pkgutil --forget Deletes the Receipt, Not the Files

Most answers to "how do I uninstall a .pkg on a Mac" end with sudo pkgutil --forget. So I tested what it removes. I built a small package with three files and a symlink, installed it into my home folder on a Mac mini running macOS 26.4.1 (no sudo needed for that), and ran pkgutil --forget cc.picklog.pkgtest --volume ~. It printed Forgot package 'cc.picklog.pkgtest' on '/Users/sg-mini'., exited 0, and didn't ask for confirmation even without -f. All six installed entries were still on disk afterwards. Only the two receipt files in ~/Library/Receipts were gone.

That matches the man page, which says --forget will "discard all receipt data about package-id, but do not touch the installed files." What the man page doesn't cover is how hard it is to do the uninstall yourself from the receipt. I went through all 32 receipts on this Mac. Several of them would make a pkgutil --files ... | xargs rm loop delete the wrong things or skip files.

What pkgutil --forget removes

A receipt is two files: a small plist (package ID, version, install location, install time) and a BOM, the list of every path the installer laid down with its owner and mode. For my 10-entry test package the BOM was 58,551 bytes. --forget deletes both files and nothing else. After that, pkgutil --file-info on one of the installed files showed only volume: / and the path, with no package. The files were still there, but nothing on the system recorded which package had put them there.

The receipts also aren't all in one folder. pkgutil --pkgs listed 32 package IDs, but /var/db/receipts held only 2 of them: com.tailscale.ipn.macsys and com.wizvera.vp20handler. The other 30, all Apple's, are in /Library/Apple/System/Library/Receipts, and ls -lO shows that folder carries the restricted flag, meaning System Integrity Protection guards it. Packages installed into a home folder write receipts to ~/Library/Receipts, and you only see them with pkgutil --pkgs --volume ~. With no home receipts that command printed nothing and exited 1.

Apple's own example prints the failure message

The receipt question comes up most often with the Command Line Tools. Apple's Installing the command-line tools page says to delete the receipt so Software Update stops offering the package, and gives this as the successful result:

% sudo pkgutil --forget com.apple.dt.commandlinetools
No receipt for 'com.apple.dt.commandlinetools' found at '/'.

That output is pkgutil's not-found error. On my Mac the same lookup printed the same line and exited 1. There is no receipt with that ID here. The Command Line Tools are installed as 9 receipts named com.apple.pkg.CLTools_*, and the same Apple page uses com.apple.pkg.CLTools_Executables in its own --pkg-info example a few paragraphs earlier. A real success looks like the line from my test: Forgot package '...' on '...', exit 0.

The Ask Different thread on removing uninstalled Command Line Tools from Software Update (19 votes) arrives at the same place from the other side. Its answers point to the /Library/Apple/System/Library/Receipts folder and say that on Apple silicon the CLTools files there could only be removed with SIP temporarily disabled. A related question shows pkgutil --forget com.apple.pkg.CLTools_Executables failing because it looked in /var/db/receipts while the receipt sat in another folder. I don't have sudo on this machine, so I didn't run --forget against any Apple receipt myself.

Four ways the receipt misleads an uninstall

The common do-it-yourself uninstall is to list the files with pkgutil --files and delete them. I ran each receipt on this Mac through that idea, and the receipt data was wrong or incomplete in four ways.

1. Paths are relative. --files prints paths relative to the receipt's install location, with no leading slash. Tailscale's receipt has location Applications/Tailscale.app, so its entries look like Contents/Info.plist. Pipe that into rm and it resolves against whatever directory your shell is in. You have to join volume, location and path yourself, which pkgutil --pkg-info gives you.

2. Files are shared between receipts. I built a map of every file path claimed by every receipt: 76,373 unique paths. Most have one owner, but pkgutil --file-info on XProtect.bundle/Contents/Info.plist listed 17 packages: 16 versions of XProtectPlistConfigData installed between May 15 and October 7, plus com.apple.files.data-template. Each old XProtect receipt still claims the current files, because newer updates overwrote them in place. Not one of those 16 receipts owns a file by itself. Deleting "the files of" the May 15 update would delete the XProtect data installed on October 7.

3. --only-files drops symlinks. My test receipt had 10 entries. --only-files returned 7 and --only-dirs returned 2. The missing one was link.txt, the symlink. Tailscale's receipt has 214 entries, 122 files and 86 directories, so 6 are neither, and find /Applications/Tailscale.app -type l counts 6 symlinks. A script built on --only-files leaves them behind.

4. Entries point at things that were never there or are gone. My test receipt lists five ._ AppleDouble entries (._a.txt and so on). pkgbuild added them because my source files carried macOS's com.apple.provenance attribute, and the installer turned them back into attributes, so they never existed as files. Four Command Line Tools SDK receipts each list a single file, /private/tmp/.BBE72B41..., that no longer exists. GatekeeperCompatibilityData lists 9 files in /private/var/db/gke.bundle, and the whole bundle is gone. In com.apple.files.data-template, 2 LaunchDaemon plists are missing. Another 310 entries returned EACCES, not ENOENT: they sit under root-only folders like /private/var/db/dslocal. A check like Python's os.path.exists reports those as missing, which is wrong.

Receipt group on this Mac	Receipts	Files per receipt	Owned by that receipt alone
XProtectPlistConfigData	16	13 to 14	0
XProtectPayloads	2	43	0
CLTools (Executables, 2 SDKs, SwiftBackDeploy)	4	222 to 32,350	all
CLTools (4 old SDK stubs, 1 empty)	5	0 or 1	0 (file gone)
files.data-template	1	8,513	8,461
GatekeeperCompatibilityData	1	9	9, all missing
MRTConfigData	1	97	97
Tailscale 1.98.1	1	122 + 6 symlinks	all
Wizvera Veraport	1	20	20

A dry-run uninstall plan from the receipt

I wrote a 38-line script that handles the four problems and deletes nothing. It resolves absolute paths from each receipt's own install location, takes everything that isn't a directory (so symlinks are included), checks every other receipt on the same volume for shared paths, and splits the result into files to delete, shared files to keep, and entries already gone. Directories are listed deepest first, to remove only if empty.

#!/usr/bin/env python3
"""Dry-run uninstall plan for one pkgutil receipt. Deletes nothing."""
import os, plistlib, subprocess, sys

def run(*a):
    return subprocess.run(['pkgutil', *a], capture_output=True)

pkg, vol = sys.argv[1], (sys.argv[2] if len(sys.argv) > 2 else '/')

def paths(p, *flag):
    info = plistlib.loads(run('--pkg-info-plist', p, '--volume', vol).stdout)
    base = os.path.join(info['volume'], info.get('install-location', ''))
    out = run(*flag, '--files', p, '--volume', vol).stdout.decode().splitlines()
    return [os.path.normpath(os.path.join(base, f)) for f in out]

# who else claims each path? (other receipts on the same volume)
others = set()
for p in run('--pkgs', '--volume', vol).stdout.decode().split():
    if p != pkg:
        others.update(set(paths(p)) - set(paths(p, '--only-dirs')))

delete, shared, absent = [], [], []
dirs = paths(pkg, '--only-dirs')
# --only-files drops symlinks, so take everything that is not a directory
for f in sorted(set(paths(pkg)) - set(dirs)):
    if not os.path.lexists(f):
        absent.append(f)
    elif f in others:
        shared.append(f)
    else:
        delete.append(f)
dirs = sorted(dirs, key=len, reverse=True)

print(f'# {pkg} delete {len(delete)}  keep-shared {len(shared)}  '
      f'absent {len(absent)}  dirs {len(dirs)}')
for f in delete: print('rm', repr(f))
for d in dirs: print('rmdir', repr(d), '# only if empty')
for f in shared: print('# shared, keep:', f)

On my test package it printed delete 3 keep-shared 0 absent 5 dirs 2, including the symlink my first draft missed. I ran the rm and rmdir lines, then --forget, and the only thing left was the install-location folder itself, which the receipt doesn't list because it is the root of the payload. On the real receipts it gave:

# com.tailscale.ipn.macsys delete 128  keep-shared 0  absent 0  dirs 86
# com.wizvera.vp20handler delete 20  keep-shared 0  absent 0  dirs 11
# ...XProtectPlistConfigData 16U4454 delete 0  keep-shared 16  absent 0  dirs 12
# ...XProtectPayloads 16U4413 delete 0  keep-shared 43  absent 0  dirs 16
# com.apple.pkg.CLTools_SDK_macOS13 delete 0  keep-shared 0  absent 1  dirs 2

A receipt also leaves a lot out: whatever the postinstall script created, launchd jobs it loaded, preferences, caches, and anything the app wrote after first launch. Check for a vendor uninstaller first. Veraport's receipt, for example, lists VeraportUninstaller.app among its own files. If the package installed a daemon, unload it before deleting its plist (the difference matters, see LaunchAgent vs LaunchDaemon). The top answer on Ask Different's How do you uninstall .pkg file? (35,927 views) makes the same point: there's no generic way, because each package puts files wherever its author chose. Run --forget last, after the files are gone, so you still have the list if something goes wrong.

Receipts are one place where Mac metadata misleads; extended attributes are another. The ditto command on Mac post covers what a copy keeps, and No such xattr com.apple.quarantine covers the quarantine flag. If you got the package inside a disk image, hdiutil covers mounting and detaching it.

FAQ

Does pkgutil --forget uninstall the package?

No. pkgutil --forget deletes only the receipt, a plist and a BOM file listing the installed paths. The installed files stay on disk. On macOS 26.4.1 it printed "Forgot package" and exited 0 without asking for confirmation. Delete the files first, using pkgutil --files for the list, and run --forget last.

Where does pkgutil store package receipts?

On macOS 26, third-party receipts are in /var/db/receipts, Apple's own receipts are in /Library/Apple/System/Library/Receipts (protected by System Integrity Protection), and packages installed into a home folder keep receipts in ~/Library/Receipts. Apple says the location can change, so use pkgutil --pkgs to list them, adding --volume ~ for home installs.

How do I uninstall a .pkg on Mac with pkgutil?

Run pkgutil --pkg-info to get the install location, then pkgutil --files to list paths relative to that location. Before deleting, check each file with pkgutil --file-info: if more than one package owns it, keep it. Include symlinks, which --only-files leaves out, remove empty directories deepest first, then run sudo pkgutil --forget with the package ID. Use the vendor's uninstaller if one exists.

Method: everything ran on 2026-10-09 between 16:30 and 16:45 KST on a Mac mini M4 (Mac16,10, macOS 26.4.1 build 25E253) over SSH, as a normal user without sudo. The test package was built with pkgbuild and productbuild (home-folder domain only) and installed with installer -target CurrentUserHomeDirectory, then removed. The census queried all 32 receipts with pkgutil --pkg-info-plist and --files and checked each path with lstat, recording ENOENT and EACCES separately; two entries under /Users were skipped. The Apple text was read from the documentation page's JSON source, and the Ask Different threads through the Stack Exchange API, the same day. I didn't run --forget on any root or Apple receipt, test with SIP disabled, or check older macOS versions, where receipts lived in other folders.