9 
$ which xar
/usr/bin/xar

It's in /usr/bin. Does that mean it's preinstalled on mac?

Improve this question
4
  • 1
    Related (duplicate?) Command line tools available by default
    – Martin R
    Mar 19, 2019 at 12:56
  • @MartinR Good find. The answers there might need a refresh for Mojave though
    – nohillside ♦
    Mar 19, 2019 at 13:10
  • I voted to reopen this because the best answer ( @Martin R ) is different than the other question.
    – fd0
    Mar 19, 2019 at 13:49
  • 1
    @fd0 There is nothing in the question which indicates that the answers on the main questions don't apply, so I doubt there is a reason to reopen.
    – nohillside ♦
    Mar 19, 2019 at 13:57

3 Answers 3

Reset to default
15

Unless you've disabled SIP and installed your own binaries in /usr/bin it's safe to assume that everything in /usr/bin (and /bin, /sbin, /usr/sbin) is pre-installed.

Improve this answer
1
  • 1
    That doesn't necessarily mean that the binaries are preinstalled with macOS. As an example, I have a file /usr/bin/swift which (I assume) was installed with Xcode.
    – Martin R
    Mar 19, 2019 at 13:34
11

One indication you might look for is found at https://opensource.apple.com/release/macos-10141.html where you see that xar-404 is indeed used by Apple.

To get a closer look at what is installed, you might use onboard tools check for some parameters:

$  codesign -vd --verbose=4 /usr/bin/xar

Executable=/usr/bin/xar
Identifier=com.apple.xar
Format=Mach-O thin (x86_64)
CodeDirectory v=20100 size=350 flags=0x0(none) hashes=7+2 location=embedded
Platform identifier=2
OSPlatform=36
OSSDKVersion=658432
OSVersionMin=658432
Hash type=sha256 size=32
CandidateCDHash sha256=6dd0100231ae53fb666827d9212b487d17fa6163
Hash choices=sha256
Page size=4096
CDHash=6dd0100231ae53fb666827d9212b487d17fa6163
Signature size=4105
Authority=Software Signing
Authority=Apple Code Signing Certification Authority
Authority=Apple Root CA
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements count=1 size=64

As Apple doesn't offer tools like that in seperate installers or packages, the conclusion from the output above would be that it came pre-installed.

Alternatively, get the full installer ("Install macOS Mojave.app"), show package contents, navigate Contents/SharedSupport/InstallESD.dmg and mount that, then navigate to /Volumes/InstallESD/Packages/Core.pkg and open that in eg Pacifist. There as well you can navigate to /usr/bin/xar .

Improve this answer
8

You can use pkgutil to determine by which installer a file was installed:

$ pkgutil -v --file-info /usr/bin/xar
     volume: /
       path: /usr/bin/xar

       pkgid: com.apple.pkg.update.os.10.14.2.18C54
 pkg-version: 1.0.0.0.1.1543558197
install-time: Thu Dec  6 11:31:26 2018
         uid: 0 (root)
         gid: 0 (wheel)
        mode: 755 (?rwxr-xr-x )

       pkgid: com.apple.pkg.update.os.10.14.1.18B75
 pkg-version: 1.0.0.0.1.1540375237
install-time: Wed Nov  7 10:05:39 2018
         uid: 0 (root)
         gid: 0 (wheel)
        mode: 755 (?rwxr-xr-x )

       pkgid: com.apple.pkg.Core
 pkg-version: 10.14.0.1.1.1537503053
install-time: Tue Sep 25 10:43:44 2018
         uid: 0 (root)
         gid: 0 (wheel)
        mode: 755 (?rwxr-xr-x )

shows that xar was installed with an Apple “Core” package (and updated twice).

Improve this answer

Not the answer you're looking for? Browse other questions tagged .