10.7.

2015

Funwithpkgutil|SomeThingsAreObvious

Some Things Are Obvious

MAC OS X

FUN WITH PKGUTIL

2013/04/17 | BRIAN FITZGERALD | LEAVE A COMMENT

With Mac OS X, Apple started out in the GUI world, but over time has transitioned to a more
traditional Unix world with command-line tools, but without forcing this on most users. For
example, you can perform and access install information via the command-line as well as
through the GUI programs Apple supplies.
The standard on Mac OS X is the package, and this is for atomic entities, such as applications,
libraries and frameworks. Installers add packages to the system; users run them (a .app is a
folder that is a package that masquerades as a file).
The pkgutil command-line program gives you access to information about installed packages.
manpkgutil tells us a little bit:

pkgutil(1)

BSDGeneralCommandsManual

pkgutil(1)
NAME
pkgutilQueryandmanipulateMacOSXInstallerpackagesand
receipts.
SYNOPSIS
pkgutil[options][commands]
DESCRIPTION
pkgutilreadsandmanipulatesMacOSXInstallerflatpackages,and
pro
videsaccesstothe``receipt''databaseusedbytheInstaller.Options
areprocessedfirst,andaffecttheoperationofallcommands.Multiple
commandsareperformedsequentiallyinthegivenorder.
...
http://blog.bfitz.us/?p=1158

1/5

10.7.2015

Funwithpkgutil|SomeThingsAreObvious

First off, you can just get a list of all the packages installed to a specific volume. For the most
part, packages are installed to the root volume /, and if you dont pass in a volumes option,
pkgutil will default to /.

brianmacpro:~bfitz$pkgutilpackages
com.apple.MacOSX.lang.ar
com.apple.MacOSX.lang.cs
...
com.apple.MacOSX.lang.zh_CN
com.apple.MacOSX.lang.zh_TW
...
com.apple.pkg.BSD
com.apple.pkg.clangLeo
com.apple.pkg.CoreAudioSDKLeo
com.apple.pkg.CoreFP
com.apple.pkg.CoreFP1
com.apple.pkg.DeveloperToolsCLILeo
com.apple.pkg.DeveloperToolsSystemSupportLeo
...
com.apple.pkg.XcodeEssentialsSystemSupportLeo
com.apple.pkg.XcodeUserSystemSupportLeo
com.apple.pkg.xcrunLeo
GitOSX.Installer.git182.etc.pkg
GitOSX.Installer.git182.git.pkg
brianmacpro:~bfitz$pkgutilpackages|wc
87872549

My Mac currently has 87 packages installed on it (I dont install a lot of things, sorry).
You can list packages that match a pattern for example, to find all packages with the string
Xcode:

brianmacpro:~bfitz$pkgutilpkgs=.\+Xcode.\+
com.apple.pkg.InstallXcodeLion
com.apple.pkg.XcodeEssentialsSystemSupportLeo
com.apple.pkg.XcodeUserSystemSupportLeo

http://blog.bfitz.us/?p=1158

2/5

10.7.2015

Funwithpkgutil|SomeThingsAreObvious

The trick with the regular expression is that it must cover the entire name, theres an implied
start and end anchor applied to the regex, and you need to escape characters that the shell
might interpret (like <, +, \ and so on). For example, if your regex needs a backslash, then you
need a backslash for that backslash.
One of the most useful commands is I have a file on my hard disk, what installed it. For
example, something installed git to /usr/bin/git what was it?

brianmacpro:~bfitz$pkgutilfileinfo/usr/bin/git
volume:/
path:/usr/bin/git
pkgid:com.apple.pkg.DeveloperToolsCLILeo
pkgversion:1.0.0.9000000000.1.1249367152
installtime:1316396966
uid:0
gid:0
mode:755
brianmacpro:~bfitz$

Evidently, when I said install command-line versions of tools in Xcode, it installed git to the
global system folder. So, what else did it install? The files option lists all the files installed by a
package, and only-files makes it list just the files, not the directories that were created to
hold those files.

brianmacpro:~bfitz$pkgutilonlyfilesfiles
com.apple.pkg.DeveloperToolsCLILeo
Library/Developer/4.0/distcc/distcclaunchdconfig
usr/bin/BuildStrings
usr/bin/CpMac
usr/bin/DeRez
usr/bin/GetFileInfo
...
usr/etc/distcc/hosts
usr/lib/libgmalloc.B.dylib
usr/lib/libltdl.a
usr/libexec/gcc/darwin/i386/as
usr/libexec/gcc/darwin/x86_64/as
usr/libexec/gdb/gdbi386appledarwin
http://blog.bfitz.us/?p=1158

3/5

10.7.2015

Funwithpkgutil|SomeThingsAreObvious

usr/libexec/gitcore/git
..
usr/share/aclocal/argz.m4
usr/share/aclocal/bisoni18n.m4
usr/share/aclocal/libtool.m4
...
brianmacpro:~bfitz$pkgutilonlyfilesfiles
com.apple.pkg.DeveloperToolsCLILeo|wc
18521856102002

It installed 1852 files, and the files are as expected, command line programs and man pages
and even a suite of test code.
You can get more information about a package with pkg-info.

brianmacpro:~bfitz$pkgutilpkginfocom.apple.pkg.DeveloperToolsCLILeo
packageid:com.apple.pkg.DeveloperToolsCLILeo
version:1.0.0.9000000000.1.1249367152
volume:/
location:/
installtime:1316396966
groups:com.apple.FindSystemFiles.pkggroupcom.apple.DevToolsBoth.pkggroup
com.apple.DevToolsNonRelocatableShared.pkggroup
brianmacpro:~bfitz$dater1316396966
SunSep1818:49:26PDT2011

The install-time flag is in Unix seconds (seconds since 1970), which I turned into a humanreadable date with the date command-line tool, so you can see that I installed this package
(which came from an install of Xcode) on September 18, 2011.
Here we see that com.apple.pkg.DeveloperToolsCLILeo is part of several groups, and we can
discover what other packages are in a group by using group-pkgs:

brianmacpro:~bfitz$pkgutilgrouppkgscom.apple.DevToolsBoth.pkggroup
com.apple.pkg.clangLeo
com.apple.pkg.DeveloperToolsCLILeo
com.apple.pkg.gcc4.2Leo
com.apple.pkg.llvmgcc4.2Leo
http://blog.bfitz.us/?p=1158

4/5

10.7.2015

Funwithpkgutil|SomeThingsAreObvious

com.apple.pkg.X11DocumentationLeo

Of course, at this point youre reverse-engineering what some developer has as their plan for
how to organize software, and youre not likely to find this documented anywhere.

http://blog.bfitz.us/?p=1158

5/5