Jdk is damaged when running elacticsearch in Mac

Elastic Stack Elasticsearch
1

Hello forum,
I just recently installed elasticsearch on a MacBook.
After a successfully unpacking and trying to run bin/elasticsearch I get the following popup message "idk is damaged".
I have tried:
xattr -d com.apple.quarantine jdk.app
which gives me back:
xattr: jdk.app: No such xattr: com.apple.quarantine

Any idea what is happening here?
Thanks much

2

from my own hand rolled upgrade script I have

xattr -d -r com.apple.quarantine /path/to/elasticsearch-9.0.0

and I know that worked for me on latest MacOS, Sequoia 14.5.1, and latest (at the time) elasticsearch, running on a apfs filesystem. And on several previous versions of elasticsearch.

This is what I now get on the 9.0.0 tree

~/ELK/elasticsearch-9.0.0 ❯ pwd
/Users/me/ELK/elasticsearch-9.0.0

~/ELK/elasticsearch-9.0.0 ❯ /usr/bin/xattr -rlv .
./jdk.app: com.apple.macl:
./modules/x-pack-ml/platform/darwin-aarch64/controller.app: com.apple.macl:
3

Thank you RainTown. After trying your recommendation, I keep getting the same error.
I'm on Sequoia 15.4.1 and trying elasticsearch 8.17.4

4

Screenshot 2025-05-02 at 8.20.23 PM
Screenshot 2025-05-02 at 8.20.23 PM544×504 52.3 KB

5

I don’t think this is the error screen I see before I execute the xattr commands. I’ll check again later.

Is there some (corporate/privare?) “protection/security/…” software running on the Mac? Did you try deleting and re-downloading, and please check the checksums.

6

So I re-downloaded elasticsearch-8.17.4-darwin-aarch64.tar.gz and checked SHA512:

$ cd ~/Downloads
$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.17.4-darwin-aarch64.tar.gz
$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.17.4-darwin-aarch64.tar.gz.sha512
$ cat elasticsearch-8.17.4-darwin-aarch64.tar.gz.sha512
1311f0fb7f389c337148de354903830abcefd6b292e9900c7be6342feec3db5747ebc8211ec5a39eaf6660f8bef47f80ebd811c60973c68f93f3cbcdfeb35ef2  elasticsearch-8.17.4-darwin-aarch64.tar.gz
$ ls -l elasticsearch-8.17.4-darwin-aarch64.tar.gz
-rw-r--r--  1 km  staff  473546950 25 Mar 10:32 elasticsearch-8.17.4-darwin-aarch64.tar.gz
$ sha512 elasticsearch-8.17.4-darwin-aarch64.tar.gz
SHA512 (elasticsearch-8.17.4-darwin-aarch64.tar.gz) = 1311f0fb7f389c337148de354903830abcefd6b292e9900c7be6342feec3db5747ebc8211ec5a39eaf6660f8bef47f80ebd811c60973c68f93f3cbcdfeb35ef2
$ cd ~/ELK
$ tar zxf ~/Downloads/elasticsearch-8.17.4-darwin-aarch64.tar.gz
$ cd elasticsearch-8.17.4
$ bin/elasticsearch
CompileCommand: dontinline java/lang/invoke/MethodHandle.setAsTypeCache bool dontinline = true
CompileCommand: dontinline java/lang/invoke/MethodHandle.asTypeUncached bool dontinline = true
[2025-05-03T23:41:20,828][INFO ][o.e.n.j.JdkVectorLibrary ] [M1MacMini.fritz.box] vec_caps=1
...

The SHA512s match.

before I start elasticsearch the below command returned nothing, but after elasticsearch started I saw:

$ /usr/bin/xattr -rlv ~/ELK/elasticsearch-8.17.4
/Users/vf/ELK/elasticsearch-8.17.4/jdk.app: com.apple.macl:
/Users/vf/ELK/elasticsearch-8.17.4/modules/x-pack-ml/platform/darwin-aarch64/controller.app: com.apple.macl:

elasticsearch started this time without any error / popup around jdk.app, maybe because I already allowed jdk.app for this release, before I updated to 9.0.0.