Unpacking Apple Archives

This thread has been locked. Questions are automatically locked after two months of inactivity, or sooner if deemed necessary by a moderator.
I support Mac code signing and notarisation for DTS and, as part of that work, I often need to look inside various Apple-specific archive file formats. This post explains how I do this. It’s mostly for the benefit of Future Quinn™, but I figured other folks would appreciate it as well.

IMPORTANT This post explains low-level techniques for inspecting archives. Do not use them to create archives. Instead, create your archives using the highest-level tool that will get the job done (1).

Flat Installer Package

A flat installer package — appropriate for uploading to the Mac App Store or the notary service — is actually a xar archive. Unpack it using the xar tool. For example:

Code Block
% # List the contents:
% xar -tf InstallTest-1.0d1.pkg
% # Actually unpack:
% mkdir tmp
% cd tmp
% xar -xf ../InstallTest-1.0d1.pkg
% find .

See the xar man page for more info on that tool.

The resulting Bom file is a ‘bill of materials’. For more on this, see the bom man page for details. Use lsbom to dump this:

Code Block
% lsbom ./com.example.apple-samplecode.InstallTest.pkg/Bom
. 0 0/0
./InstallTest.app …
./InstallTest.app/Contents …
./InstallTest.app/Contents/Info.plist …
./InstallTest.app/Contents/MacOS …
./InstallTest.app/Contents/MacOS/InstallTest …

The Payload file contains… you guessed it… the installer’s payload. This is a gzipped cpio archive. To unpack it, pipe the file through cpio:

Code Block
% cpio -i < com.example.apple-samplecode.InstallTest.pkg/Payload
5072 blocks
% find InstallTest.app

See the cpio man page for more info on that tool.

Xip Archives

To extract a xip archive (pronounced, I believe, as chip archive), run the xip tool with the --expand argument:

Code Block
% xip --expand XipTest.xip

However, if that doesn’t work you’ll need to dig into the archive. First, undo the outer xar wrapper:

Code Block
% xar -xf XipTest.xip

This produces two files, Content and Metadata:

Code Block
% ls -l
total 7552
-rw-r--r-- 1 quinn staff 1683391 10 Jun 17:05 Content
-rw-r--r-- 1 quinn staff 287 10 Jun 17:08 Metadata
-rw-r--r-- 1 quinn staff 1697157 10 Jun 17:05 XipTest.xip

The Metadata file is an XML property list:

Code Block
% cat Metadata

The Content file is a yaa archive. Unpack this using the yaa tool:

Code Block
% yaa extract -ignore-eperm -i Content -d tmp
% find tmp

See the yaa man page for more info on that tool.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

(1) For installer package specifically, productbuild is your friend, but you can also use the lower-level tools like productsign, pkgbuild, and pkgutil.
Up vote post of eskimo