How to extract contents from 'Payload' file in a apple macOS update package?

Question

I am extracting macOS sierra update package - macOSUpd10.12.1.pkg using following command to /tmp/macosupd directory.

pkgutil --expand /Volumes/macOS\ Sierra\ Update/macOSUpd10.12.1.pkg /tmp/macosupd

I can see following packages are bundled inside the metapackage.

-rwxr-xr-x   1  Distribution
drwxr-xr-x   6  FirmwareUpdate.pkg
drwxr-xr-x   5  FullBundleUpdate.pkg
drwxr-xr-x  36  Resources
drwxr-xr-x   6  macOSUpd10.12.1.pkg

I am not able to extract contents of Payload file. For example when i try to extract the Payload of macOSUpd10.12.1.pkg, i get following error message:

with tar:

tar -xvf macOSUpd10.12.1.pkg/Payload 
tar: Unrecognized archive format
tar: Error exit delayed from previous errors.

with xar:

xar -xvf macOSUpd10.12.1.pkg/Payload 
Error opening xar archive: macOSUpd10.12.1.pkg/Payload

When I run file command on the payload file, i get a message as:

file macOSUpd10.12.1.pkg/Payload 
macOSUpd10.12.1.pkg/Payload: data

By seeing initial bits of Payload file using xxd command , i can see file type looks like pbzx

xxd macOSUpd10.12.1.pkg/Payload 


00000000: 7062 7a78 0000 0000 0100 0000 0000 0000  pbzx............
00000010: 0100 0000 0000 0000 0031 0330 fd37 7a58  .........1.0.7zX
00000020: 5a00 0000 ff12 d941 04c0 f385 c401 8080  Z......A........
00000030: 8008 2101 1600 0000 506a 84e2 e3b8 13ef  ..!.....Pj......
00000040: fe5d 0018 0ddf 07a4 347c 7c50 9853 8031  .]......4||P.S.1
00000050: 2d14 f703 6903 cf69 f214 76b0 93c0 a4c9  -...i..i..v.....
00000060: 774d 6fb0 8b3a 2257 4a55 04ad 289b cc4d  wMo..:"WJU..(..M
00000070: b835 5db7 7e72 f7a8 dc15 7a9c 7755 800c  .5].~r....z.wU..
00000080: 6060 d45f e078 f84f e537 4319 2d89 f72e  ``._.x.O.7C.-...
00000090: 60c4 cdb0 6b54 9326 9321 3339 4a4f 1e75  `...kT.&.!39JO.u
000000a0: 8eb7 991d 8968 5e6f 45d4 24c9 e364 712b  .....h^oE.$..dq+
000000b0: ef4e 9abc af70 e97a e5a3 1810 7f05 54df  .N...p.z......T.
000000c0: 08d2 3060 9f8a a1e0 edb8 2b10 df23 789d  ..0`......+..#x.
000000d0: 3e52 ee3e d6f0 468a bfee 3366 d39e 28db  >R.>..F...3f..(.

Please suggest a way on how to extract the contents of Payload file. I have tried all he methods suggested in link1 and link2, including the method suggested in this external-link still no success. Seems like apple updates prior to Mavericks were pure xar and tar packages. With Mavericks and above apple changed the file format from a tar to pbzx(lzma).

please suggest an easy command line way to extract contents of the Payload file as i have to make use in my automation setup.

Geoff Nixon · Answer 1 · 2018-10-27T01:44:37.343

63

There is an undocumented option to pkgutil, --expand-full, which uses the same syntax as pkgutil --expand.

pkgutil --expand-full [pkg] [dir]

This will completely "unarchive" a pkg or mpkg file.

edited Oct 27 '18 at 01:44

answered Jun 13 '18 at 11:21

Geoff Nixon

3,540
2
23
34

Very useful! Thank you. – mayankk2308 Jun 27 '18 at 15:08
1

that option has gone in 10.13 – georgexsh Sep 27 '18 at 11:30
Determine type of the archive and use the appropriate unarchiver instead. – Kentzo Oct 19 '18 at 19:25
2

@georgexsh No, it hasn't — I just didn't correctly have the syntax marked that a second argument (where to extract) was needed. Fixed. – Geoff Nixon Oct 27 '18 at 01:45
5

Worked like a charm in osX 10.14 Mojave. Make sure the destination [dir] does not exist. pkgutil will create that. – BhaveshDiwan Jun 02 '19 at 16:47
This worked for me to extract macOS 10.12 installer contents. – Joshua Olson Jun 02 '20 at 17:56
macOS Catalina 10.15.5, successfully extracted JDK7 package. Thanks! – Adrian J. Moreno Jun 06 '20 at 04:40

score 14 · Answer 2 · answered Jan 11 '17 at 18:34

14

Since OSX 10.10, the Payload in the .pkg files is encoded as pbzx (which is in turn lzma compressed). It can no longer be extracted using gunzip. Check out the pbzx tool (a fork of the original which would not allow you to extract the Payload directly but only by passing the .pkg file directly).

Instead of

tar -xvf macOSUpd10.12.1.pkg/Payload

you can write

pbzx -n macOSUpd10.12.1.pkg/Payload | cpio -i

answered Jan 11 '17 at 18:34

Niklas R

14,369
23
82
179

Thanks for the answer, it helped. – ap1982 May 24 '17 at 13:03
The "macOSUpd10.12.1.pkg" represents the name of the folder where the pkg was extracted into, right? It was a bit confusing to me at first glance, I thought pbzx was able to "look into" the pkg file and only extract the "Payload". – jakob.j Apr 22 '19 at 20:02

How to extract contents from 'Payload' file in a apple macOS update package?

2 Answers2

Linked