Title: How to extract contents from 'Payload' file in a apple macOS update package?
Tags: macos;macos-pkgutil
Question: I am extracting macOS sierra update package - macOSUpd10.12.1.pkg using following command to /tmp/macosupd directory.
pkgutil --expand /Volumes/macOS\ Sierra\ Update/macOSUpd10.12.1.pkg /tmp/macosupd
I can see following packages are bundled inside the metapackage.
-rwxr-xr-x   1  Distribution
drwxr-xr-x   6  FirmwareUpdate.pkg
drwxr-xr-x   5  FullBundleUpdate.pkg
drwxr-xr-x  36  Resources
drwxr-xr-x   6  macOSUpd10.12.1.pkg
I am not able to extract contents of Payload file. For example when i try to extract the Payload of macOSUpd10.12.1.pkg, i get following error message:
with tar:
tar -xvf macOSUpd10.12.1.pkg/Payload
tar: Unrecognized archive format
tar: Error exit delayed from previous errors.
with xar:
xar -xvf macOSUpd10.12.1.pkg/Payload
Error opening xar archive: macOSUpd10.12.1.pkg/Payload
When I run file command on the payload file, i get a message as:
file macOSUpd10.12.1.pkg/Payload
macOSUpd10.12.1.pkg/Payload: data
By seeing initial bits of Payload file using xxd command , i can see file type looks like pbzx
xxd macOSUpd10.12.1.pkg/Payload
00000000: 7062 7a78 0000 0000 0100 0000 0000 0000  pbzx............
00000010: 0100 0000 0000 0000 0031 0330 fd37 7a58  .........1.0.7zX
00000020: 5a00 0000 ff12 d941 04c0 f385 c401 8080  Z......A........
00000030: 8008 2101 1600 0000 506a 84e2 e3b8 13ef  ..!.....Pj......
00000040: fe5d 0018 0ddf 07a4 347c 7c50 9853 8031  .]......4||P.S.1
00000050: 2d14 f703 6903 cf69 f214 76b0 93c0 a4c9  -...i..i..v.....
00000060: 774d 6fb0 8b3a 2257 4a55 04ad 289b cc4d  wMo..:"WJU..(..M
00000070: b835 5db7 7e72 f7a8 dc15 7a9c 7755 800c  .5].~r....z.wU..
00000080: 6060 d45f e078 f84f e537 4319 2d89 f72e  ``._.x.O.7C.-...
00000090: 60c4 cdb0 6b54 9326 9321 3339 4a4f 1e75  `...kT.&amp;.!39JO.u
000000a0: 8eb7 991d 8968 5e6f 45d4 24c9 e364 712b  .....h^oE.$..dq+
000000b0: ef4e 9abc af70 e97a e5a3 1810 7f05 54df  .N...p.z......T.
000000c0: 08d2 3060 9f8a a1e0 edb8 2b10 df23 789d  ..0`......+..#x.
000000d0: 3e52 ee3e d6f0 468a bfee 3366 d39e 28db  &gt;R.&gt;..F...3f..(.
Please suggest a way on how to extract the contents of Payload file. I have tried all he methods suggested in link1 and link2, including the method suggested in this external-link  still no success. Seems like apple updates prior to Mavericks were pure xar and tar packages. With Mavericks and above apple changed the file format from a tar to pbzx(lzma).
please suggest an easy command line way to extract contents of the Payload file as i have to make use in my automation setup.


Here is another answer: There is an undocumented option to pkgutil, --expand-full, which uses the same syntax as pkgutil --expand.
pkgutil --expand-full [pkg] [dir]
This will completely "unarchive" a pkg or mpkg file.
Comment for this answer: Determine type of the archive and use the appropriate unarchiver instead.
Comment for this answer: Not sure about macOS 11+, but it worked on 10.15.17.
Comment for this answer: Very useful! Thank you.
Comment for this answer: macOS Catalina 10.15.5, successfully extracted JDK7 package. Thanks!
Comment for this answer: This worked for me to extract macOS 10.12 installer contents.
Comment for this answer: Worked like a charm in osX 10.14 Mojave.
Make sure the destination [dir] does not exist. pkgutil will create that.
Comment for this answer: @georgexsh No, it hasn't — I just didn't correctly have the syntax marked that a second argument (where to extract) was needed. Fixed.

Here is another answer: Since OSX 10.10, the Payload in the .pkg files is encoded as pbzx (which is in turn lzma compressed). It can no longer be extracted using gunzip. Check out the pbzx tool (a fork of the original which would not allow you to extract the Payload directly but only by passing the .pkg file directly).
Instead of
tar -xvf macOSUpd10.12.1.pkg/Payload
you can write
pbzx -n macOSUpd10.12.1.pkg/Payload | cpio -i
Comment for this answer: The "macOSUpd10.12.1.pkg" represents the name of the folder where the pkg was extracted into, right? It was a bit confusing to me at first glance, I thought pbzx was able to "look into" the pkg file and only extract the "Payload".
Comment for this answer: I've seen some PKGs (Avast antivirus, for example) that have CPIO format Payload file. Is CPIO considered to be lzma-compressed pbzx? I thought that CPIO utilizes no compression.
Comment for this answer: Thanks for the answer, it helped.

{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 2, 'CommentCount': 0, 'ContentLicense': 'CC BY-SA 3.0', 'CreationDate': '2016:00:12/15/16', 'FavoriteCount': 12.0, 'PostTypeId': 1, 'Tags': '<macos><macos-pkgutil>', 'Title': "How to extract contents from 'Payload' file in a apple macOS update package?", 'ViewCount': 26438, 'id': 41166805, 'user_AboutMe': None, 'user_AccountId': 9858707.0, 'user_DisplayName': 'ap1982', 'user_Reputation': 341.0, 'user_Views': 9.0, 'user_id': 7302427.0}}