Several users have noticed that the information about system update history shown in my free app SystHist, or that in the Installations section of System Information, doesn’t match the version of macOS which they’re currently running. As a result, I have produced a new version of SystHist which tries to be more helpful. This article explains the issue more fully.

macOS can install updates and upgrades through several different routes. In Mojave, updates to macOS itself are now normally delivered through the Software Update pane in System Preferences, which also controls the download and installation of pushed security and critical updates to macOS. Prior to Mojave, macOS updates are delivered through the App Store (although security and critical updates still use softwareupdate). They can also be downloaded from Apple in the form of Installer packages, and system administrators may have other options too.

Apps and other software are either delivered via the App Store, or through a mechanism provided outside, which includes Installer packages, built-in Sparkle updates, and manual installation from some form of archive or disk image.

Software update, pushed security and critical updates and Installer packages all write information about the updates which they install to two locations:

• the system install history at /Library/Receipts/InstallHistory.plist;
• the receipts folder at /System/Library/Receipts;

where they are used by System Information and SystHist to generate lists of recent installations and updates.

One interesting catch with those install histories and receipts is that they apply only when the copy of macOS on that same volume is running. So if you install macOS on your normal boot volume when your Mac started up from a different boot volume, including the Recovery partition, that installation won’t normally be recorded in the install history on the volume on which you installed that version of macOS.

Similarly, if you install or update macOS on another volume, such as an external drive, when your Mac is booted from its internal disk, that installation isn’t normally recorded in the install history on that external drive.

When you first start up a brand new or secondhand Mac, and it shows the Welcome screen for you to configure it, chances are that initial installation doesn’t appear in its install history either. For example, this iMac Pro came with macOS High Sierra pre-installed, but its first record of any version of macOS is when I installed Mojave 10.14.1 on it, a couple of days later.

Other factors come into play too.

Look at the file /Library/Receipts/InstallHistory.plist and you’ll see a Property List containing many dictionaries, each representing an update or other installation. Every one should contain a string stating the displayName of that item, which identifies it. Unfortunately, Apple sometimes forgets to include that displayName, leaving it set just to SU_TITLE, a placemarker. This happened with some Mojave updates, and makes it impossible for an app like SystHist to tell what was actually installed. In addition to that, there should be a displayVersion string which gives the version number of that item. That was left blank in macOS 10.14.1 too, so instead of the install history recording that macOS 10.14.1 update was installed, it said that SU_TITLE of no version was installed.

That is why SystHist has three separate views:

• On the left is a hierarchical display taken from the dictionaries in /Library/Receipts/InstallHistory.plist. When things are going well there, this should give a clear display of each macOS update with relevant security updates in between.
• In the centre is a simple list version of the same items from /Library/Receipts/InstallHistory.plist which can be more accessible, particularly when the hierarchy in the left view isn’t perfect.
• On the right is a history constructed from a different source, the ‘Bills of Material’ (BoM, .bom) files which each install should deposit in /System/Library/Receipts.

Entries in the install history give minimal information about what has been installed. To discover exactly what packages have been installed at any time, and obtain full listings of the contents of those packages, SystHist inspects and analyses the BoM files tucked away in /System/Library/Receipts. Again, these are subject to the vagaries of which macOS is running from where at the time that the installation is performed, and occasionally are missing completely.

Finally, these install histories and BoMs are subject to other conditions. Every once in while, a third-party tool may go haywire and decide to trash them, or change permissions on the history or either folder. Those events may not make themselves apparent until you open SystHist some weeks later, only to see its history stops a while ago, perhaps with macOS 10.14.2, when you’re now running 10.14.4.

SystHist does its best, but the information it displays is only as good as the install history and BoMs on that boot volume.