Until last week, I believed that all the Apple software installed or updated on my Mac was recorded in the the list provided in Installations, in System Information, and in /Library/Receipts/InstallHistory.plist.

Then, I discovered an update which was not recorded there, for which there was clear evidence of installation in the files stored in /System/Library/Receipts. Keeping a watch on that folder and inspecting its .bom files using lsbom is tedious.

So how can you get a truly comprehensive list of all the Apple software which has been installed or updated?

The official way is to use the command tool pkgutil, in a line in Terminal such as
pkgutil -v --pkgs > listing.text
and sure enough that lists the mysterious update which is missing from /Library/Receipts/InstallHistory.plist. At least, I think it does, because you’ll have to do quite a bit of massaging with pkgutil to get anything more helpful than a long list of the names of all the installer packages.

If you enjoy developing your own shell scripts, lsbom and pkgutil between them should be able to tell you pretty well anything you might want to know.

For the rest of us, there’s a new version of SystHist, now into its first beta release. This should run correctly on High Sierra, Sierra, and on El Capitan, but I have once again been unable to test it there, and welcome reports, please.

SystHist now has a third view which is based not on the contents of /Library/Receipts/InstallHistory.plist, but on the files tucked away in /System/Library/Receipts. It now detects the silent silent update which Apple pushed at my Mac on 4 January this year, and tells me exactly what it updated too.

The central view here works just the same as in previous versions: it lists all the recognised macOS and security updates which have been installed, with the most recent at the top. For day-to-day checking, just look at the date on the top line, and see if it is very recent.

The view on the left provides a more structured view of the updates which have been installed between macOS updates. This is valuable when you want to browse that Mac’s full installation and update history. Because this type of folding view is designed to put the most recent event at its foot, and doesn’t really work upside-down, this view doesn’t change direction.

Those two views are derived from the entries in /Library/Receipts/InstallHistory.plist. That on the right, though, comes from an examination of the installation records in /System/Library/Receipts. Those include all Apple software and updates, and their names and details don’t make it so easy to distinguish system and security packages. The installation times shown there are often slightly different from those in the other two views, so there isn’t a robust way to match them against one another.

All those listed in the right view should also have matching ‘Bill of Materials’ (BoM) files. Click on any row in the table, and SystHist opens the BoM and lists all the files which were installed in that installation, together with their size and date of creation. These appear in a scrolling popover, from which you can copy information as you wish.

The end result provides the most complete overview and details of all Apple software installations and updates.

This new version of SystHist is available here: systhist10b1
and in Downloads above.

I hope that you find it useful. It is certainly a very simple way of detecting whether your Mac (running Sierra) had this mystery update on or about 4 January 2018. It also helps unravel what has been going on with High Sierra’s multiple updates – a sorry story which I will look at another time, now that I have the right tool.