New posts

Reply to thread

Message: <blockquote data-quote="MacInWin" data-source="post: 1895630" data-attributes="member: 396914">The Mx systems will NOT boot if the internal storage has a failure. So an external drive can only be used as a boot drive if the internal drive is still available. For now, that includes all external drives--they can ONLY boot if the internal storage is still functioning. And if the internal storage is functioning, there is already a full system of the current OS stored in the secure enclave known as the Sealed System Volume that can be reinstalled. Because of that, I see no use-case for a bootable external thumb drive installer for Mx systems (or for that matter, systems running Monterey).If you want to know why, keep reading, otherwise that's it.On an Mx system running either Big Sur or Monterey (the only two version supported at this time), the system files are kept in a secure enclave where they are encrypted, write protected and from which an SHA-256 hash is calculated. That hash is then stored in the enclave with the metadata. Every file has a hash, the hashes are then hashed as groups and a final master hash generated, verified by Apple as correct, encrypted, and stored. Apple calls that the Seal, or Sealed System Volume. Only Apple can open the Seal with their security codes. (Somebody may crack that, but probably not until quantum computers come along, I suspect.) Then a snapshot of that system is made, and it is that snapshot that is actually booted. Part of the boot process checks to see if the hash of the snapshot matches the hash of the Seal, and if it does not, the system boots into recovery mode. If the hash does match, the boot process continues. Now consider trying to boot from an external drive. The process will calculate the hash of the boot system on the external and if it matches the Seal, let the boot continue (there is a LOT more going on, but just go along with this for a minute). But if the internal storage has failed, the hash cannot be retrieved and the system boots to Recovery Mode, not to the USB drive. For that reason alone, there is not much use for a bootable external installer. I can't think of a situation where one would be needed, if it could be booted. So what do we do when the system gets corrupted by something? (Either malware or our own incompetence, or just random luck.) Well, as I said if the hash doesn't match, the system boots to recovery mode. The Seal version is then used to "reinstall" the OS, in which case it goes through the hashing process to generate a new master hash, check that against the Apple signature, and only if it matches create a new snapshot of the system for the boot process. There are ways to disable some of the security Apple built in. SIP can still be turned off, for example, but if any changes are made that affect the Seal value, when it boots it won't match the Apple signature for that OS and stop. So, in a practical sense, if the system boots, the system files are in perfect condition. If it won't, reinstalling probably won't fix it. If the internal "drive" fails, the files can't be checked and the system won't boot at all.But you CAN boot from an external drive if the internal storage is functional. How is that possible with all of this Seal stuff? Well, to get to the bootable drives on an Mx system you press and hold the power button until you see the "Loading startup options" appear. Then select the boot disk you want and click Continue. On the next restart, that disk will be the boot disk. Note that you can only set it if the internal drive is functional because the low-level boot (LLB) process checks the Seal before you get to the options. But when you point to some other drive as the desired boot drive, the Seal value for THAT drive is calculated and stored. In BS, that value was stored in the metadata on the internal storage, but I have read that with Monterey it is now stored on the external drive in the metadata. If that's true, what that means is that you can move an external boot drive from one Mx Mac to another, set it as the boot drive as described, and boot from it and the hash on the external won't need to be recalculated twice (once to certify, again in the LLB process). In either case, on the next boot the external will be the boot drive. Again, the LLB will check the internal hash, then the external hash and then boot, so the internal still needs to be functional to boot the external. How might one use that external boot process? How about for beta testing? You get the beta version, install to an external, set it as a boot drive and then boot from it. Play around, test, do whatever you want/need to do, then set the internal drive as the boot drive again and reboot to exit the beta. You can use the System Preferences "Startup Disk" option to see the boot drive to get back easier. OK, lots of words so I'll stop there.</blockquote>

Verification: Name this item 🌈