# Jdk is damaged when running elacticsearch in Mac

**URL:** <https://discuss.elastic.co/t/jdk-is-damaged-when-running-elacticsearch-in-mac/377582>\
**Category:** Elasticsearch\
**Created:** [April 28, 2025, 3:36pm UTC](https://discuss.elastic.co/t/jdk-is-damaged-when-running-elacticsearch-in-mac/377582 "2025-04-28T15:36:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alakser](https://avatars.discourse-cdn.com/v4/letter/a/54ee81/32.png) [@Alakser](https://discuss.elastic.co/u/Alakser)\
**Post date:** [April 28, 2025, 3:36pm UTC](https://discuss.elastic.co/t/jdk-is-damaged-when-running-elacticsearch-in-mac/377582/1 "2025-04-28T15:36:31Z")

</div>

Hello forum,  
I just recently installed elasticsearch on a MacBook.  
After a successfully unpacking and trying to run bin/elasticsearch I get the following popup message "idk is damaged".  
I have tried:  
xattr -d com.apple.quarantine jdk.app  
which gives me back:  
xattr: jdk.app: No such xattr: com.apple.quarantine

Any idea what is happening here?  
Thanks much

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [April 28, 2025, 5:09pm UTC](https://discuss.elastic.co/t/jdk-is-damaged-when-running-elacticsearch-in-mac/377582/2 "2025-04-28T17:09:30Z")

</div>

from my own hand rolled upgrade script I have

```auto
xattr -d -r com.apple.quarantine /path/to/elasticsearch-9.0.0

```

and I know that worked for me on latest MacOS, Sequoia 14.5.1, and latest (at the time) elasticsearch, running on a apfs filesystem. And on several previous versions of elasticsearch.

This is what I now get on the 9.0.0 tree

```auto
~/ELK/elasticsearch-9.0.0 ❯ pwd
/Users/me/ELK/elasticsearch-9.0.0

~/ELK/elasticsearch-9.0.0 ❯ /usr/bin/xattr -rlv .
./jdk.app: com.apple.macl:
./modules/x-pack-ml/platform/darwin-aarch64/controller.app: com.apple.macl:

```

---

<div class="post-metadata">

**Author:** ![Alakser](https://avatars.discourse-cdn.com/v4/letter/a/54ee81/32.png) [@Alakser](https://discuss.elastic.co/u/Alakser)\
**Post date:** [May 3, 2025, 1:19am UTC](https://discuss.elastic.co/t/jdk-is-damaged-when-running-elacticsearch-in-mac/377582/3 "2025-05-03T01:19:08Z")

</div>

Thank you RainTown. After trying your recommendation, I keep getting the same error.  
I'm on Sequoia 15.4.1 and trying elasticsearch 8.17.4

---

<div class="post-metadata">

**Author:** ![Alakser](https://avatars.discourse-cdn.com/v4/letter/a/54ee81/32.png) [@Alakser](https://discuss.elastic.co/u/Alakser)\
**Post date:** [May 3, 2025, 1:21am UTC](https://discuss.elastic.co/t/jdk-is-damaged-when-running-elacticsearch-in-mac/377582/4 "2025-05-03T01:21:46Z")

</div>

![Screenshot 2025-05-02 at 8.20.23 PM](https://us1.discourse-cdn.com/elastic/original/3X/9/5/958c955e94ef0656dbda8848f573c3fb068f76c0.png)

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [May 3, 2025, 11:55am UTC](https://discuss.elastic.co/t/jdk-is-damaged-when-running-elacticsearch-in-mac/377582/5 "2025-05-03T11:55:09Z")

</div>

I don’t _think_ this is the error screen I see before I execute the xattr commands. I’ll check again later.

Is there some (corporate/privare?) “protection/security/…” software running on the Mac? Did you try deleting and re-downloading, and please check the checksums.

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [May 3, 2025, 9:56pm UTC](https://discuss.elastic.co/t/jdk-is-damaged-when-running-elacticsearch-in-mac/377582/6 "2025-05-03T21:56:22Z")

</div>

So I re-downloaded elasticsearch-8.17.4-darwin-aarch64.tar.gz and checked SHA512:

```auto
$ cd ~/Downloads
$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.17.4-darwin-aarch64.tar.gz
$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.17.4-darwin-aarch64.tar.gz.sha512
$ cat elasticsearch-8.17.4-darwin-aarch64.tar.gz.sha512
1311f0fb7f389c337148de354903830abcefd6b292e9900c7be6342feec3db5747ebc8211ec5a39eaf6660f8bef47f80ebd811c60973c68f93f3cbcdfeb35ef2 elasticsearch-8.17.4-darwin-aarch64.tar.gz
$ ls -l elasticsearch-8.17.4-darwin-aarch64.tar.gz
-rw-r--r-- 1 km staff 473546950 25 Mar 10:32 elasticsearch-8.17.4-darwin-aarch64.tar.gz
$ sha512 elasticsearch-8.17.4-darwin-aarch64.tar.gz
SHA512 (elasticsearch-8.17.4-darwin-aarch64.tar.gz) = 1311f0fb7f389c337148de354903830abcefd6b292e9900c7be6342feec3db5747ebc8211ec5a39eaf6660f8bef47f80ebd811c60973c68f93f3cbcdfeb35ef2
$ cd ~/ELK
$ tar zxf ~/Downloads/elasticsearch-8.17.4-darwin-aarch64.tar.gz
$ cd elasticsearch-8.17.4
$ bin/elasticsearch
CompileCommand: dontinline java/lang/invoke/MethodHandle.setAsTypeCache bool dontinline = true
CompileCommand: dontinline java/lang/invoke/MethodHandle.asTypeUncached bool dontinline = true
[2025-05-03T23:41:20,828][INFO][o.e.n.j.JdkVectorLibrary] [M1MacMini.fritz.box] vec_caps=1
...

```

The SHA512s match.

_before_ I start elasticsearch the below command returned nothing, but _after_ elasticsearch started I saw:

```auto
$ /usr/bin/xattr -rlv ~/ELK/elasticsearch-8.17.4
/Users/vf/ELK/elasticsearch-8.17.4/jdk.app: com.apple.macl:
/Users/vf/ELK/elasticsearch-8.17.4/modules/x-pack-ml/platform/darwin-aarch64/controller.app: com.apple.macl:

```

elasticsearch started this time without any error / popup around jdk.app, maybe because I already allowed jdk.app for this release, before I updated to 9.0.0.