Apple released a new platform security guide today. [1] According to that, there is a "fallback recovery OS" that can be accessed if you "[f]rom a shutdown state, double-press and hold the power button." I wonder if this one works if you zero the disk.
It also answers my question about the distinction between OS recovery and 1TR:
> Note: Apple uses the term One True recoveryOS (1TR) to indicate a boot into the primary recoveryOS which is achieved using a physical power button press. This is different from a normal recoveryOS boot, which can be achieved using NVRAM or which may happen when errors occur on startup. The physical button press increases trust that the boot environment isn’t reachable by a software-only attacker who has broken into macOS.
Yeah, that's the right way to do it. You can do it without FileVault enabled, too. Enter `resetpassword` in Terminal, and the Erase Mac option is in the menu bar.
I'll grant that this is poorly documented and not intuitive in the least. A secure erase and reinstall is a common task. It shouldn't require an obscure menu bar option or the use of Terminal.
By the way, how do you get into OS recovery (not 1TR)? `man bputil` does allude to a distinction between the two, as you mention:
> Boot environment requirements: software-launched macOS Recovery or 1TR.
The only way I know of to get to any recovery mode is by holding down the power button, which the man page says is 1TR (though I know you mention seeing that boot into regular recovery anyway).
From what I can tell, Internet Recovery (which downloaded a recovery OS) is gone and replaced by 1TR which is stored on a hidden flash partition. 1TR is capable of downloading the OS and installing it, so in a way it can be considered the replacement for Internet Recovery.
While architecturally simpler (and probably more secure by allowing the network stack to be removed from the low-level boot infrastructure?), the disadvantage is that you can mess up the 1TR partition. If you do, the only way to recover the machine is to do a DFU restore from another Mac via Apple Configurator. That's not terribly convenient if you don't have another Mac around. (An Apple Store can DFU restore for you, but last I checked Apple Stores are appointment-only due to COVID and it's almost impossible to get an appointment there these days.)
> Additionally, the SEP data is stored separately from the OS (in one of the volumes of the first container). To wipe that, after wiping the partition and before reinstalling, run `xartutil --erase-all`.
I believe the "Erase Mac" function in Recovery Assistant also erases the SEP data, based on the output of `xartutil --list` before and after. If I'm correct about that, going through Recovery Assistant should be the recommended way to fully erase an M1 Mac (short of a DFU restore through Apple Configurator which also restores firmware).
On T2 Macs, `xartutil --erase-all` would wipe all SEP data, including the encryption keys used for the drive. In other words, it was the equivalent of a secure erase and was my recommended way to fully erase a Mac before resale. I suspect Recovery Assistant is just doing the equivalent of `xartutil --erase-all`, but I haven't tried `xartutil --erase-all` on an M1 because I'm afraid to brick the machine to the point of needing a DFU restore, and I don't have another Mac at hand to run Apple Configurator with right now.
I agree that disk management of M1 Macs is poorly documented, but the author's issue appears to stem from:
> Nope, this don’t work as I suspected… so, let’s check online, Apple suggests a long procedure and a short by typing “resetpassword” in terminal, that was a chance but since it founds no users, there’s no passwords to reset.
"resetpassword" opens Recovery Assistant. Recovery Assistant is primarily intended to provide a "forgot password" flow, which is why it wants to identify a user. However, in the app menu bar, there is an option called "Erase Mac." That is how you do a full secure erase of an M1 Mac. It will work without any user, and even without any OS install at all. (I have tested this myself by erasing a machine multiple times without reinstalling the OS.)
It also answers my question about the distinction between OS recovery and 1TR:
> Note: Apple uses the term One True recoveryOS (1TR) to indicate a boot into the primary recoveryOS which is achieved using a physical power button press. This is different from a normal recoveryOS boot, which can be achieved using NVRAM or which may happen when errors occur on startup. The physical button press increases trust that the boot environment isn’t reachable by a software-only attacker who has broken into macOS.
[1] https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...