Installing ProvToolbox on macOS

ProvToolbox is a useful command line tool for validating and visualizing PROV documents, but unfortunately it can be a bit of a challenge to install on Windows and on macOS because of its dependency requirements.

This post suggests three step-by-step methods of installing ProvToolbox on your Mac – you should follow the method you feel most comfortable with, but can try the other methods in case of problems.

Table of content

  1. Overview of requirements
    1. Software packaging for macOS
  2. Conda
    1. Installing Graphviz and OpenJDK with Conda
  3. HomeBrew
    1. Installing Graphviz with HomeBrew
    2. Installing OpenJDK with HomeBrew
  4. Installing manually
    1. Installing AdoptOpenJDK manually
    2. Installing Graphviz manually
  5. Installing ProvToolbox
    1. Using ProvToolbox from VSCode

Overview of requirements

As of 2020-08, ProvToolbox 0.9.5 is the latest release, which requires:

  • Java JRE 9 or later. We’ll show how to install OpenJDK 11 which is the closest Long-Term Support release.
  • Graphviz 2.x (for visualization)

There is also an outdated installer of ProvToolbox for macOS, which is currently not recommended. In this guide we’ll show how to install ProvToolbox 0.9.5 from ZIP along with its requirements.

Warning: This guide has been developed for Intel-based Macs, if you are using the new ARM64 Mac you will either need to use compatibility modes or install/compile these individual dependencies manually.

Software packaging for macOS

Traditionally software installations on macOS are either drag-drop Application bundles (as from the Mac App Store or dmg disk images) or the wizard-based pkg installation packages, which can modify the Operating System.

Both of these approaches require the software to bundle all its dependencies, or that the user carefully install matching dependencies in order. As many open source software packages, particularly for the command line and programming, rely heavily on other software libraries, this traditional approach can become cumbersome or fragile over time.

As an alternative, several software packaging initiatives have evolved that work with macOS, including:

  • Conda
    Initially centered around supporting multiple Python binaries and Jupyter Notebook, the Anaconda repository provides a large selection of pre-compiled open source software tools and libraries, particularly for data science and academic users. Also available for Windows and Linux. Conda can activate different environments which is useful for reproducibility or if installing multiple versions of the same software.
  • HomeBrew
    A recipe-based repository of pre-compiled software, including most general-purpose open source you will want to install in macOS, but also useful for adding newer versions of software already installed in macOS. Usually fast and straight forward to use as long as HomeBrew itself installs correctly, and packages are kept up to date.
  • MacPorts
    Similar to HomeBrew, providing a large selection of general open source packages. Compiles from source code locally, which can be time-consuming and requires installation of build tools like XCode. Useful for experimenting with bleeding edge versions of software.

These systems work similar to Linux distributions like Ubuntu or Debian, in that installing a particular package will also install its dependencies. However the packages and binaries are installed under a dedicated folder, typically under /usr/local or /Users/alice/miniconda3 within the user home directory. This alternative root will have traditional POSIX folders corresponding to their operating system counter-parts under /usr like bin/ lib/ and share/ — allowing the package system to rely on runtimes like Python, independent of what Apple may provide in that particular macOS version.

These packaging systems therefore typically modify the system variable PATH for the current user, so that the tools installed can take preference over the commands included with the operating system.

Note: You should not need to use sudo to install software within the chosen packaging system.

Warning: If you are already using programming languages like Java, Python or Ruby, be aware that after installing a packaging system according to this guide, your PATH may pick up a different version of runtimes/compilers, which may require you to reinstall any additional libraries you use. To check which path is resolved, use the shell built-in type:

$ type python
python is /home/stain/miniconda3/bin/python


We found that using the package manager Conda gave the most consistent results for installing the dependencies of ProvToolbox. The large selection of packages in Anaconda repository is also useful for data science purposes, such as using Jupyter Notebook or R.

While there are multiple ways to install Conda on macOS, we here show the Miniconda method using the Terminal.

First open the Terminal application from Applications/Utilities:

To install Miniconda, run these two commands:

curl -O


As installation finishes, ensure you say yes to allow conda init to modify your PATH.

Here the Conda base environment have been installed under /Users/testuser/miniconda3 however we need to start a new terminal to activate it.

Note: If you are on macOS Catalina or newer, the default shell is now zsh. Substituting testuser below you may need to run the equivalent of:

source /Users/testuser/miniconda3/bin/activate

conda init zsh

Installing Graphviz and OpenJDK with Conda

First, in a new terminal window, check that the conda command is working by searching for Graphviz:

conda search graphviz

We can install graphviz and OpenJDK 11 at the same time using:

conda install graphviz openjdk=11

After Conda has resolved dependencies, answer y to install:

After download and installation has finished, verify both GraphViz and Java work:

dot -V
java -version

You can now skip to the section on installing ProvToolbox.


HomeBrew is a popular package management system for macOS that can help with installing pre-built open source software. However, installing and using HomeBrew itself is not always trivial. This section is provided as an alternative to the Conda method above.

Warning: In our testing we found HomeBrew did not work using an older macOS 10.11. If you are using the newest macOS version on compatible hardware, you are free to try this approach, which can be useful later as HomeBrew adds a convenient way to install many other data science tools in recent versions, e.g. R, LaTeX, Snakemake.

Installing HomeBrew

First open the Terminal application, found under Applications/Utilities.

Following the instructions on the HomeBrew home page, paste this command line on a single line to start installing, providing your user password for administrator rights:

/bin/bash -c "$(curl -fsSL"

The defaults for installing are usually fine:

Note: If you get a similar warning about old macOS version, using HomeBrew may not work well on your machine (as we found in our testing). Try instead the Conda method described above.

After installing HomeBrew you may get a warning about shallow clone, this can be ignored unless you are developing your own brew recipes.

Installing GraphViz with Homebrew

To activate brew it should be sufficient to start a new Terminal window. Test this by doing running:

brew search graphviz

In this case you are ready to install:

brew install graphviz

On a good day the above should complete and you would be able to verify the installation of graphviz:

dot -V

However on our test machine we got a stack trace error indicating a bug in Homebrew itself. This is why this method of Homebrew is not recommended for older Macs.

Installing OpenJDK with HomeBrew

Warning: This section has not been tested.

AdoptOpenJDK is a community effort for packaging binary installers/packages of the open source Java implementation OpenJDK, avoiding restrictive licenses and registration requirements.

To install OpenJDK 11 from AdoptOpenJDK with HomeBrew try:

brew tap AdoptOpenJDK/openjdk

brew cask install 

Verify the Java version:

java -version

If both Graphviz and Java are working, you can now skip to the section on installing ProvToolbox.

Installing manually

Installing AdoptOpenJDK manually

AdoptOpenJDK is a community effort for packaging binary installers/packages of the open source Java implementation OpenJDK, avoiding restrictive licenses and registration requirements.

While using a packaging system can help you keep your OpenJDK install updated, if you were unable to use Conda or HomeBrew to install Java, as an fallback it is also possible to download the standalone AdoptOpenJDK installer.

From the AdoptOpenJDK make sure you select:

  • Version: Open JDK 11 (LTS)
  • JVM: HotSpot
  • OS: macOS
  • Architecture: x64

If these options are not available, select them from the Other Platforms page. Download the pkg installer of the JRE.

Walk through the installer and use the default settings.

Now open a new Terminal from Applications/Utilities

The installer should have adjusted your PATH. To check the installed version, run:

java -version

If you don’t get the correct Java version you will need to adjust your PATH and/or JAVA_HOME environmental variables.

Installing Graphviz manually

Compiling and installing Graphviz from source code is a non-trivial task on macOS. Some outdated pkg installers of Graphviz have been made but we have not tested these. A recent blog post details how graphviz can be compiled using brew dependencies, but this should only be needed for PDF support compared to brew install graphviz described above. If you already use MacPorts then try sudo port install graphviz

Installing ProvToolbox

Following the ProvToolbox install instructions for “Other Platforms”, download the

Opening with Archive Utility will unzip to your Downloads directory. From there, move the ProvToolbox directory to your Applications folder:

Next we will add the provconvert command line to your PATH. First open the Terminal from Applications/Utilities:

Become the root user and carefully run:

sudo -i

cd /etc/paths.d/

echo /Applications/ProvToolbox/bin > ProvToolbox


Tip: You can use the Tab button to auto-complete the paths.

To activate the new PATH, either restart Terminal or log out of macOS and in again. Now verify with:

provconvert -version

You can now start validating and visualizing PROV-N with ProvToolbox.

Tip: Convert to png and use the open command to preview the diagram:

You can use the commands cd and ls to change directory and list directories in the Terminal. If you are unfamiliar with navigating the shell, you may find it easiest to save the provn files directly in your home directory.

Using ProvToolbox from VSCode

While you may use an editor like Application/Utilities/TextEdit bundled with macOS for creating PROVN files, you may find an editor like VSCode more convenient, particularly as it allows opening an embedded terminal. After installing, try View -> Terminal in the menu.

If you convert to png you can preview the diagram within VSCode:

Installing ProvToolbox in Windows

While there are several tools available for validating and visualizing PROV, the ProvToolbox is perhaps the most useful for validating PROV-N syntax. However, the normal releases does not run in Windows due to a operating system restriction for command line and folder path length.

We have suggested a fix, but while we wait for that below we describe a patch build that should work on Windows. You will also need Java for executing ProvToolbox, and Graphviz for visualization.

Install Java for Windows

You will need Java JRE 9 or later to run ProvToolbox 0.9.5, so below we show how to install JRE 11 LTS on Windows. Do not install from as that provides the older Java 8, which unfortunately do not work with this ProvToolbox release.

Unfortunately there are quite a few alternatives for installing Java in Windows:

Oracle provide installers of JDK 11 for Windows x64, however they are distributed under a restrictive license you or your organization may have reservations against using. These are however straight forward to install if you only want to run ProvToolbox for personal or development use.

The official open source release of OpenJDK 11 for Windows do not provide an installer, and are fairly large. If you choose to install this you will need to modify your PATH system environment variable manually depending on where you extract the folder jdk-11 to.

Alternatively RedHat provide OpenJDK installers based on the open source JDK, we would recommend jre- MSI or newer. The MSI packages are installable by double-click in newer versions of Windows. You will need to create a RedHat account to download.

Finally, AdoptOpenJDK is a community project for providing user-friendly open source builds of Java. We found option this to be the easiest to install in Windows, as they provide a MSI installer of the smaller JRE distribution, and do not require registration. However the website needs some help navigating as they provide many alternatives.

Installing AdoptOpenJDK

We recommend this open source option for installing Java for Windows users.

From select Other Platforms, giving the full list of downloads. Make sure you select:

  • Version: Open JDK 11 (LTS)
  • JVM: HotSpot
  • Operating System: Windows
  • Architecture: x64 (64-bit Windows)
    • If you use 32-bit Windows, say on an older or smaller machine, try x86 instead

Download the JRE as a MSI installer (the ZIP file does not include an installer).

Before you open the MSI you may need to change the Windows Store settings to allow installing applications. From the start menu type Add or Remove Programs to open the Settings pane for Choose where to get apps. Select Anywhere.

Now double-click the MSI file from the Download folder and walk through the Installer. Enable the “Set JAVA_HOME environment variable” option.

Now open the Command Prompt window:

Run java -version to check you now got OpenJDK 11 installed on the PATH.

Install ProvToolbox (patched)

Now we will install ProvToolbox 0.9.5 including the suggested fix so it runs in Windows. Until this fix has been accepted, for now we’ll use the ProvToolbox 0.9.5 for Windows patch release from the fork

Download and, after opening, click Extract All:

Shorten the path to install the folder to your home directory, e.g. C:\Users\stain

You should now have a folder ProvToolbox in your home directory:

You should now be able to run ProvToolbox\bin\provconvert from the Command Prompt open in your home directory:

Note that if you change the directory with cd you will need to modify the path to provconvert. To avoid that we’ll add it to the System Environment Variable PATH. In the Start menu, type PATH and select Settings -> Edit the system environment variables.

Click System Environment, then under User variables select PATH and click Edit. (If not found, click New and set Variable Name as PATH). Add a new line (or set Variable Value) where you can use Browse to navigate to find the full path of the ProvToolbox\bin folder:

After applying the settings with OK you will need to close and restart the Command Prompt window. This time provconvert -version should work from any path.

Install Graphviz for Windows

ProvToolbox can also generate visualization, but for this we need to install the open source tool Graphviz.

Following the link for downloading Stable Windows Install Packages we are unfortunately thrown into an undocumented directory browsing. We found that the cmake/Release/x64 installer worked well on 64-bit Windows (for older 32-bit Windows, try Win32).

You will need to allow the unsifned package to install

When running the install wizard for GraphViz, make sure you enable to add GraphViz to the system PATH for the current user:

Close and restart the Command Prompt Window. This time dot -V (notice capital) should work:

Unfortunately the installer of GraphViz does not initialize the plugins for graphical formats. To fix this we need to open another Command Prompt, but running as Administrator:

In this window, run dot -c to initialize the GraphViz plugins.

Installing Visual Studio Code

VSCode is a free and lightweight text editor which is useful for writing *.provn files. The User Installer for 64-bit Windows should work for most users.

Note: After installing VSCode you will need to Restart Windows to pick up the updated PATH for ProvToolbox.

Running provconvert from VSCode

Remember to save PROV-N files (example) with the extension .provn so that ProvToolbox can recognize the file type. The first time you may need to select No Extension and add .provn yourself to the filename.

In VSCode’s menu, select Terminal -> New Terminal, an embedded command prompt should open in the correct directory. Check with dir *.provn that the file is present with the correct name.

You should now be able to convert the provn file to a PNG image, in our example using the command:

provconvert -infile alice.provn -outfile alice.png

You will be able to navigate and open the PNG image within VSCode. See validating and visualisation for details.

If you have made a syntactical error in the PROV-N file, then provconvert report errors by line numbers, which you can recognize within the VSCode editor. Note that VSCode has no native PROVN support and so its Problems tab is currently unable to detect these errors.

Remember an error early in the file, such as a broken prefix, or a missing ), may cause phantom errors to be reported later in the file.

Attribution vs association

A valid question when writing provenance in responsibility view and process view is:

Should we attribute contributors from entities, isn’t that what the activities are showing?

Specially when roles it may seem unnecessary to also declare wasAttributedTo statements.

It is true that you can conclude from:

wasAttributed(ex:entity, ex:agent)

then there was some activity X such that:

wasGeneratedBy(ex:entity, X)
wasAssociatedWith(X, ex:entity)

This conclusion follows from the constraint on agents and the definition of wasAttributedTo.

However you can’t conclude the opposite directions – someone might be associated with an activity but not be responsible for a particular entity generated by that activity.

Imagine three family members writing Christmas cards:


wasAssociatedWith(ex:Alice, ex:WritingCards, prov:role=['ex:Writing'])
wasAssociatedWith(ex:Bob, ex:WritingCards, prov:role=['ex:Writing'])
wasAssociatedWith(ex:Charlie, ex:WritingCards, prov:role=['ex:Addressing'])


wasGeneratedBy(ex:cardToEve, ex:WritingCards)
wasGeneratedBy(ex:cardToFrank, ex:WritingCards)
wasGeneratedBy(ex:cardToMalory, ex:WritingCards)

Now from this we may want to give the cards attribution to the individual agents, and while we can perhaps assume Charlie has written the address on all the cards, we don’t know if it was Alice or Bob who
wrote the particular card going to Frank.

We therefore can add more specifically:

wasAttributedTo(ex:cardToEve, ex:Alice)
wasAttributedTo(ex:cardToFrank, ex:Alice)
wasAttributedTo(ex:cardToMalory, ex:Bob)

.. and for completeness:

wasAttributedTo(ex:cardToEve, ex:Charlie)
wasAttributedTo(ex:cardToFrank, ex:Charlie)
wasAttributedTo(ex:cardToMalory, ex:Charlie)

This highlights that responsibility view and process view can complement each other.

It is part of our modelling to decide what is considered “work height” in terms of attributions. Perhaps we should not consider Charlie putting on addresses as part of writing the cards, if what mattered was the personalized message, not how the cards were posted.

It is possible to also assign prov:type to wasAttributedTo relations, e.g. ex:authorship, but this can easily become overlapping with the roles in associations with the corresponding activity. This is perhaps more useful when the activity is not explicitly declared, or we want to declare explicit contributor roles using metadata models like CRediT.

Multiple agents sharing roles

Assuming the task of writing provenance for a student group exercise, consider the question:

Do we need to assign everyone in the group a specific role since in our group we found that for many of the tasks, everyone worked together to complete it?

If you all worked together without distinguishing roles, then you can either assign the same role to each agent (showing you shared that role) or not have any roles.

prefix ex
prefix terms
activity(ex:writingCards, [prov:type='terms:CardWriting'])
wasAssociatedWith(ex:Alice, ex:writingCards,
wasAssociatedWith(ex:Bob, ex:writingCards,

While the role terms:Writing above does not really tell us much as the activity is already of type terms:CardWriting, the distinction is somewhat that not saying the role is “We don’t know / didn’t say what work they did” while explicit role is saying “They did the same work, but we have not broken it down further“.

In a way a role is a short-circuiting device to avoid having infinite recursion into very tiny activities – it allows multiple things to happen in the same activity.

Let’s say Charlie helped with putting addresses on the envelopes, in our simple one-activity modelling we can associate them with a separate role:

wasAssociatedWith(ex:Charlie, ex:writingCards, 

Now we know who to blame if the cards end up on the North pole!

It is a modelling question to use a single activity with multiple agents associated, potentially with different roles; or to use multiple activities with simpler associations, perhaps not needing roles. One thing to keep in mind is that more activities will also need more entities to represent the different states, e.g. ex:unwrittenCard1, ex:writtenCard1, ex:addressedCard1.


Rather than associating multiple agents to a single activity it is possible to make a new agent that represent the whole group, in which case it is a choice to not break down to individual engagement.

For instance this would be correct if recording a board room decision, where the group of Alice, Bob and Charlie together decided/stated something they may agreed with or be responsible for individually.

PROV does not itself define how to specify the make-up of groups – but
it has agent types prov:Person, prov:Organization and
prov:SoftwareAgent that you can assign using prov:type.

A student group might not sound like an organization, but it is the
closest match of the three. We also see that there is an equivalent type Organization in the vocabulary, with looser sub-types including PerformingGroup (a band or orchestra), Project (someone working towards a shared goal) or even CollegeOrUniversity (the University as a whole).

While PROV literature does not cover well how to use external vocabularies like, we can take advantage of such types and attributes in PROV-N and express group membership using, adding a parentOrganization relation to the University for good measure.

prefix s <>
prefix ex <>

agent(ex:UoM, [prov:label="University of Manchester",

agent(ex:RedGroup, [prov:label="Red Group",

The keen reader will notice that the above example repeats some attribute names to express multiple relations of prov:type and s:member – both of these are unordered.


As an alternative, PROV has the concept of Collections.

Although collections are mainly used for describing compound entities, such as a dataset containing samples, as agents can concurrently be entities
they could also be used for showing group members.

Tip: Treating a agent as an entity can be of interest if your provenance need to show its evolution over time, for instance changes to group membership. In this case, note that you will need multiple agent identifiers depending on which “version” of the group was associated with particular activities across time, or use specialization to make a “timeless” entity.

Using prov:Collection would perhaps feel more PROV native than use above, but without any additional attributes like parentOrganization:

prefix ex <>

agent(ex:Red, [prov:type='prov:Organization'])
entity(ex:Red, [prov:type='prov:Collection'])

hadMember(ex:Red, group:Alice)
hadMember(ex:Red, group:Bob)

This choice between vocabularies is I’m afraid part of data modelling — there will never be a single perfect metadata model, and so we have to either pick the one that is most useful, or find a way to combine both approaches. (Although verbose, the above should work both ways)

Sometimes two metadata models can be in conflict in terms of granularity, in which case you should use different identifiers, in some cases even different documents.

What are good PROV-N prefixes?

Most examples of PROV-N use example prefixes like:

prefix ex <>
prefix exg <>

These example domains are explicitly reserved globally for all kinds of examples and training material, and deliberately do not have any content, advertisement or affiliations.

Assume you are writing the provenance of a student group exercise, should you be using the prefix/namespace ex and to define agents/entities/relationship and your own attribute types?

You can keep using, but ideally you should define your
own namespace based on a Web URL you “control” or “own”. This would make your Linked Data identifiers globally unique.

Students at The University of Manchester can publish their own home pages, and luckily most universities still provide a similar facility. Our students can search up themselves on and find for instance that they are which means they could make any sub-page under that directory.

Now the page does not need to exist – this blog is not about making Web pages – it is just important that it could exist at that address – that means it is that person’s identifier space.

So we could imagine that Alice made two files under her directory:

In real life you would also have to deal with file extensions like .html or server configuration for content types, see Tim Berners-Lee’s Cool URIs don’t change for further considerations.

As above it is considered good practice to separate the prefix/namespace for new roles/attributes that you define vs specific agents/entities in one particular provenance trace. The idea being that the general terms could be reused in multiple provenance documents with the same meaning.

So let’s map in the above documents as namespaces in PROV-N:

prefix terms <>
prefix group <>

The prefix string usually is a short name somewhat matching the address, it just needs be unique and consistent within the same PROV document. Other documents can freely map the same namespace to a different prefix.

A diligent reader might notice the # at the end of the namespace – this “fragment” is in Web documents used to indicate a subsection or heading within the same file.

This is so that terms:student expands to
rather than end with alice.davidson/termsstudent – even if we have not made the pages now we would not want to make a separate page for each word.

In some cases separate pages are desirable, in which case the namespace
ends in / to mark a directory – for instance s:Person becomes as have decided their term list is too big to keep in a single page.

Now we can use these prefixes for identifying
agents/entities/activities, as well as using our own attributes, roles
and types.

agent(group:Alice, [prov:type='prov:Person',

wasAssociatedWith(group:Alice, group:studying,

It is customary that attributes start with lower case after :, while
types/roles start with Capital – but this is just stylistic.

As for entity identifiers, your terms and roles should not have spaces or special characters in them as they must be combineable with the namespace to a valid URI, e.g. camel case favouriteDay or underscore favourite_day

It is possible in PROV-N (but not easily in other PROV syntaxes) to use freehand roles/types strings like prov:role="Writing carefully" – these are kind of anonymous and cannot be assumed to mean the same thing across multiple PROV documents.

In many cases there is no suitable URI yet, in which case using a temporary namespace like is perfectly valid as a working example, just be aware of the risk of other people having the same namespace idea!