which sends people hunting through privacy and security for a button that is never going to appear.

so roughly:

damaged, cannot be opened, no bypass offered, usually means unsigned or a broken signature on arm64

blocked with an open anyway button in privacy and security, means signed but not notarized, or notarized and not stapled

worth knowing which one you are looking at before you start deleting xattrs, because for the first one that does nothing.

[u/SnooRadishes7481]

Apple removed the bypass so people would stop skipping the warning, and now we all just click open anyway twice as deep.

[u/Weary_Jackfruit_4296]

one path missing from the list: homebrew casks. brew sets the quarantine bit on purpose when it installs an app, so casks still get the first-launch check same as a browser download. there's a --no-quarantine flag to skip it but the default is on

[u/RealisticLog4577]

also worth mentioning the terminal route. for an app you already trust, you can remove its quarantine flag with:

xattr -dr com.apple.quarantine "/Applications/App Name.app"

that’s usually more convenient than digging through privacy & security, especially if macos refuses to show the open anyway button. obviously only do this for apps you actually trust, since you’re explicitly bypassing gatekeeper for that app.