How to extract contents from 'Payload' file in a apple macOS update package?

ap1982 picture ap1982 · Dec 15, 2016 · Viewed 19k times · Source

I am extracting macOS sierra update package - macOSUpd10.12.1.pkg using following command to /tmp/macosupd directory.

pkgutil --expand /Volumes/macOS\ Sierra\ Update/macOSUpd10.12.1.pkg /tmp/macosupd 

I can see following packages are bundled inside the metapackage.

-rwxr-xr-x   1  Distribution
drwxr-xr-x   6  FirmwareUpdate.pkg
drwxr-xr-x   5  FullBundleUpdate.pkg
drwxr-xr-x  36  Resources
drwxr-xr-x   6  macOSUpd10.12.1.pkg

I am not able to extract contents of Payload file. For example when i try to extract the Payload of macOSUpd10.12.1.pkg, i get following error message:

with tar:

tar -xvf macOSUpd10.12.1.pkg/Payload 
tar: Unrecognized archive format
tar: Error exit delayed from previous errors.

with xar:

xar -xvf macOSUpd10.12.1.pkg/Payload 
Error opening xar archive: macOSUpd10.12.1.pkg/Payload

When I run file command on the payload file, i get a message as:

file macOSUpd10.12.1.pkg/Payload 
macOSUpd10.12.1.pkg/Payload: data

By seeing initial bits of Payload file using xxd command , i can see file type looks like pbzx

xxd macOSUpd10.12.1.pkg/Payload 


00000000: 7062 7a78 0000 0000 0100 0000 0000 0000  pbzx............
00000010: 0100 0000 0000 0000 0031 0330 fd37 7a58  .........1.0.7zX
00000020: 5a00 0000 ff12 d941 04c0 f385 c401 8080  Z......A........
00000030: 8008 2101 1600 0000 506a 84e2 e3b8 13ef  ..!.....Pj......
00000040: fe5d 0018 0ddf 07a4 347c 7c50 9853 8031  .]......4||P.S.1
00000050: 2d14 f703 6903 cf69 f214 76b0 93c0 a4c9  -...i..i..v.....
00000060: 774d 6fb0 8b3a 2257 4a55 04ad 289b cc4d  wMo..:"WJU..(..M
00000070: b835 5db7 7e72 f7a8 dc15 7a9c 7755 800c  .5].~r....z.wU..
00000080: 6060 d45f e078 f84f e537 4319 2d89 f72e  ``._.x.O.7C.-...
00000090: 60c4 cdb0 6b54 9326 9321 3339 4a4f 1e75  `...kT.&.!39JO.u
000000a0: 8eb7 991d 8968 5e6f 45d4 24c9 e364 712b  .....h^oE.$..dq+
000000b0: ef4e 9abc af70 e97a e5a3 1810 7f05 54df  .N...p.z......T.
000000c0: 08d2 3060 9f8a a1e0 edb8 2b10 df23 789d  ..0`......+..#x.
000000d0: 3e52 ee3e d6f0 468a bfee 3366 d39e 28db  >R.>..F...3f..(.

Please suggest a way on how to extract the contents of Payload file. I have tried all he methods suggested in link1 and link2, including the method suggested in this external-link still no success. Seems like apple updates prior to Mavericks were pure xar and tar packages. With Mavericks and above apple changed the file format from a tar to pbzx(lzma).

please suggest an easy command line way to extract contents of the Payload file as i have to make use in my automation setup.

Answer

Geoff Nixon picture Geoff Nixon · Jun 13, 2018

There is an undocumented option to pkgutil, --expand-full, which uses the same syntax as pkgutil --expand.

pkgutil --expand-full [pkg] [dir]

This will completely "unarchive" a pkg or mpkg file.