Is xar preinstalled on macOS? [duplicate]

Solution 1:

Unless you've disabled SIP and installed your own binaries in /usr/bin it's safe to assume that everything in /usr/bin (and /bin, /sbin, /usr/sbin) is pre-installed.

Solution 2:

One indication you might look for is found at https://opensource.apple.com/release/macos-10141.html where you see that xar-404 is indeed used by Apple.

To get a closer look at what is installed, you might use onboard tools check for some parameters:

$  codesign -vd --verbose=4 /usr/bin/xar

Executable=/usr/bin/xar
Identifier=com.apple.xar
Format=Mach-O thin (x86_64)
CodeDirectory v=20100 size=350 flags=0x0(none) hashes=7+2 location=embedded
Platform identifier=2
OSPlatform=36
OSSDKVersion=658432
OSVersionMin=658432
Hash type=sha256 size=32
CandidateCDHash sha256=6dd0100231ae53fb666827d9212b487d17fa6163
Hash choices=sha256
Page size=4096
CDHash=6dd0100231ae53fb666827d9212b487d17fa6163
Signature size=4105
Authority=Software Signing
Authority=Apple Code Signing Certification Authority
Authority=Apple Root CA
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements count=1 size=64

As Apple doesn't offer tools like that in seperate installers or packages, the conclusion from the output above would be that it came pre-installed.

Alternatively, get the full installer ("Install macOS Mojave.app"), show package contents, navigate Contents/SharedSupport/InstallESD.dmg and mount that, then navigate to /Volumes/InstallESD/Packages/Core.pkg and open that in eg Pacifist. There as well you can navigate to /usr/bin/xar .