How can I track the changes an installer makes?
Standard OS X Installer packages can easily be viewed. One tool for this is Suspicious Package, a QuickLook plugin that shows files and scripts contained in the Installer package.
While installing, you can monitor file system accesses using tools like opensnoop
or fs_usage
(both command line utilities).
You can show the files that would be copied by an installer by pressing command-I:
Or with lsbom:
$ lsbom ~/Desktop/KeyRemap4MacBook.pkg/Contents/Archive.bom
. 40755 501/20
./Library 40755 0/0
./Library/LaunchAgents 40755 0/0
./Library/LaunchAgents/org.pqrs.KeyRemap4MacBook.server.plist 100644 0/0 485 2125025754
...