PowerShell on macOS: installation without security warnings

PowerShell 7 runs on macOS for automation, remote administration, scripting, and DevOps. Older packages could be blocked by Gatekeeper. Microsoft now states that macOS PKGs released from May 2026 onward are signed and notarized. A current package from the official source does not require weakening macOS security.

Why warnings appeared

Gatekeeper checks developer identity, integrity, and Apple notarization. Outdated guides may suggest xattr, -allowUntrusted, or disabling Gatekeeper. Those bypasses are inappropriate for a new installation; use a recent notarized PKG.

Choose the correct package

Run uname -m: arm64 means Apple Silicon and x86_64 means Intel. From Microsoft Learn, follow the official Releases link, select a supported stable version, and download osx-arm64.pkg or osx-x64.pkg. Open it in Finder and complete the standard installer.

The normal first-open confirmation for an Internet download may still appear. It is expected and is not an unidentified-developer error.

Start and verify

uname -m
pwsh
$PSVersionTable
pkgutil --check-signature ~/Downloads/powershell-*.pkg
spctl -a -vv -t install ~/Downloads/powershell-*.pkg

pwsh starts PowerShell and $PSVersionTable reports version and platform. The final commands inspect the package signature and Gatekeeper assessment.

Homebrew alternative

Microsoft also documents the community-maintained Homebrew formula:

brew install powershell
brew update
brew upgrade powershell

Remove an old cask first with brew uninstall --cask powershell, and avoid mixing installation methods.

What to avoid

• Do not disable Gatekeeper globally.
• Do not use -allowUntrusted with a modern package.
• Do not strip quarantine from unverified downloads.
• Do not use third-party mirrors.
• Prefer a supported stable release on production Macs.

Updates and removal

For PKG installations, install a newer supported package from the official source. With Homebrew use brew upgrade powershell. Preserve any personal PowerShell profiles before removal.

Conclusion

A recent, architecture-correct, notarized Microsoft package is the cleanest approach. It keeps Gatekeeper active and avoids legacy workarounds.