# PackageKit PackageKit is an Apple installation framework involved in evaluating and applying software packages, including package metadata, payloads, receipts, and authorized installation actions. ## Security significance Package installation crosses from externally supplied content into privileged filesystem mutation. Historical packages could include pre-installation and post-installation scripts or invoke compiled helpers. The decisive security object is not the scripting language but whether PackageKit or a related privileged process exercises its authority over attacker-influenced state. ## Evidentiary boundary A package receipt or PackageKit log establishes installation activity, not malicious intent. Investigation should recover package signatures, source provenance, scripts, payload hashes, installer logs, authorization context, and resulting file changes. ## Relationships [[Package Manager]] · [[Software Supply-Chain Provenance]] · [[InstallESD.dmg]] · [[Perl]] · [[System Integrity Protection]] · [[Foundational Persistence]]. ## Source [[InstallESD.dmg#Why readable high-level code mattered|InstallESD.dmg — readable high-level code]].