We generally assume that we could roll back an Apple silicon Mac if an update/upgrade goes sideways thanks to TM. And that makes sense, since (apart from firmware) we’re basically talking about reverting the System volume to the state of the pre-update SSV, no big deal. But that got me thinking about updates like the currently available Safari 26.0.1. That’s IIRC installed on the Data volume so would rolling that back be carried out and work just the same as say Tahoe to Sequoia?
To make matters worse, thinking about this I realized I’m not sure about the exact procedure with Apple silicon anymore, even when it comes to just reverting the System partition. It’s been so long since I’ve had to do this (there is a reason I like to read reviews and usually wait till I upgrade). Conventional advice (something like eg. this) is boot into recovery and there use Restore from TM to revert to a snapshot from right before the update. Now, obviously that on Apple silicon is not a true 100% rollback, since that doesn’t take care of firmware (that would require DFU and hence nuking the entire Mac), but that aside, wouldn’t Restore from TM require that no newer system be present on the destination volume? And if so, doesn’t that mean the System partition needs to be nuked first?
And if so, can that be done through recovery mode’s Disk Utility formatting just the System? Usually, these days, the advice is to use the convenient Erase All Content and Settings (advice as in eg. here and here). Now, while I’m sure that will work, it also means that you have then thoroughly wiped your Mac: it’s been removed from all your sign-ins, your TouchID/SecureEnclave data has been wiped along with Wallet and FMM, your favorite wifi gone, BT devices all forgotten, etc. So all of that stuff that you’re really not trying to get rid of (in this case only, reselling a Mac of course you want that gone) is gone. And it all needs to be set up again which now sounds like you have almost got yourself into as much work as if you had just gone straight into DFU mode, nuked the whole Mac, and set it up again from scratch, only that at least this way, you actually restored the Mac’s old firmware too, thus making this a true rollback (something Intel Macs, even those with T2 cannot do).
So, bottom line, is a Safari update (or anything else that happens to live on Data rather than come from the SSV) rolled back just the same as say Tahoe? And if so, is there really no easier way to do this than essentially nuke and pave in spite of beautiful SSV and TM backups?
I believe it’s a little more complicated than that. IIRC, Safari updates are installed via a cryptex on the Preboot volume which loads before the Data volume is mounted.
The bigger question is, of course, how to downgrade. As one might expect, Howard Oakley has an article on the options:
If you just want to back out of Safari, it seems like the cryptex architecture would allow for that, but I don’t recall seeing an article that discusses reverting to a previous version of a cryptex or deleting one entirely.
I have a suspicion that a “nuke and pave” operation might be the safest choice for any downgrade of an Apple software product on Apple Silicon.
Howard’s take doesn’t really answer the questions I had above, but he does seem to indicate that a bootable installer presents a viable route without requiring a complete nuke and pave. That’s good advice for sure.
I did this on my 2018 mini. I downloaded the installer then ran its embedded createinstallmedia script to make a bootable thumb drive. After booting it, you end up in a Recovery Mode OS booted from that thumb drive. From there, you can do whatever Recovery Mode can do, including run disk Utility (to wipe partitions) and run the macOS installer, which will install the version from that thumb drive.
Note that it can’t downgrade a system. If you want to do that, you need to blow away your System volume and then run the installer. And there’s no guarantee that the content of your Data volume will be compatible with the older OS, so you really should delete that as well. Then reinstall and migrate your data.
If you’re reinstalling the version of macOS that was used to make your backup, then that should restore everything.
If you’re trying to migrate from a backup made from a newer version of macOS, it might not work - you may have to migrate from an older backup and then restore your documents only from the newer backup. Which really is nuke-and-pave.
Well, the case for discussion here is rollback from a recent update, so we’re always talking about installing an older system over a newer system. OTOH the Data partition should be fine either way. Either because it is or because it’s restored from backup.
Also, things do work quite a bit different on Apple silicon (for example, you never truly boot from the “bootable” installer), so let’s focus on Apple silicon processes and not drag in older Intel systems. (or just start a new thread for those)
The system of firmlinks between the system and data partition is the issue. This is why (for example), you can’t just clone a system volume to a new computer, even if the contents are identical - the firmlinks to the data volume won’t be there.
If you blow away the system volume and leave the data volume in place, and install the same version of macOS, that should work. At least it has worked for me. The installer should (re-)create the necessary firmlinks.
If you blow away the system volume and install a different version of macOS, then it’s much less certain. I would like to think it would work (I did this to roll-back a 10.15 system to 10.14). The big concern will be the same one you get using any kind of rollback - that data in your Library directory may have been migrated forward and may no longer be compatible with the software from the old release.
So it’s a risk, but may work.
If you blow away the Data partition and don’t restore the Libraries, then this won’t be an issue. But you may have to reinstall/reconfigure some apps and system services.
The procedure for using a bootable installer is the same either way. The only difference is how you tell the computer to boot from the flash drive. Once that starts, you still end up in a flash-drive-booted Recovery OS, from where you can do what you need to do.
The fact that the pre-boot loader runs from your internal SSD is really irrelevant in this context.
There’s a lot more differences, so I want this thread to stay on Apple silicon.
Cloning obviously doesn’t work, but that’s not at issue here anyway. The installer has been tweaked (at least in newer versions) to preserve (and even recreate) firmlinks to the Data partition when necessary. The real issue is when exactly that breaks, because certainly there are well documented cases where rejoining doesn’t work and yoiu end up woth orphaned volumes. We can speculate all day long, but I was really hoping somebody might chime in with actual hands-on experience or a link to a report of such. But perhaps I just need to go waste a day to check this out myself—buy a MBA and an extra TM disk, play around with these things, and then return the MBA within the 14 day window. The hardware is the easy part, finding that extra day to play around would be the hard part.