Here's what's happening (in Sierra, 10.12.5)

  • try to launch a non-application file which ISN'T a bundle (e.g. pdf, png -- numbers bundles will be fine) -- by double-clicking, or using open in the Terminal
  • A dialog is prevent with "FILENAME" is damaged and can't be opened. You should move it to the Trash. dialog

What I've tried:

  • safe mode
  • running as a separate user

What I've discovered:

  • It's definitely related to gatekeeper: Turning gatekeeper off with sudo spctl --master-disable makes these images launchable.
  • Something is wrong with spctl the underlying command line utility which manages security policies. See below.

Problem with spctl:

If you run a basic command like spctl --assess -vvv --raw /bin/ls it replies with One or more parameters passed to a function were not valid. (I tried this as it is a diagnostic step in an old but closely related fix.

However running this same command with gatekeeper off gives the correct result. I've also tried to restore the SystemPolicy db from the original by:

  • sudo spctl --master-disable turning gatekeeper off
  • sudo cp -p /var/db/.SystemPolicy-default /var/db/SystemPolicy copying the system policy
  • sudo chmod u+w /var/db/SystemPolicy fix perms
  • restart the computer
  • sudo spctl --master-enable turning gatekeeper back on

But this hasn't helped (but in fact I don't think the SystemPolicy db has reverted back to the defaults -- it seems to grow massively in size (or possibly just revert back to the previous db) when I turn gatekeeper back on.

Any thoughts?


3 Answers 3


Just experienced a similar issue on a 10.13 system after having migrated it from a 10.12 system -- turns out /var/db/gkopaque.bundle wasn't valid, so I copied that from a good 10.13 system (by making a tarball as root on the good system, extracting it as root on the destination system), restarting (the system or killing syspolicyd), and that fixed the issue.

  • How did you work out it was the /var/db/gkopaque.bundle? In my case I just lived with it until it just went away after another OS upgrade. (path of least resistance) Commented Nov 21, 2017 at 15:47
  • 1
    First I debugged spctl, to figure out that it was sending a message to syspolicyd to do the assessment. Then I attached (as root) a debugger to syspolicyd (doing this required turning off SIP), and stepping through its message handler. Eventually I found that the gEngine global variable was uninitialized, and then I found that it was only initialized once via a ModuleNexus object (which uses a dispatch-once thing), so I would overwrite its state in the debugger to trigger a reinitialization, then stepped through that to see what failed. Commented Nov 27, 2017 at 15:43
  • This resolved it for me as well. I have reported the solution back to Apple Support to ensure they are aware of it and know to check this file. I've also posted links back to this for several other reports of the issue on Apple support site and etc. to hope word gets around. A note - the last 10.13.3 update replaced the bad gkopaque file for me, before I could do it manually - so hopefully Apple is aware of the issue?
    – dr.nixon
    Commented Mar 21, 2018 at 15:53

As others have said, replacing /var/db/gkopaque.bundle worked for me. In my case I pulled it from a Time Machine backup by:

  • Running: $ defaults write com.apple.finder AppleShowAllFiles TRUE
  • Relaunching the Finder (command + option + escape)
  • Navigating to /var/db/
  • Entering the Time Machine and navigating to an older version of gkopaque.bundle and clicking restore
  • Exiting the Time Machine
  • Rebooting
  • Running (to confirm): $ spctl --assess -vvv --raw /bin/ls
  • Running: defaults write com.apple.finder AppleShowAllFiles FALSE
  • Relaunching the Finder (command + option + escape)
  • 1
    No need for the AppleShowAllFiles, command+shift+period will do this in Finder
    – Ezekiel
    Commented Nov 14, 2018 at 1:06

I had exactly your problems with Gatekeeper. What worked for me was to replace the /var/db/gkopaque.bundle with a copy from another, good, computer.

I simply used AirDrop to transfer it to the bad Mac. Then login to the bad Mac as root, and move the bundle to /var/db/. After a reboot Gatekeeper is working, the settings in System Preferences > Security & Privacy now "stick" and don't revert back to App Store. As a result apps can now launch when I double-click files in Finder.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .