It won’t open. Here is why, and what to do.

What the warning actually means

A code signature is a certificate a developer buys, from Apple or from a certificate authority, and attaches to what they ship. It says which identity built this file and that nobody has altered it since.

Nobody has bought one for these. So the warning means exactly one thing: the operating system cannot tell you who made this. It does not mean the file has been examined and found dangerous, and — this is the part worth being clear about — a signature would not mean it had been examined and found safe either. Plenty of signed software is unpleasant. Signing buys accountability, not virtue.

What you can check instead is on every program’s page: the SHA-256 of every file, and the full source it was built from. What that proves, and what it does not, is worth two minutes if you would rather not take anybody’s word for it.

macOS

Two separate things stand between you and a downloaded program on a Mac, and it is easy to fix one and be stopped by the other.

1. Make it executable

Browsers save downloads without permission to run. These are plain binaries rather than .app bundles, so that matters:

chmod +x ~/Downloads/dupepilot-gui-darwin-arm64

2. Clear the quarantine flag

macOS marks everything a browser downloads. For an unsigned binary that mark is what produces “cannot be opened because the developer cannot be verified”. Remove it for that one file:

xattr -d com.apple.quarantine ~/Downloads/dupepilot-gui-darwin-arm64

Then run it:

~/Downloads/dupepilot-gui-darwin-arm64

If you would rather not use Terminal: try to open it once and let it be refused, then go to System Settings → Privacy & Security, scroll to the Security section, and there will be a line about the program that was just blocked with an Open Anyway button. That button only appears after the first refusal, and on recent versions of macOS it is the only place it appears — it was removed from the dialog itself.

Which Mac file to take

Apple Silicon — any M1, M2, M3 or M4 Mac — wants the darwin-arm64 file. An Intel Mac wants darwin-amd64. If you are not sure, click → About This Mac and look at the chip. Taking the wrong one gives you “bad CPU type in executable”.

Windows

Windows shows a blue full-screen panel titled Windows protected your PC. There is no visible button at first — the way through is:

1. Click More info, which is the small link in the panel.
2. Click Run anyway, which appears once you do.

If the file will not run at all rather than warning you, Windows has marked it as coming from the internet. Right-click the file → Properties → tick Unblock at the bottom of the General tab → OK.

If an antivirus removes it

This happens, and it is worth understanding rather than working around blindly. Unsigned programs that walk a lot of files look, to a heuristic, like something worth flagging — and walking a lot of files is precisely what a duplicate finder does. It is a guess made about a file with no signature to identify it.

What to do: check the SHA-256 on the program’s page against the file you downloaded. If it matches, the file is the one published here. You can then report it to your antivirus vendor as a false positive, which helps everybody, or build the program yourself from the source next to the download.

Adding a permanent exclusion for your Downloads folder is not a good trade, and we would rather you did not.

Linux

chmod +x ./dupepilot-linux-amd64
./dupepilot-linux-amd64

No warning to clear. There are Linux builds of the command-line programs, though the windows are Windows and macOS only.

The window and the command line are the same file

Worth knowing when something is not behaving: double-clicking a program opens its window, and giving that same file arguments runs it as a command-line tool. So if a window will not start, running the same file from a terminal with --help is the fastest way to see what it says for itself.

./dupepilot-gui-darwin-arm64 --help

If none of that works

Every program publishes its full source and its build instructions beside the download, so building it yourself is always available:

cd tools/dupepilot/src
go build -o dupepilot .

And it is worth saying plainly: these are previews. If a program starts and then does not do what its page says it does, the page is wrong and we would like to know rather than have you assume it is you.