Basically, I used the native Safari.app web browser to download a third party application and I want to run / open it from the comfort of my bash shell / Terminal.app CLI; despite the following error message:

“<unidentified_thirdparty.app>” can’t be opened because it is from an unidentified 
 developer. Your security preferences allow installation of only apps from the Mac 
 App Store and identified developers. Safari downloaded this file on <today's_date> 
 from <the.inter.net>.

3 Answers 3


You'll either have to change the settings under System Preferences > Security & Privacy > General > Allow applications downloaded from: to Anywhere or in a Terminal, strip the xattr com.apple.quarantine attribute from the downloaded file(s).

xattr -dr com.apple.quarantine "unidentified_thirdparty.app"
  • I was aware of the GUI method. The next part looks spot-on though. What exactly does the com.apple.quarantine (attribute) argument refer to?
    – voices
    Sep 8, 2015 at 2:21
  • 1
    @tjt263, Sorry I didn't see your comment until now... All filesystem objects have attributes, e.g. information you'd see in the output of the ls -l file command. Filesystem objects also have extended attributes of which com.apple.quarantine is one that is assigned to objects downloaded from the Internet by OS X to help prevent arbitrary execution and thus one level of protecting the system. Using ls -lR@ file or xattr −lr file will show extended attribute information the latter of which will output more extensive information. See man xattr for more information. Jan 31, 2016 at 14:17
  • Wow. That's interesting. I did not know about that. Do other Operating Systems have something like this in place?
    – voices
    Jan 31, 2016 at 18:21
  • You can also use either right-click (aka ctrl-click) and choose "Open", to allow executing just that app. May 1, 2016 at 1:19
  • 1
    @HawkenRives, Yes it does as it's a global setting not the actual running or opening of the file as the right-click on the file does. Using xattr portion of my answer cover the command line and Terminal. May 1, 2016 at 1:32

Enter this in the Terminal under a administrator account: sudo spctl --master-disable

  • 1
    This turns off Gatekeeper completely. And it is not an answer to the question.
    – user61744
    Sep 1, 2017 at 7:47

To do it wisely in command line

  1. xattr -p com.apple.quarantine unidentified_thirdparty.app outputs something like 0081;5e7fec61;Chrome;6585C1D3-E260-4275-9E6E-505DF8D6B7EE
  2. Copy the output string, replace first 4 characters with 00c1
  3. run xattr -w com.apple.quarantine 00c1;5e7fec61;Chrome;6585C1D3-E260-4275-9E6E-505DF8D6B7EE unidentified_thirdparty.app

or, combine these steps into a single command:

xattr -w com.apple.quarantine "$(attr -p com.apple.quarantine unidentified_thirdparty.app | sed 's/^.\{4\}/00c1/' )" unidentified_thirdparty.app

My blog post on this.

  • What does each of the values in the com.apple.quarantine attribute mean? Jul 27, 2020 at 20:25
  • 1
    @DanielSerodio thanks for the proofreading. The value stores information of the downloader agent (chrome, curl, wget, etc.) and related info. The last id is used to search for the co-located entry in ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 (sqlite format). Check this answer for more info.
    – transang
    Jul 27, 2020 at 23:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .