The usual macOS thing. The download is fine — the app is not signed yet, and Gatekeeper phrases "I do not recognise who made this" as "damaged", which is a genuinely terrible message for the situation.
The safest way past it is the one macOS offers itself: find SDODS in Applications, right-click, choose Open, and confirm in the dialog. macOS remembers the decision, so you only do it once and every later launch is a normal double-click.
It works, and I mention it second on purpose: it is worse advice to hand a stranger, because it is a command you can be talked into running against something that really is malicious. Right-click and Open is the same decision with a dialog attached.
The CLI is unaffected by any of this — nothing installed by the script is quarantined.
To answer the implied question: signing is not free and not automatic. It needs an Apple Developer Program membership, a Developer ID Application certificate and a notarization step per build. Until that exists every download says this.
If you want to verify the download rather than trust the dialog, every release ships a SHA256SUMS.txt and you can check the file you got against it.
Do not skip the right-click. I tried Open from the Finder menu bar with the app already selected and got the same refusal; the context-menu Open is the one carrying the override.
For a managed fleet, none of the above scales — ask whoever runs your MDM to allow the app rather than telling twenty people to right-click. That is also the honest answer to give a security team, who will not love a xattr instruction in a runbook.