As with many packages, it actually does a bit more, but even browsing its log you won’t know that it has also downloaded another app (in fact, a properly signed and notarized command tool, blowhole) from a remote website. When you open it, if you check what it installs using the Show Files command in the File menu, it admits only to installing a command tool, cintch, which is put in the main Applications folder. My example installer package has another surprise for you. That’s not true of Apple’s installer packages, though, and it requires you to notice something by its absence, which invites human error. Of course, the information is there if you look for it: when the package has been correctly signed, a small padlock icon is shown at the top right of the window. Instead, you’re taken straight into the first of the sequence of windows which lead you through the installation process. If you first open the Installer app and use its open file dialog to choose an unsigned package, there are no warnings given at all. Use the Finder’s Open command and, much like when trying to open a new app which hasn’t been notarized, you’re warned but given the choice of “overriding system security” and the risks that exposes you to.

That behaviour applies when you double-click the package. Normally, if you try to open a package which isn’t signed, and has been downloaded from the internet so has been put in quarantine, macOS informs you that the package is from an unidentified developer, so can’t be opened. In Big Sur, developers are required to sign them, and notarize the apps they distribute within them. Installer packages are one of the two means of installing third-party software which Apple officially recommends (the other being disk images). This shows how you can download, install and run executable code, such as an app, which isn’t signed with a Developer ID, only an ad-hoc signature, without macOS warning you that the code is potentially dangerous. This article is a demonstration of features in Big Sur which you might have thought would protect you, but because of their inconsistent behaviour could catch you out. Consistency in security, particularly in the GUI, is very important.

Macos big sur installation package