Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Some applications come in .pkg files, and ask for you administrator password, even if all they do is copy the binary to /Applications.

I like to have my applications in ~/Applications, and I do not like to give administrative permissions to anything that is not from the mothership.

Is there a way that I can manually open the .pkg file and pull out the application? There is PackageMaker in the Developer Tools, but that does not seem to do it (it did produce some output that makes me think that there really are no scripts or other pieces in the installer, just the application).

share|improve this question
    
Try unpkg. –  lhf Jul 12 '12 at 11:51

6 Answers 6

The Unarchiver can do this; it will do the same as pkgutil --expand but using drag-and-drop. It's a better replacement for Apple's Archive Utility.app anyways.

share|improve this answer

If you right click it, and click Show Package Contents you'll get a few files in a Contents folder. (Note: if you do not see Show Package Contents you will need to open Terminal.app and run pkgutil --expand mystubbornpackage.pkg path/to/expand)

One is a BOM file (bill of materials) which gets turned into a receipt that you can use to uninstall the app. This file contains a manifest of everything the package will install and where to; to read this file, use the lsbom command.

Most packages (I'm using Office 2008 here) also have an Archive.pax.gz file, this contains everything that Installer will move into the various folders as instructed in the BOM file. Most apps seem to have the .app in this archive, although dragging that to /Applications might leave it without frameworks it needs to run; so you'll have to figure out which other files it needs and where it needs them to get it to work.

Additionally, all packages can log messages, if you hit Cmd-L (or choose the Installer Log option from the Window menu, you can view them as they're generated. This might give you an idea what extra things it's installing, at the very least it's some more information if you're untrusting of the package.

share|improve this answer
1  
I don't get "Show Package Contents" in the right-click menu. –  Thilo Jun 9 '11 at 23:29
1  
@Thilo If you aren't getting the option to "Show Package Contents" then the pkg file was created as flat file. Apple introduced flat-style pkg's a couple years ago –  username Jun 16 '11 at 1:14
    
@username: So how do I open those? –  Thilo Jun 16 '11 at 1:19
7  
pkgutil will do that. You can expand it using pkgutil --expand file.pkg path_to_expand and it'll convert it into a directory style package. –  Mathew Hall Jun 16 '11 at 10:30

Thilo, After you succeed in opening the package, look for the Archive.pax.gz file that was mentioned earlier. Create a new empty folder on your desktop naming it whatever you wish. I usually name them "xxxx" or "zzzz" etc. to make typing easier later. Option-drag a copy of the Archive.pax.gz file into that new folder "xxxx" on your desktop. If the file is inside of read-only media you can just drag it to your "xxxx" folder without the Option key to create a copy. Now open Terminal.app and at the command line navigate to your new "xxxx" directory, "cd ~/Desktop/xxxx 'enter'" Now type "ls -l" or "ls -al" and list the directory's contents to confirm that your Archive.pax.gz file is there. Now there are two simple commands to enter. 1) "gunzip -v Archive.pax.gz" (Gzip will tell you that it has replaced "Archive.pax.gz" with "Archive.pax") Now list the directory's contents again to confirm this. The second command is 2) "pax -r -f Archive.pax" (You must separate -r and -f, as "-rf" will not work) Finally, list the directory's contents again with "ls -l" or "ls -al". In addition to your Archive.pax file you will now see a directory hierarchy probably containing one or more directories. The files in that directory hierarchy will illustrate to you where the Mac OS X installer would install files on your system as if your "xxxx" directory was the root directory "/". You may then manually copy those files to their destinations if you wish.

I hope this helps you. :-)

share|improve this answer
3  
In other words cd ~/Desktop; cp Package.pkg/Contents/Archive.pax.gz .; gunzip -v Archive.pax.gz; pax -r -f Archive.pax. You don't need to describe everything at that level of detail. –  ؘؘؘؘ Aug 14 '11 at 0:30
    
Lri, I gave that amount of detail so users at any level of expertise would be able to follow it and be successful. Granted, your cryptic version would achieve the same results. However, other users reading this in the future who may not be familiar with the command line might be hopelessly lost. –  stargood Aug 15 '11 at 4:56

In addition to what Matthew Hall said, you can also hit Cmd-I in the Installer app to see what files the installer will install and where.

share|improve this answer
1  
+1. With this I could quickly verify that there is just the application binary in there, no other system-wide stuff. –  Thilo Jun 9 '11 at 23:35

Alternatively you can try,

sudo installer -pkg ~/Downloads/packagename.pkg -target ~/Applications/

OR

installer -pkg ~/Downloads/packagename.pkg -target ~/Applications/
share|improve this answer
    
That did not work unfortunately. It still insisted to "Installing at base path /" and then asked for the admin password. –  Thilo Jun 9 '11 at 23:34

If you don't trust the installer enough to give administrative permissions to install, then why do you trust the binary in /Applications?

Pacifist will let you look in package files. This doesn't necessarily just let you "pull out the binary".

share|improve this answer
    
I do not trust the binary, either. I want to never ever give it administrative permissions (which it should not need anyway). –  Thilo Jun 9 '11 at 23:30
1  
As long as you don't run the app from any user that has admin privileges, your trust will be upheld. Don't forget that even a user level app can make requests from admin level processes so it's a lot of work to run apps you don't actually trust. –  bmike Jun 18 '11 at 1:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.