macOS says "Clash Verge is damaged and can't be opened" — three fixes

You double-click Clash Verge on your Mac and get this:

"Clash Verge" is damaged and can't be opened. You should move it to the Trash.

Do not delete it. The file is almost certainly fine.

Why this happens

macOS has a security mechanism called Gatekeeper. When you download a file through a browser, the system attaches an extended attribute called com.apple.quarantine to it.

On opening, Gatekeeper checks two things:

The key point: "damaged" is Apple's wording, not a statement about the file's condition. The same mechanism on older macOS versions said "from an unidentified developer", which was far more accurate. Practically every open-source project that has not paid for a developer certificate produces this message.

Fix 1: the xattr command (recommended)

The most direct option, and the narrowest in scope — it removes the quarantine flag from this one app only.

Open Terminal (Launchpad → Other → Terminal) and paste:

sudo xattr -rd com.apple.quarantine /Applications/Clash\ Verge.app

Press Enter, then type your login password. Nothing appears on screen while you type — that is normal. Press Enter again.

Clash Verge will now open.

If your app has a different name or path, adjust it. The easiest approach is to type sudo xattr -rd com.apple.quarantine (note the trailing space) and then drag the app icon into the Terminal window — the path fills itself in.

Fix 2: right-click and open

If you would rather avoid the command line:

Fix 3: allow it in System Settings

On macOS 13 and later:

1. Double-click the app and let it show "damaged", then click Cancel
2. Open System Settings → Privacy & Security
3. Scroll down and you will see "'Clash Verge' was blocked from use because it is not from an identified developer"
4. Click Open Anyway
5. Enter your password to confirm

That notice only appears for a short window after you tried to open the app. If you cannot find it, double-click the app once and come straight back.

Why not just disable Gatekeeper

Plenty of guides tell you to run:

sudo spctl --master-disable

which adds an "Anywhere" option under Privacy & Security and stops all future checks.

Do not. Gatekeeper is a worthwhile defence for most users, and switching it off system-wide to install one app is a poor trade. Fix 1 affects a single app, achieves the same result, and carries far less risk.

If you already disabled it, turn it back on once you are done:

sudo spctl --master-enable

Comparing the three

Related error messages

"Apple could not verify this app is free of malware"

Same class of problem. Any of the three fixes above works.

"cannot be opened because it is not designed for this Mac"

This one is a genuine mismatch — you installed the Apple Silicon build on an Intel Mac, or the other way round. Go back to the download page and get the right architecture. Identifying your chip is covered in the macOS install guide.

It opens and immediately quits, with no message

Run it from the Terminal to see the actual error:

/Applications/Clash\ Verge.app/Contents/MacOS/clash-verge

The terminal prints the real failure, which beats guessing at a silent crash. The usual cause is a corrupted config; deleting the config directory and re-importing your subscription fixes it:

rm -rf ~/Library/Application\ Support/io.github.clash-verge-rev.clash-verge-rev

In short

"Damaged" is a widely misunderstood message on macOS. It means "I cannot verify where this came from", not "this file is broken".

Use xattr -rd com.apple.quarantine — one app, one command, no need to touch system-wide security settings.

The precondition, of course, is that your installer came from our download page or the project's own release page. Anything of unknown origin is better deleted than fixed.