Does a Installer Package guarantee that all files are tracked?

Question

I know about <command> <l>, pkgutil --files, and lsbom. I know also that installer packages are really a XAR archive.

What I do not know yet, is that whether running a .pkg installer packages guarantees that all the files produced as a result of running it will be tracked?

For instance, when a .pkg installer package ran some arbitrary scripts, will the files be tracked by macOS? I tried searching and there does not seems to be any official documentation on this.

Some unofficial guides:

https://matthew-brett.github.io/docosx/flat_packages.html

http://s.sudre.free.fr/Stuff/Ivanhoe/FLAT.html

Although not explicitly mentioned, these guides seems to be indicating that the files won't be tracked, is this correct?

Also, are there any official answer on this?

Answer 1

The issue is what do you mean by track.

At the file system level macOS does track any file changes however this is not saved for all time. Files directly installed by the installer will have metadata set on them saying which package installed them in. You can also use pkgutil to see what files the package says it will install. As in the other answer you can run installer ti install the package and it will log these chnages.

However if the installer runs a script or executable that creates files then the last few methods will not pick this up.

There is an API that can see all the file changes https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/FSEvents_ProgGuide/UsingtheFSEventsFramework/UsingtheFSEventsFramework.html. (yes it is in archive but Apple's new documantation does not have overviews and I think is still up to date). Thus you can write an application to see what files the installer changes.

I have not used this API or used any tool to view the events.

But I think you always need to register watching before you run the installer. There do exist many language libraries with example simple apps e.g. python and also full applications that use this API and provide a user GUI to see the changes.

This webpage suggest you can see then using Finder. I think Instruments.app in Xcode can also do this

The stand alone application examples I found or was pointed to are paid applications are https://fsmonitor.com/ and https://rixstep.com/4/0/tracker/

Answer 2

There is no official answer, because it is not a feature offered by macOS's Installer. Most packages are digitally signed; if problems are found, the signing organisation can be contacted and held responsible.

Installer

Files created or modified by scripts within a package are not tracked. macOS's installer does not record or monitor the true impact of the package on the destination.

You may be looking for a File Alteration Monitor.

FSEvents and kqueue

For macOS computer wide file system change notifications, see FSEvents.

macOS's built-in fs_usage reports system calls and page faults related to filesystem activity in real-time:

 sudo fs_usage -f filesys

See 10.4: Monitor file system events in real time:

OS X 10.4 has a private API that's used by Spotlight to monitor file system events such as file creation, renaming, and permission changes. Several command line and GUI tools are now available that can suscribe to the event notification system and provide a log of the events. These are useful for, e.g., monitoring files created by installers, and so forth.

FSEvents on macOS are implemented using BSD's kqueue:

Kqueue not only handles file descriptor events but is also used for various other notifications such as file modification monitoring, signals, asynchronous I/O events (AIO), child process state change monitoring, and timers which support nanosecond resolution, furthermore kqueue provides a way to use user-defined events in addition to the ones provided by the kernel.