macOS Sequoia 15.3.1 reporting Joplin-3.2.13-arm64.DMG "could harm your device" after download

Support
1

Operating system

macOS

Joplin version

3.2.13

Desktop version info

Joplin 3.1.24 (prod, darwin)

What issue do you have?

I am currently running "Joplin 3.1.24 (prod, darwin)" on an M4 Mac Mini running the latest macOS version Sequoia 15.3.1. Using Joplin's "Check for updates" shows "Your version: 3.1.24", "New version: 3.2.13" as well as the change log as normal. However, once downloaded, macOS pops up a warning dialog: "Joplin-3.2.13-arm64.DMG could harm your device. Do you want to keep it anyway? [Keep] [Delete]"

Screenshots

macOSwarning.png
macOSwarning.png684×152 7.06 KB

2

For comparison, I was able to install the x86_64 version of Joplin on MacOS Sequoia without encountering a similar warning (I don't have access to an ARM Mac to try installing the -arm64.DMG file).

Here are some things to try:

Thank you for reporting this!

3

I just tried to download Joplin-3.2.13-arm64.DMG directly from the Joplin homepage and get the same warning from my M4 Mac Mini running a fully updated Sequoia.

4

Here is something interesting. Downloading from the updater from within Joplin, or the Download button on Joplin's home page, or the GitHub page, all resut in the macOS Sequoia warning dialog: "Joplin-3.2.13-arm64.DMG could harm your device. Do you want to keep it anyway? [Keep] [Delete]". Note that any version that I download directly from GitHub also gives the warning.

However, I just discovered that if I am on the Joplin website's /download/ page, I can use the link in the message "If your download didn't start, click here", and then click the button "Get it on macOS M1", and the file downloads successfully without any warning.

I then checked the hashes of both files (the one that macOS warns on and the one it doesn't) and they are identical. I then also checked the DMG in VirusTotal and it's clean. So, I have no idea what's going on but I'm going to install from the unwarned file.