You downloaded a plugin and macOS says it is damaged and you should move it to the Trash, or that the developer cannot be verified. The file is almost never actually damaged. This is Gatekeeper blocking a plugin that was not signed and notarized, and there is a clean fix.
Steps are for recent macOS on both Apple Silicon and Intel. Apple has changed the exact wording and buttons across versions, so where it matters the difference is called out.
Almost always the plugin is not really damaged. When you download any file, macOS attaches a quarantine flag to it. Gatekeeper reads that flag and blocks the file if the plugin was not signed and notarized by a developer registered with Apple. That single cause shows up as three different warnings, so people search for three different problems that all have the same fix.
These are the messages you might see, with the plugin or installer name in place of the brackets:
| The warning macOS shows | What it actually means |
|---|---|
| "[name] is damaged and can't be opened. You should move it to the Trash." | Quarantined and unsigned, or a genuinely corrupted download |
| "[name] cannot be opened because the developer cannot be verified." | Quarantined, and not notarized by Apple |
| "Apple could not verify [name] is free of malware." | The same block, worded for newer macOS |
The one real exception is the first message. Now and then a download truly did get damaged in transfer, and no amount of settings will help. So if the file is small, fetch a fresh copy first to rule that out. If a fresh copy still throws the warning, it is the quarantine flag, and the steps below clear it.
The download is blocked because it is not signed and notarized, not because it is broken. You either tell macOS to open it anyway, or you strip the quarantine flag off the file yourself. A plugin that is properly signed and notarized never shows any of these warnings in the first place.
For an installer or a standalone app you double-click, open System Settings, go to Privacy & Security, scroll to the Security section, and click Open Anyway. On older macOS you could instead Control-click the file and choose Open, but recent versions removed that shortcut for this warning.
This is the reliable path on current macOS.
On macOS Sonoma and earlier you could Control-click, or right-click, the app or installer, choose Open, then click Open again in the dialog. macOS Sequoia and later removed this bypass for the "developer cannot be verified" and "free of malware" warnings, so on a newer Mac use the Privacy & Security route above instead.
A plugin bundle, an .component, .vst3 or .aaxplugin,
is loaded by your DAW rather than double-clicked, so the Open Anyway button often never appears
for it. When there is nothing to click, the Terminal command in the next section is the way to
clear it.
Open Terminal and run one command that strips the quarantine flag from the plugin:
xattr -dr com.apple.quarantine followed by the full path to the plugin. This works
even when there is no Open Anyway button, because it removes the flag Gatekeeper is reading.
Terminal is in Applications, in the Utilities folder, or press Cmd+Space and type
Terminal. Then use the command below.
xattr -dr com.apple.quarantine /path/to/plugin The -d flag
deletes the quarantine attribute and the -r flag applies it through the whole
plugin bundle, since a plugin is really a folder of files.
You do not have to type the path. Type xattr -dr com.apple.quarantine and a
space, then drag the plugin from Finder onto the Terminal window. That drops in the exact path.
Press Return.
If the plugin sits in the top-level /Library folder, shared by every user, macOS
needs an admin password to change it. Put sudo in front and enter your password when
asked, nothing appears on screen as you type it. For example, for a VST3 in the shared folder:
sudo xattr -dr com.apple.quarantine "/Library/Audio/Plug-Ins/VST3/YourPlugin.vst3"
A plugin in your home-folder ~/Library needs no sudo. To confirm it
worked, run xattr followed by the same path and check that
com.apple.quarantine is no longer in the list, then quit and reopen your DAW. This
removes the flag from that one plugin only. It does not turn off Gatekeeper or any other macOS
protection.
If the plugin still does not appear after this, the block was probably never the real issue. The plugin not showing up checklist covers the other ordinary causes, and the installing on macOS guide has the exact folder for each format.
Use plugins that are code-signed with an Apple Developer ID and notarized by Apple. macOS sees the signature and the notarization and lets the plugin install and load with no warning, even though it was downloaded. None of the messages on this page can appear.
Signing ties the file to a developer Apple has registered. Notarization means Apple has already scanned the plugin and cleared it. When both are in place, the quarantine flag is still there but Gatekeeper passes the file through, so it just opens. Every damaged, unverified or malware warning on this page comes from a plugin that skipped one of those steps, which is why anything from a developer who does both works on the first try.
The Tunary Collection is three instruments: ARGISH, SILT and REHEAT. Every one is code-signed and Apple-notarized, so you never see the damaged, cannot be verified or free of malware warnings on this page. Each ships as an Audio Unit, a VST3, an AAX and a standalone on macOS, and as a VST3 on Windows, so it lands in the right folder and loads on the first launch.
Try one free in your browser first, no install and no account. The whole Collection is one purchase.
We write these when there is something worth writing down. One email when a new one lands or a new Tunary instrument ships. No newsletter, no schedule.
Tunary