DMG (Apple Disk Image)

Overview

DMG (Apple Disk Image) is a disk image format used on macOS to package applications, installers, and data for distribution. DMG files create a virtual disk that appears in Finder when mounted, providing a convenient way to distribute software with custom backgrounds, layouts, and installation instructions. They support compression, encryption, and digital signatures for secure software distribution.

Technical Details

Container Format

• UDIF (Universal Disk Image Format): Modern DMG format
• HFS+/APFS Support: Native macOS file system compatibility
• Compression Options: Multiple compression algorithms
• Encryption: AES-128 and AES-256 encryption support
• Digital Signatures: Code signing for authenticity

DMG Variants

• UDRO: Read-only disk image
• UDCO: Compressed read-only (ADC compression)
• UDZO: Compressed read-only (zlib compression)
• UDBZ: Compressed read-only (bzip2 compression)
• UDTO: DVD/CD master format
• UDSP: Sparse disk image (grows as needed)
• UDSB: Sparse bundle (directory-based sparse)

File Structure

DMG File Components:
- Header: File format identifier and metadata
- Property List: XML configuration data
- Resource Fork: Additional metadata and resources
- Compressed Data: File system image data
- Checksum: Data integrity verification
- Digital Signature: Optional code signing data

Compression Algorithms

• ADC (Apple Data Compression): Legacy Apple compression
• zlib: Standard deflate compression
• bzip2: Higher compression ratio
• LZFSE: Apple's modern compression algorithm
• LZMA: High-efficiency compression

History and Development

DMG was introduced by Apple as part of Mac OS X to replace the older disk image formats used in classic Mac OS. The format was designed to simplify software distribution while providing security features like encryption and digital signing. DMG has evolved to support modern file systems, improved compression, and enhanced security features while maintaining backward compatibility.

Code Examples

Creating DMG Files (macOS)

Using hdiutil (Command Line)

# Create DMG from folder
hdiutil create -volname "MyApp" -srcfolder "/path/to/source" -ov -format UDZO "MyApp.dmg"

# Create encrypted DMG
hdiutil create -volname "SecureApp" -srcfolder "/path/to/source" -ov -format UDZO -encryption AES-256 "SecureApp.dmg"

# Create sparse DMG (expandable)
hdiutil create -volname "SparseVolume" -size 1g -type SPARSE -fs HFS+ "SparseVolume.dmg"

# Create DMG with custom size
hdiutil create -volname "CustomSize" -srcfolder "/path/to/source" -size 500m -format UDZO "CustomSize.dmg"

# Convert between DMG formats
hdiutil convert "input.dmg" -format UDBZ -o "output.dmg"

# Mount DMG
hdiutil mount "MyApp.dmg"

# Unmount DMG
hdiutil unmount "/Volumes/MyApp"

# Verify DMG integrity
hdiutil verify "MyApp.dmg"

# Get DMG information
hdiutil imageinfo "MyApp.dmg"

# Create DMG with background image and custom layout
mkdir temp_dmg
cp -R "MyApp.app" temp_dmg/
cp "background.png" temp_dmg/.background.png
hdiutil create -volname "MyApp Installer" -srcfolder temp_dmg -ov -format UDZO "MyApp-Installer.dmg"
rm -rf temp_dmg

Advanced DMG Creation Script

#!/bin/bash

# Advanced DMG creation script with custom styling
APP_NAME="MyApplication"
APP_VERSION="1.0.0"
SOURCE_DIR="./build/MyApp.app"
DMG_NAME="${APP_NAME}-${APP_VERSION}"
DMG_TEMP_DIR="./dmg_temp"
DMG_BACKGROUND="dmg_background.png"
DMG_WINDOW_X=100
DMG_WINDOW_Y=100
DMG_WINDOW_WIDTH=600
DMG_WINDOW_HEIGHT=400
DMG_ICON_SIZE=128

echo "Creating DMG for ${APP_NAME} ${APP_VERSION}..."

# Clean up any previous build
rm -rf "${DMG_TEMP_DIR}"
rm -f "${DMG_NAME}.dmg"

# Create temporary directory structure
mkdir -p "${DMG_TEMP_DIR}"
mkdir -p "${DMG_TEMP_DIR}/.background"

# Copy application
cp -R "${SOURCE_DIR}" "${DMG_TEMP_DIR}/"

# Copy background image
cp "${DMG_BACKGROUND}" "${DMG_TEMP_DIR}/.background/"

# Create Applications symlink
ln -s /Applications "${DMG_TEMP_DIR}/Applications"

# Create temporary DMG
hdiutil create -srcfolder "${DMG_TEMP_DIR}" -volname "${APP_NAME}" -fs HFS+ \
        -fsargs "-c c=64,a=16,e=16" -format UDRW -size 200m "temp_${DMG_NAME}.dmg"

# Mount the temporary DMG
DEVICE=$(hdiutil attach -readwrite -noverify -noautoopen "temp_${DMG_NAME}.dmg" | \
         egrep '^/dev/' | sed 1q | awk '{print $1}')
MOUNT_POINT="/Volumes/${APP_NAME}"

# Wait for mount
sleep 2

# Apply custom view settings using AppleScript
cat > temp_applescript.scpt << EOF
tell application "Finder"
    tell disk "${APP_NAME}"
        open
        set current view of container window to icon view
        set toolbar visible of container window to false
        set statusbar visible of container window to false
        set the bounds of container window to {${DMG_WINDOW_X}, ${DMG_WINDOW_Y}, $((DMG_WINDOW_X + DMG_WINDOW_WIDTH)), $((DMG_WINDOW_Y + DMG_WINDOW_HEIGHT))}
        set theViewOptions to the icon view options of container window
        set arrangement of theViewOptions to not arranged
        set icon size of theViewOptions to ${DMG_ICON_SIZE}
        set background picture of theViewOptions to file ".background:${DMG_BACKGROUND}"
        set position of item "${APP_NAME}.app" of container window to {150, 200}
        set position of item "Applications" of container window to {450, 200}
        close
        open
        update without registering applications
        delay 2
    end tell
end tell
EOF

# Execute AppleScript
osascript temp_applescript.scpt

# Wait for Finder to apply changes
sleep 3

# Unmount temporary DMG
hdiutil detach "${DEVICE}"

# Create final compressed DMG
hdiutil convert "temp_${DMG_NAME}.dmg" -format UDZO -imagekey zlib-level=9 -o "${DMG_NAME}.dmg"

# Clean up
rm -rf "${DMG_TEMP_DIR}"
rm "temp_${DMG_NAME}.dmg"
rm temp_applescript.scpt

echo "DMG created: ${DMG_NAME}.dmg"

# Optional: Code sign the DMG
if [ ! -z "$DEVELOPER_ID" ]; then
    echo "Code signing DMG..."
    codesign --sign "$DEVELOPER_ID" --verbose "${DMG_NAME}.dmg"
fi

Python DMG Handling

import subprocess
import os
import plistlib
import tempfile
from pathlib import Path

class DMGManager:
    @staticmethod
    def create_dmg(source_path, output_path, volume_name=None, compressed=True):
        """Create DMG from source directory or file"""
        if volume_name is None:
            volume_name = Path(output_path).stem
        
        cmd = [
            'hdiutil', 'create',
            '-volname', volume_name,
            '-srcfolder', str(source_path),
            '-ov',
            '-format', 'UDZO' if compressed else 'UDRO',
            str(output_path)
        ]
        
        try:
            result = subprocess.run(cmd, capture_output=True, text=True, check=True)
            print(f"DMG created successfully: {output_path}")
            return True
        except subprocess.CalledProcessError as e:
            print(f"Error creating DMG: {e.stderr}")
            return False
    
    @staticmethod
    def mount_dmg(dmg_path):
        """Mount DMG and return mount point"""
        cmd = ['hdiutil', 'mount', str(dmg_path)]
        
        try:
            result = subprocess.run(cmd, capture_output=True, text=True, check=True)
            # Parse output to find mount point
            lines = result.stdout.strip().split('\n')
            for line in lines:
                if '/Volumes/' in line:
                    mount_point = line.split('\t')[-1]
                    return mount_point
            return None
        except subprocess.CalledProcessError as e:
            print(f"Error mounting DMG: {e.stderr}")
            return None
    
    @staticmethod
    def unmount_dmg(mount_point):
        """Unmount DMG"""
        cmd = ['hdiutil', 'unmount', str(mount_point)]
        
        try:
            subprocess.run(cmd, capture_output=True, text=True, check=True)
            print(f"DMG unmounted: {mount_point}")
            return True
        except subprocess.CalledProcessError as e:
            print(f"Error unmounting DMG: {e.stderr}")
            return False
    
    @staticmethod
    def get_dmg_info(dmg_path):
        """Get information about DMG file"""
        cmd = ['hdiutil', 'imageinfo', str(dmg_path), '-plist']
        
        try:
            result = subprocess.run(cmd, capture_output=True, text=True, check=True)
            plist_data = plistlib.loads(result.stdout.encode())
            
            info = {
                'format': plist_data.get('Format', 'Unknown'),
                'size_bytes': plist_data.get('Size Information', {}).get('Total Bytes', 0),
                'compressed_bytes': plist_data.get('Size Information', {}).get('Compressed Bytes', 0),
                'encryption': 'AES' in plist_data.get('Format', ''),
                'checksum': plist_data.get('Checksum', {})
            }
            
            # Calculate compression ratio
            if info['size_bytes'] > 0:
                info['compression_ratio'] = (1 - info['compressed_bytes'] / info['size_bytes']) * 100
            else:
                info['compression_ratio'] = 0
            
            return info
            
        except subprocess.CalledProcessError as e:
            print(f"Error getting DMG info: {e.stderr}")
            return None
    
    @staticmethod
    def verify_dmg(dmg_path):
        """Verify DMG integrity"""
        cmd = ['hdiutil', 'verify', str(dmg_path)]
        
        try:
            result = subprocess.run(cmd, capture_output=True, text=True, check=True)
            print(f"DMG verification successful: {dmg_path}")
            return True
        except subprocess.CalledProcessError as e:
            print(f"DMG verification failed: {e.stderr}")
            return False
    
    @staticmethod
    def convert_dmg(input_path, output_path, format_type='UDZO'):
        """Convert DMG between different formats"""
        cmd = [
            'hdiutil', 'convert', str(input_path),
            '-format', format_type,
            '-o', str(output_path)
        ]
        
        try:
            subprocess.run(cmd, capture_output=True, text=True, check=True)
            print(f"DMG converted: {input_path} -> {output_path}")
            return True
        except subprocess.CalledProcessError as e:
            print(f"Error converting DMG: {e.stderr}")
            return False
    
    @staticmethod
    def extract_dmg_contents(dmg_path, extract_to):
        """Extract contents of DMG to directory"""
        mount_point = DMGManager.mount_dmg(dmg_path)
        if not mount_point:
            return False
        
        try:
            # Copy contents
            import shutil
            
            os.makedirs(extract_to, exist_ok=True)
            
            for item in os.listdir(mount_point):
                if not item.startswith('.'):  # Skip hidden files
                    source = os.path.join(mount_point, item)
                    dest = os.path.join(extract_to, item)
                    
                    if os.path.isdir(source):
                        shutil.copytree(source, dest, dirs_exist_ok=True)
                    else:
                        shutil.copy2(source, dest)
            
            print(f"DMG contents extracted to: {extract_to}")
            return True
            
        except Exception as e:
            print(f"Error extracting DMG contents: {e}")
            return False
        finally:
            DMGManager.unmount_dmg(mount_point)

# Usage examples
dmg_manager = DMGManager()

# Create DMG from application bundle
app_path = "/Applications/MyApp.app"
dmg_path = "MyApp-1.0.dmg"
dmg_manager.create_dmg(app_path, dmg_path, "MyApp Installer", compressed=True)

# Get DMG information
info = dmg_manager.get_dmg_info(dmg_path)
if info:
    print(f"Format: {info['format']}")
    print(f"Size: {info['size_bytes']:,} bytes")
    print(f"Compressed: {info['compressed_bytes']:,} bytes")
    print(f"Compression: {info['compression_ratio']:.1f}%")
    print(f"Encrypted: {info['encryption']}")

# Mount, list contents, and unmount
mount_point = dmg_manager.mount_dmg(dmg_path)
if mount_point:
    print(f"DMG mounted at: {mount_point}")
    print("Contents:")
    for item in os.listdir(mount_point):
        print(f"  - {item}")
    dmg_manager.unmount_dmg(mount_point)

# Verify DMG integrity
is_valid = dmg_manager.verify_dmg(dmg_path)
print(f"DMG is valid: {is_valid}")

# Extract DMG contents
extract_dir = "./extracted_dmg"
dmg_manager.extract_dmg_contents(dmg_path, extract_dir)

DMG Automation with GitHub Actions

name: Create DMG Release

on:
  release:
    types: [created]

jobs:
  create-dmg:
    runs-on: macos-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v3
    
    - name: Setup Node.js
      uses: actions/setup-node@v3
      with:
        node-version: '18'
    
    - name: Install dependencies
      run: npm install
    
    - name: Build application
      run: npm run build:mac
    
    - name: Import Code Signing Certificate
      env:
        CERTIFICATE_P12: ${{ secrets.CERTIFICATE_P12 }}
        CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
      run: |
        # Import certificate for code signing
        echo $CERTIFICATE_P12 | base64 --decode > certificate.p12
        security create-keychain -p temp_password build.keychain
        security default-keychain -s build.keychain
        security unlock-keychain -p temp_password build.keychain
        security import certificate.p12 -k build.keychain -P $CERTIFICATE_PASSWORD -T /usr/bin/codesign
        security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k temp_password build.keychain
    
    - name: Sign Application
      run: |
        codesign --deep --force --verify --verbose --sign "Developer ID Application: Your Name" "dist/MyApp.app"
    
    - name: Create DMG
      run: |
        # Create DMG with custom styling
        npm install -g create-dmg
        create-dmg \
          --volname "MyApp Installer" \
          --volicon "assets/volume-icon.icns" \
          --window-pos 200 120 \
          --window-size 800 450 \
          --icon-size 100 \
          --icon "MyApp.app" 200 190 \
          --hide-extension "MyApp.app" \
          --app-drop-link 600 185 \
          --background "assets/dmg-background.png" \
          "MyApp-${{ github.event.release.tag_name }}.dmg" \
          "dist/"
    
    - name: Notarize DMG
      env:
        APPLE_ID: ${{ secrets.APPLE_ID }}
        APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
        TEAM_ID: ${{ secrets.TEAM_ID }}
      run: |
        # Submit for notarization
        xcrun notarytool submit "MyApp-${{ github.event.release.tag_name }}.dmg" \
          --apple-id "$APPLE_ID" \
          --password "$APPLE_ID_PASSWORD" \
          --team-id "$TEAM_ID" \
          --wait
        
        # Staple notarization
        xcrun stapler staple "MyApp-${{ github.event.release.tag_name }}.dmg"
    
    - name: Upload DMG to Release
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        upload_url: ${{ github.event.release.upload_url }}
        asset_path: MyApp-${{ github.event.release.tag_name }}.dmg
        asset_name: MyApp-${{ github.event.release.tag_name }}.dmg
        asset_content_type: application/x-apple-diskimage

Common Use Cases

Software Distribution

• Application Installers: Packaging macOS applications for distribution
• System Utilities: Installing system tools and utilities
• Game Distributions: Packaging games and entertainment software
• Professional Software: Enterprise and creative application delivery

Content Delivery

• Media Files: Distributing video, audio, and multimedia content
• Document Packages: Bundling related documents and resources
• Font Collections: Typography and design asset distribution
• Educational Materials: Course content and learning resources

Development Workflows

• Build Artifacts: Automated build and release processes
• Beta Testing: Distributing pre-release software to testers
• Asset Distribution: Sharing development resources and tools
• Backup Solutions: Creating portable backup packages

Enterprise Deployment

• Corporate Software: Internal application distribution
• Configuration Packages: System configuration and settings
• Update Packages: Software update and patch distribution
• Security Tools: Deploying security software and certificates

Security and Code Signing

Digital Signatures

# Sign DMG with Developer ID
codesign --sign "Developer ID Application: Your Name" MyApp.dmg

# Verify DMG signature
codesign --verify --verbose MyApp.dmg

# Check signature details
codesign --display --verbose=4 MyApp.dmg

Notarization Process

# Submit for notarization
xcrun notarytool submit MyApp.dmg \
    --apple-id "[email protected]" \
    --password "app-specific-password" \
    --team-id "TEAM_ID" \
    --wait

# Staple notarization ticket
xcrun stapler staple MyApp.dmg

# Verify notarization
xcrun stapler validate MyApp.dmg

Security Best Practices

• Code Signing: Always sign applications and DMGs
• Notarization: Submit to Apple for malware scanning
• Encryption: Use AES encryption for sensitive content
• Verification: Validate DMG integrity before distribution
• Secure Distribution: Use HTTPS for download links

DMG files provide a secure, user-friendly way to distribute macOS software while maintaining the native look and feel that Mac users expect, with robust security features and customization options for professional software deployment.