Verify a .pkg Installer's Signature with pkgutil

Inspect the certificate chain of a macOS package file before you install anything from it.

macOSpkgutilcodesigninstallerpkgLow risk

Run `pkgutil --check-signature /path/to/file.pkg` to see the signing certificate chain and whether it is trusted.

01Command

Command

$ pkgutil --check-signature ~/Downloads/SomeInstaller.pkg

02What it does

Unlike a full Gatekeeper assessment, pkgutil --check-signature works directly on the .pkg file and shows every certificate in the chain, including when each expires. It catches packages that were re-signed by someone else or modified after signing. Pair it with `codesign -dv` on the app afterward for a complete trust picture.

03Risk

RiskLow risk

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

macOS pkgutil — query and manipulate packages
SS64 · technical · 2026-09-17
Evidence: Documents pkgutil --check-signature for verifying signed package archives.

Last verified: 2026-09-17 · Category: System & Settings

06Related solutions

Verify an App's Code Signature with codesign

macOSGatekeepersignaturecodesign

Check whether an application bundle was signed properly and hasn't been modified since.

Low risk ✓ 2026-09-17

Inspect Package Receipts and File Lists with pkgutil

macOSpkgutilcleanuppackage

List what an installer actually put on your disk, long after the installer window closed.

Low risk ✓ 2026-09-17