macOS says Notula is damaged. The download is fine.

Fix it in three steps

1. 01

   Drag Notula into Applications

   Open the .dmg and drag the app across. The command below names that location, so do this part first.

2. 02

   Run this in Terminal

   Terminal is in Applications, under Utilities. Paste the line, press Return. It prints nothing and asks for no password.

   xattr -dr com.apple.quarantine /Applications/Notula.app Copy
3. 03

   Open Notula

   It starts normally from now on, and updates itself from then on without repeating any of this.

What that command does

Nobody should paste a command they have not had explained. When a browser downloads a file, macOS writes an extended attribute on it called com.apple.quarantine, which marks it as having come from the internet. Gatekeeper then checks who signed the app. Notula has no Developer ID certificate yet, so that check finds no signature, and the message macOS chose for that case is the word damaged.

xattr reads and writes those attributes. -d com.apple.quarantine deletes that one attribute and -r walks the whole app bundle. It touches nothing else, needs no password, and applies only to the app you name. The same command is what Homebrew and every other unsigned Mac build asks for.

It goes away the day Notula has a certificate. That is a paid Apple Developer account and a notarisation step, not a technical obstacle, and it is listed openly on the status table.

It still says damaged

• You ran the command before moving the app

  The quarantine flag travels with the file. Copying the app to Applications after clearing it brings the flag along. Run the command again now that the app is in place.

• Notula is not in Applications

  The command names /Applications/Notula.app. If the app is somewhere else, put that path in instead, or drag the app onto the Terminal window after typing xattr -dr com.apple.quarantine and a space, which fills the path in for you.

• You are on a managed Mac

  Some company devices block unsigned apps outright, and no command gets past that. There is nothing to work around here: it needs the signed build, and until then Notula will not run on that machine.

On Windows, it is SmartScreen

The installer is unsigned for the same reason, so the first time you run it Windows shows a blue panel saying it protected your PC. Choose More info, then Run anyway. There is no command and nothing else to do; the panel appears once.