How do I use erase-install but disable SIP

[aspauldingcode]

Hi,
I use the erase-install tool without mdm.
I want to disable SIP, and keep it disabled. each time I erase and reinstall macos with erase-install, SIP is re-enabled.
How do I tell it to keep it disabled or disable? Can we even do this? can it be implemented?

[grahampugh]

Hi there. It wasn't asked for before, but startosinstall does have an option called --reducedsecurity. I've never tested how it works, so if you'd like to see this implemented in erase-install.sh, please can you do the following.

1. Obtain an Install macOS app on a machine that you want to test this out on, e.g. using erase-install.sh, but don't use the --erase option - just download it.
2. Run the following command to perform the erase:

/Applications/Install\ macOS\ Sequoia.app/Contents/Resources/startosinstall --agreetolicense --eraseinstall --forcequitapps --reducedsecurity

3. Document what happens and post it here.

If it seems to work reasonably and as expected, I'd be prepared to add the --reducedsecurity option to a future version of erase-install.sh

[aspauldingcode]

I couldn't run that command. I needed a method of password entry. So I added the passprompt flag, and after it installed, it seems to have encrypted the disk, and I couldn't unlock it with my password.

In addition, I wasn't able to enter recoveryOS and check the sip status of the volume, because it seems to think there isn't one.

Odd. In addition, I had SIP enabled before I ran this command. I'm going to retry with SIP disabled.

[aspauldingcode]

Odd. In addition, I had SIP enabled before I ran this command. I'm going to retry with SIP disabled.

Same result.

[aspauldingcode]

SIP is still enabled, checking from the booted volume in user space.