I've been trying to install rEFInd with --ownhfs
on my Macbook Air 2019, but booting into it results in Recovery Mode starting with the message
A software update is required to use this Startup Disk.
Trying to accept installing the update either immediately fails or fails after updating for about 5 minutes, with the message
An error occurred installing the update.
Curiously, before installing rEFInd I had both SIP and Secure Boot disabled (No Security) and External Boot enabled so macOS should have no reason to complain about an unverified boot, and yet it does. I haven't been able to find solutions anywhere else (all I can find is the same issue but with reinstalling macOS and Secure Boot enabled). Does anyone know possible workarounds or solutions?
Environment:
- macOS Catalina 10.15.6 on Macbook Air 2019
- rEFInd 0.12.0 from
bin
, installed as--ownhfs
on a 50MBMac OS Extended (Case-sensitive, Journaled)
behindMacintosh HD
- SIP & Secure Boot off, External Boot on
Other notes:
- rEFInd was also reinstalled 2 more times after the first time this happened, but it didn't change anything. rEFInd also had no warnings or errors when installing
- Directly booting from the boot device menu (via Option key on boot) into a portable Windows 10 installation on an external hard drive results in a black screen
- Both rEFInd and the Windows drive displays as
EFI Boot
with an internal and external hard drive icon in the boot device menu, respectively - macOS boots normally without issues
- EFI volume only contains the
APPLE
folder, even after installing rEFInd
Best Answer
Recreating the Problem
Before I provide an answer which explains how to install rEFInd to work properly on a Mac with a T2 chip, I will first incorrectly install rEFInd by following a path similar to the one taken by the OP. I do this because the OP posted a comment stating the following.
I hope this newly edited answer will demonstrate to the OP that I can recreate the problem outlined in OP's question, then provide steps to eliminate the problem.
I am using a 2018 mac mini which has a T2 chip. The Mac is configure with the following setup.
Halibut2
and the labels for the Catalina volumes areAnchovy
andAnchovy - Data
.Mac OS Extended (Case-sensitive, Journaled)
volume with the labelrEFInd
. Therefind-install
script with the--ownhfs
option was used to install rEFInd. Note, when aMac OS Extended (Journaled)
volume is substituted, the results are the same.The output from the command
diskutil list
is shown below.An image of the Mac Startup Manager icons is shown below.
The label
EFI Boot
is used by the Mac Startup Manager when no valid label files exist in the folder containing the boot file. The label files can be created by using the macOSbless
command. However, when a properly installed Windows 10 exists on an internal drive, then the default Mac Startup Manager label isWindows
. The refind-install script does not install a Mac Startup Manager label for rEFInd, therefore the default Mac Startup Manager label will be EFI Boot.When choosing rEFInd from the Mac Startup Manager, the following message box appears.
Both the OP and I installed rEFInd using the
--ownhfs
option. This option installs rEFInd to appear to be OS X. The firmware installed in older Macs would be fooled into thinking rEFInd was OS X and the firmware would boot rEFInd. Evidently, Macs with a T2 chip are still being fooled into thinking a version of OS X is installed, but will not boot rEFInd. As the OP discovered, clicking on theUpdate
button will not solve this problem.Fixing the Problem
Below documents the steps taken to get a properly installed rEFInd.
Boot to macOS. In this case, I choose Catalina.
Use the Disk Utility application to erase the volume with
rEFInd
label. The nameREFIND
and formatMS-DOS (FAT)
were selected. Afterwards, the output from the commanddiskutil list
appeared as shown below.Download rEFInd from this website to my Downloads folder. I downloaded version 0.12.0.
Enter the following commands in a Terminal application window to install rEFInd to the
REFIND
volume.The above commands produced the following output.
Enter the following command to changed the label in the Mac Startup Manager for rEFInd from
EFI Boot
torEFInd
.Restart the mac and immediately hold down the option key until the Mac Startup Manager icons appeared. To make rEFInd the default at startup, hold down the control key while selecting
rEFInd
.After these changes, the Mac correctly boots to rEFInd at startup.
Configuring rEFInd
Below is an cropped image of what was displayed by rEFInd.
This default arrangement also has the following deficiencies.
The two middle icons on the top row, which are shown below, have the same
Boot macOS from Preboot
label. There is no indication which is for Mojave or Catalina. Also, rEFInd is suppose to highlight the previous choice when first displaying the icons. This does not happen when the second icon shown below is selected.The last icon on the top row, which is shown below, has the label
Boot Windows (Legacy) from NTFS volume
. When selected, rEFInd will instruct the firmware to BIOS boot Windows 10. Since all Macs with a T2 chip cannot BIOS boot, clearly this choice is invalid and needs to be eliminated.Two of the icons on the bottom row, which are shown below, have the same
Start Apple Recovery on Recovery
label. There is no indication which is for Mojave or Catalina.UUID's can not be used to specify APFS volumes in the
refind.conf
file. Also, the APFS volume labels are not recognized by thedont_scan_dirs
option.Below outlines additions made to the
refind.conf
file to remedy the above and other possible deficiencies. This file can be found in theEFI/BOOT
folder on theREFIND
volume. The additions need be placed at the end of this file.Reduce the changes of a label (name) conflict. By default, a bootable APFS containers have two hidden volumes with the labels "Preboot" and "Recovery". If a external drive with a bootable APFS container was plugged in to the Mac, then the duplicate labels could cause a conflict. To help prevent this from occurring, these labels need to be made more unique. In this case, the "Preboot" and "Recovery" labels will be changed to "Internal Preboot" and "Internal Recovery", respectively. For my Mac, the commands to rename these volumes is given below. These commands need to entered in a Terminal application window.
Add the following line to the end of the
refind.conf
file. This option causes rEFInd to store rEFInd specific variables in theEFI/BOOT/vars
folder of theREFIND
volume instead of NVRAM. This is done to avoid possible wear on the NVRAM,Add the following line to the end of the
refind.conf
file to set the System Integrity Protect (SIP) values to enable and disable. This file can be found in theEFI/BOOT
folder on theREFIND
volume.Add the following line to the end of the
refind.conf
file to set which tool icons to appear on the rEFInd display.Even though specified, the follows tools icons will not appear for the following reasons.
shell
: Noshellx64.efi
file exists in in theEFI/tools
folder. See the Installing Additional Components section of the Installing rEFInd page for pointers to acquiring this file. This file did work on my 2018 mac mini.gdisk
: Nogdiskx64.efi
file exists in theEFI/tools
folder. See the Installing Additional Components section of the Installing rEFInd page for pointers to acquiring this file. This file did not work on my 2018 mac mini.memtest
: No file exists in an acceptable folder. See the Installing Additional Components section of the Installing rEFInd page for pointers to acquiring this file. No file was ever tested on my 2018 mac mini.apple_recovery
: The two macOS Recovery boot files were skipped because twodont_scan_tools
options were placed in therefind.conf
file.windows_recovery
: The Boot Camp Assistant installed the Windows Recovery Environment (WRE) files inside theBOOTCAMP
volume. No WRE partition was created, therefore rEFInd has no volume to scan.Adding following option to the end of the
refind.conf
file will instruct rEFInd to not search for BIOS boot loaders.Replace any automatically created menu entries for Mojave and Catalina with manual entries. First, commands need to executed to determine the UUID for the Catalina APFS volume and Mojave APFS volume. For my Mac, the following commands were entered in a macOS Terminal application window. You will need to make the appropriate substitutions for the identifiers and resulting UUIDs.
For my Mac, the output from these commands is summarized below.
Based on the above UUIDs, the following lines were be added to the end of the
refind.conf
file.Prevent rEFInd from scanning the EFI volume for Windows boot files and create a manual entry for Windows. First, a command needs to executed to determine the UUID for the EFI volume. For my Mac, the following command was entered in a macOS Terminal application window. You will need to make the appropriate substitutions for the identifier and resulting UUID.
For my Mac, the output from this command is summarized below.
Based on the above UUID, the following lines were be added to the end of the
refind.conf
file.Replace any automatically created menu entries for Mojave and Catalina macOS Recovery with manual entries. Here, the previous determined UUIDs can be use. You will need to make the appropriate substitutions for the identifiers and resulting UUIDs. Based on the UUIDs, the following lines were be added to the end of the
refind.conf
file.Below is a entire copy of the lines added to the end of the
refind.conf
file.Below is an cropped image of what was displayed by rEFInd after adding the above lines.
The label for each icon is given below.
Other Thoughts
The options could be simplified. First, a command needs to executed to determine the UUID for the APFS container. For my Mac, the following command was entered in a macOS Terminal application window. You will need to make the appropriate substitutions for the identifier and resulting UUID.
For my Mac, the output from this command is summarized below.
Next, the options
can be replace by the single option
without changing the result. Basically, the change causes rEFInd to omit a search of the entire APFS container. This may result in a fast boot time to the rEFInd display.
The above could be improved on by replacing the options
with the single option
which also would not change the result. Basically, this change causes rEFInd to omit a search of the entire internal drive. This may result in an even faster boot time to the rEFInd display.
The rEFInd Boot Manager can also be installed to an ExFAT volume. Currently,
refind-install
will not permit this, so you would have to do a manual install. I verified installing rEFInd to a ExFAT volume does work, except I needed to renametool_rescue.png
torescue.png
. In other words, rEFInd will not accept long file names for theicon
option when installed to an ExFAT volume.Installing rEFInd to a FAT volume is a security risk. Since no password (or other security means) is required to access the volume where rEFInd is installed, malicious software could change the rEFInd files. One way to help prevent this from happening would be to change the partition type to EFI. This can be done in Windows by using the
gdisk
ordiskpart
command and in Linux by using thegdisk
command. Thegdisk
orgpt
command can be used in macOS, but this may require disabling SIP and/or booting to macOS Recovery. Note: After rEFInd is installed, SIP can be disabled by rEFInd, thus avoiding the need to boot to macOS Recovery. You can enable SIP from macOS by entering the commandsudo csrutil clear
.