> On a technical level, you can't install third party OSs without accepting the EULA first.

You absolutely can (no EULA when booting into recovery partition), and I’m also fairly sure that acceptance would be legally void, as it only applies to the software. The hardware you own, it’s not licensed to you.

And thanks to the first sale doctrine, there’s nothing stopping someone from starting to sell M1/M2 MacBooks running Asahi commercially.

I base this upon what I read in OP. From OP:

> You do have to click through Apple's EULA in order to use the machines at all.

> Owner control is asserted on first boot (you become machine owner by going through the macOS setup flow and creating the first admin user).

> The SEP maintains a database of machine owner users. The first such user is created when the user goes through the macOS boot flow on first startup from a factory-fresh state (or after a full DFU wipe). Subsequent machine owners can only be created by authenticating with an existing owner's credentials.

> Permissive Security allows for ~all security features to be disabled, and third-party kernels to be installed. No phoning home is required. Downgrading to Permissive Security requires booting in 1TR paired to the specific OS involved, and authenticating using machine owner credentials.

It seems to me that you can boot into the recovery partition but in order to be able to boot Linux, you need to authenticate using machine owner credentials, which you only get if you go through setup of the OS, for which you need to accept the EULA. However, on the good news front, OP also writes that no internet access is required for any of these steps.

"On a technical level..."

Sorry, what? Does buying a device from Apple contractually oblige me to turn on the phone and agree to the EULA on "first run"? What about second hand markets?

What if I was smart / tooled up enough to replace the Iphone flash storage with my own OS (without running "first run")?

At what "technical level" would what your saying make any sense? Because it seems far more like a "contractual condition of purchase" (I appear to have made that term up) issue vs a "technical" issue to me.

By technical level I meant that the security chip only allows admin users to change the security level to one that allows booting linux, and in order to create admin users, you need to accept the EULA. Also see my reply to your sibling comment.

How much this mechanism enforced by the SEP can be circumvented with physical access by e.g. desoldering some components and replacing them with alternatives, I don't know. If the SEP is located on the main M1 SoC, you will probably have a hard time though.

Also note that this thread is talking about laptops, not phones.

> By technical level I meant that the security chip only allows admin users to change the security level to one that allows booting linux, and in order to create admin users, you need to accept the EULA

Hmm, again a "theory" - its a software limit not a hardware one. If I could pwn apples root account that statement would not hold true (I dont write exploits against Apple, I dont know what's "state of the art").

My initial comment was to point out the fact "at a technical level" is a silly comment, at a "technical level" there is likely to always be > 0 vulnerabilities so you are wrong (hence current Apple root access on Iphones through "jail breaking")

> Also note that this thread is talking about laptops, not phones.

Ironically Iphone is probably harder than a laptop, I moved the goal posts against myself (see latest M1/M2 kernel upstream work as evidence of that) - which I appreciate is annoying, so sorry for that!