Troubleshooting macOS Gatekeeper: A Diagnostic Guide for Ventura and Later

Recognizable Condition

When you try to launch an application, you either see a dialog that says "[AppName] can’t be opened because it is from an unidentified developer", or the app quits immediately with no user interface. This is Gatekeeper rejecting the binary before it can run.

Cause & Diagnostic Table

Potential Cause	Typical Symptom	How to Detect
Unsigned or missing notarization	Gatekeeper dialog appears immediately	Run spctl -a -t execute -vv /Path/To/App – look for “rejected”
Security & Privacy set to "App Store only"	All non‑App‑Store apps block	Check System Settings → Security & Privacy → General
Corrupted quarantine attribute on an otherwise allowed app	App quits without warning after being previously approved	Run xattr -l /Path/To/App – look for com.apple.quarantine
System Integrity Protection (SIP) preventing policy changes	Commands like spctl --master-disable return “Operation not permitted”	Boot into Recovery and run csrutil status

Ordered Checks

1. Verify the app’s signature and notarization status:

   spctl -a -t execute -vv /Applications/ExampleApp.app

   Expected output ends with accepted if the binary is signed and notarized. If it shows rejected, proceed to step 4.

2. Check Gatekeeper policy:

   spctl --status

   Output should be assessments enabled. If it shows assessments disabled, Gatekeeper is turned off.

3. Review user‑level security settings:

   Open System Settings → Security & Privacy → General. Ensure the source is set to "App Store and identified developers". If it’s "App Store only", Gatekeeper will block all other binaries.

4. Inspect quarantine attributes:

   xattr -l /Applications/ExampleApp.app

   If com.apple.quarantine is present, remove it with xattr -d com.apple.quarantine /Applications/ExampleApp.app. This clears a stale quarantine flag that can trigger re‑evaluation.

5. Check Console for Gatekeeper logs:

   log show --predicate 'subsystem == "com.apple.gatekeeper"' --info --last 1h

   Look for entries that reference the app’s bundle identifier. These entries confirm whether Gatekeeper is actively rejecting the binary.

Fixes Tied to Findings

• Unsigned or missing notarization: Obtain a notarized build from the vendor or re‑sign with a valid Developer ID and notarize via Xcode or notarytool. After notarization, re‑run the spctl check to confirm acceptance.
• "App Store only" policy: Temporarily switch to "App Store and identified developers" in System Settings or run sudo spctl --master-disable (this disables Gatekeeper entirely). After testing, re‑enable with sudo spctl --master-enable to restore security.
• Quarantine attribute present: Remove it with xattr -d com.apple.quarantine /Applications/ExampleApp.app. Verify the attribute is gone by re‑running xattr -l.
• SIP blocking changes: Boot into Recovery, run csrutil disable, reboot, adjust Gatekeeper policy, then run csrutil enable to restore SIP. Use this only when other steps fail.

Escalation Criteria

If after applying the appropriate fix the app still fails to launch, gather the following information:

1. Full Gatekeeper log: log show --predicate 'subsystem == "com.apple.gatekeeper"' --info --last 1h
2. App’s bundle identifier and version (found in Info.plist).
3. The exact error message displayed.
4. Any custom signing certificates used.

Submit this package to Apple’s Feedback Assistant under the “Security” category. Apple’s engineering team will review the log and determine if a bug or mis‑configuration is at fault.

Limitations & Practical Verification

• Disabling Gatekeeper globally exposes the system to malware. Use sudo spctl --master-disable only for short‑term testing and re‑enable immediately after.
• Removing quarantine attributes without verifying provenance can allow tampered code. Always compare the binary’s hash to the vendor’s published checksum.
• After each fix, confirm acceptance with spctl -a -t execute -vv /Applications/ExampleApp.app and launch the app from Finder to ensure no Gatekeeper dialog appears.

Concrete Example

Suppose you’re trying to run ExampleApp.app from /Applications and receive the Gatekeeper warning. Follow these steps:

1. Run spctl -a -t execute -vv /Applications/ExampleApp.app → output shows rejected.
2. Check policy: spctl --status → assessments enabled.
3. Verify Security & Privacy setting is "App Store only" → change to "App Store and identified developers".
4. Re‑run spctl → now shows accepted.
5. Launch the app; it opens without warning.

These steps resolve the most common Gatekeeper blockage scenarios on macOS Ventura and later.