Add support for injecting Intel VMD drivers into WinPE environment via a new DRV parameter. This enables proper NVMe device detection during Windows PE boot and installation.
Changes:
- Accept optional 5th parameter (DRV) for driver directory path
- Embed driver files into WinPE boot image via drvload command
- Register driver in target Windows installation via DISM
- Copy driver directory into boot.wim fwsdrv folder for accessibility
Add PolicyKit policy configuration that authorizes gameboot launchers (desktop entries) to execute /usr/local/bin/fws-gameboot via pkexec.
The policy allows active users (physically present) to switch to Windows without password prompt since the switch is non-destructive (FWS hibernates and restores the session on return). Remote or inactive sessions require admin authentication.
Add a new SVG icon for the FWS gameboot launcher application. The icon features a gradient blue background with stylized game controller handles and a play triangle, designed as a neutral generic gameboot icon without brand-specific logos.
Add desktop application entry for launching Valorant via gameboot, which hibernates FWS and switches to bare-metal Windows. Includes French and English translations for name, description, and keywords.
Add fws-play-lol.desktop file that provides a graphical launcher for switching to bare-metal Windows to play League of Legends with Vanguard anticheat support. Includes localized French and English labels and descriptions.
Add unattend.offline.xml.tmpl for Windows 11 deployment via fws-windows-deploy.
This offline answer file handles specialize and oobeSystem passes after wimlib
image application. It configures:
- Computer name and locale settings
- BitLocker and OOBE registry tweaks
- Local admin gaming account with temporary auto-login
- FirstBoot PowerShell script execution
Tokens (__HOSTNAME__, __USER__, __DISPLAY__, __LOCALE__, __INPUT__,
__FIRSTBOOT__) are substituted by fws-windows-deploy via sed.
Add a new script that constructs a Windows BCD store offline from Linux using hivex.
The script copies the BCD-Template from Windows and patches string elements.
However, the binary device element encoding (GPT partition info) is not reliably
encoded in this implementation, so the script returns exit code 1 to trigger
fallback to the WinPE-based fws-windows-bcdfix which uses the official bcdboot tool.
Args: ESP_MOUNT WIN_MOUNT WINDOWS_PARTUUID DISK_GUID
Exit codes: 0 = BCD written safely; 1 = fallback to WinPE approach
Add new script to make Windows bootable by executing bcdboot in WinPE launched once via BootNext after FWS installation.
The script:
1. Stages bootable WinPE from ISO (bootmgr + BCD + boot.wim) to ESP
2. Injects automation (winpeshl.ini + fwspe.cmd) into boot.wim boot image
- WinPE finds Windows drive and ESP partition
- Executes bcdboot and reboots
3. Creates UEFI entry with one-shot BootNext to WinPE
Note: Not validated on real hardware. Recommended path: bcdboot writes correct BCD with one automatic WinPE reboot before returning to FWS.
Add executable permissions configuration for three new Windows deployment related utilities:
- fws-windows-deploy
- fws-windows-bcdfix
- fws-bcd-write library script
Add support for Secure Boot preparation and Windows dual-boot deployment during Anaconda installation.
- Implement Secure Boot chain preparation using sbctl when Windows gaming dual-boot is selected
- Add Windows deployment phase via fws-windows-deploy in nochroot post-installation hook
- Include safety checks: literal file inspection to prevent code injection, fail-closed guards
- Deployment is non-blocking: failures don't prevent FWS from booting
- Add comprehensive comments explaining the Windows spoke integration and deployment flow
Change GRUB bootloader identity from GRUB to FWS to match kickstart configuration.
Add signing of both primary (\EFI\FWS\grubx64.efi) and fallback removable
(\EFI\BOOT\BOOTX64.EFI) boot paths, as these are the paths actually loaded
by the firmware.
Extract GRUB_MODULES to a variable for reuse in both standard and removable
installation commands. Add objdump availability check before attempting SBAT
verification. Add sbat.csv existence check before reinstalling GRUB.
Add packages required for offline Windows gaming dual-boot deployment with Secure Boot support:
- wimlib: for applying Windows install.wim/.esd images
- hivex: for offline BCD and anti-BitLocker modifications
- sbctl/sbsigntools/mokutil: for Secure Boot management
- binutils: for objdump (.sbat) inspection
Note: nvidia driver is conditional and managed separately via fws-setup-hardware.
Clean up residual 'FWS WinPE' boot entries left over from Windows deployment fallback (bcdboot one-shot already consumed). These entries were cluttering the boot menu and needed to be removed during the boot fix process.
Replace terse die message with user-friendly notification before the error.
When Windows Boot Manager entry is not found, first notify the user with
clear instructions about installing gaming Windows and checking UEFI boot
entries before terminating with the technical error message.
Add installers.json configuration file with official installation sources for Valorant and League of Legends. This file specifies download URLs from Riot's CDN and installation parameters for the game installer script.
Note: URLs are region-specific (EU default) and may require periodic verification as Riot frequently updates these resources.
Add Install-Games.ps1 script that downloads and launches official game installers marked with autoinstall=true in installers.json.
The script:
- Downloads installers from official Riot servers (not redistributed by FWS)
- Supports silent installation via configurable arguments
- Handles TLS 1.2 compatibility for older .NET stacks
- Provides user feedback and error handling for download/launch failures
- Note: Valorant installation requires manual confirmation due to Vanguard kernel driver and mandatory restart
Add PowerShell script to orchestrate first-boot initialization on Windows gaming system.
The script executes on first boot only:
1. Install-FwsGameboot.ps1 for gaming account setup and auto-login
2. Install-Games.ps1 to download and install configured games from official sources
A marker file prevents re-execution on subsequent boots. Idempotent and safe to re-run.
- Add FirstBoot-FwsGameboot.ps1 script for automated first boot setup
- Document Install-Games.ps1 for downloading official Riot game installers
- Add installers.json for managing Riot installer URLs
- Explain why games cannot be pre-bundled (licensing and Vanguard constraints)
- Provide two methods for triggering first boot: autounattend.xml integration and manual execution
- Clarify prerequisites: local admin account, no password, Secure Boot/TPM/VBS-HVCI
- Expand complete flow documentation with first boot step
- Add security reminders about BitLocker and physical access implications
- Reorganize sections for better clarity and structure
Extend the file deployment loop to include installers.json and Install-Games.ps1 files. Add conditional path validation before copying to gracefully handle missing files instead of failing on non-existent paths.
Add games.json configuration file with support for Riot client games (Valorant and League of Legends). This file defines launchable games with their process names and patchline information for fws-gameboot to-windows command.
Replace hardcoded Valorant launch with flexible game resolution system:
- Add Get-RequestedGame() to read and consume launch.json tokens from all ESP partitions (dual-disk support)
- Add Resolve-RiotClient() to locate Riot Client via RiotClientInstalls.json canonical source instead of hardcoded paths
- Add Start-Game() to support multiple game types (riot, uri, exe) via games.json configuration
- Implement token consume-once pattern to prevent replay of stale launch requests
- Remove scheduled task management (FWS-Return-OnStart) - now handled purely via BootNext assertions
- Add re-assertion of BootNext=Windows after 25s delay to win race against ONSTART task
- Validate requested game against games.json with fallback to valorant
- Improve robustness: handle dual disks, missing tokens, unreadable tokens, and missing processes gracefully
- Update documentation to reflect new auto-launch architecture and admin requirement
Update README to reflect the complete automated game launch flow:
- Clarify that fws-play reads the requested game from launch.json on ESP
- Add games.json registration system allowing users to add custom games
- Document auto-login setup and password handling in installer
- Update workflow steps with auto-login and logon task details
- Add section explaining how to register new games
- Improve clarity on security considerations and boot fallback mechanism
- Refine status notes and technical details for better accuracy
Add ability to specify which game to launch on Windows via --game CLI argument.
- Introduce FWS_DEFAULT_GAME environment variable (defaults to 'valorant')
- Parse --game option in to-windows command to override default
- Sanitize game identifiers using lowercase and allowed chars [a-z0-9_-]
- Write atomic game token (launch.json) to ESP FAT partition for Windows to consume
- Purge stale tokens on write failure to prevent replay of old choices
- Update help text with new option and game identifier constraints
Add FWS_DEFAULT_GAME configuration parameter to specify the default game launched when fws-gameboot to-windows is called without the --game argument. The game identifier must exist in the Windows games.json file (e.g., valorant, lol).
Add a new libalpm hook that automatically re-signs bootloader binaries with sbctl after kernel or GRUB updates. This ensures that Secure Boot remains functional after system updates that modify unsigned binaries.
The hook triggers on updates to kernel, GRUB, and EFI files, and runs sbctl sign-all to maintain signature consistency. This is idempotent and harmless if sbctl has no enrolled keys.
Add PowerShell scripts to manage dual-boot transitions between FWS and Windows 11 for gaming sessions with Valorant.
Includes:
- fws-return.ps1: Arms firmware boot-next (one-shot) to target OS via bcdedit
- fws-play.ps1: Orchestrates Valorant session with robust crash recovery
- Install-FwsGameboot.ps1: Deploys scripts, disables hibernation, creates ONSTART task
- README.md: Documentation on dual-boot workflow and prerequisites
Design principles:
- Minimal footprint, no Vanguard interference (no injection/kernel hooks)
- Permanent fallback: BootOrder[0]=FWS catches unmanaged reboots
- Robust locale-independent bcdedit parsing via EFI paths and GUIDs
- Crash-proof game session: ONSTART task disabled during play to prevent mid-match boot changes
Add a new script that prepares FWS to boot signed under Secure Boot without enabling kernel lockdown, preserving hibernation capability.
The script:
- Checks UEFI firmware availability
- Installs sbctl if needed
- Locates ESP and GRUB EFI binary
- Reinstalls GRUB with SBAT section if missing
- Creates and enrolls sbctl keys while preserving Microsoft keys
- Signs GRUB and available kernel images
- Provides instructions for manual firmware setup steps
- Enables automatic re-signing after kernel/GRUB updates via pacman hooks
This allows FWS to meet Vanguard's Secure Boot requirement without sacrificing hibernation support.
Add boot fix script that executes at every FWS startup to reassert BootOrder[0] = FWS.
This serves as a permanent safety net to handle cases where Windows Update or system crashes might reorder the EFI boot options, ensuring the system always boots into FWS when no explicit BootNext is set, preventing the system from becoming stuck in Windows.
The script is inactive on live systems via ConditionPathExists check.
Implement fws-gameboot, an orchestrator for seamless dual-boot between FWS and Windows
bare-metal using hibernate-swap mechanism. Enables playing kernel anticheat games
(e.g., Valorant/Vanguard) without persistent virtualization by hibernating FWS
to swap, setting BootNext to Windows UEFI one-shot, and rebooting. Upon Windows
shutdown, the kernel resumes the FWS session via resume= parameter.
Features:
- doctor/status subcommand: validates hibernation readiness (swap size, resume=
parameter, VRAM usage, Secure Boot status)
- to-windows subcommand: hibernates FWS, unmounts NTFS filesystems, arms BootNext,
and initiates hibernation; resumes FWS session on return from Windows
- Safety mechanisms: BootOrder[0] fallback to FWS via fws-gameboot-bootfix,
permanent BootNext cleanup on resume, optional simple reboot fallback
- Configuration via /etc/fws/gameboot.conf (Windows boot entry number, swap margin,
hibernation fallback mode)
- User notification via D-Bus notify-send for graphical feedback
- Comprehensive error handling and preflight validation
Requires validated hardware support for NVIDIA GPU hibernation/resume and firmware
BootNext semantics.
Add a new systemd service that reasserts BootOrder=FWS and the Windows boot marker on gameboot systems. This service runs only on installed UEFI systems (not on live media) and is designed to be best-effort without delaying boot. It handles unavailable efivars gracefully by not failing the boot process.
Add gameboot.conf configuration file for the FWS orchestrator. This file defines settings for dual-boot hibernation-swap mode including:
- Windows boot entry detection
- Hibernation preflight failure behavior (reboot or abort)
- Swap margin for hibernation image sizing
See docs/hibernate-swap-dualboot.md for details.
Add permission entries for three new executable scripts:
- fws-gameboot
- fws-gameboot-bootfix
- fws-secureboot-setup
All scripts are set with 0:0:755 permissions (owner:group:mode).
Replace hardcoded msdos disklabel with firmware-aware configuration:
- UEFI systems now use GPT, allowing ESP creation for grub-install EFI
- BIOS systems continue using MBR/msdos where core.img fits in post-MBR space
This fixes the bug where forcing msdos on UEFI prevented ESP creation,
resulting in non-bootable installations. The disklabel is now dynamically
generated by a %pre script that detects firmware type and writes the
appropriate clearpart command to /tmp/fws-clearpart.ks for inclusion.
Clarifies that clearpart --all only affects GUI-selected disks, addressing
multi-disk scenarios where users may not want all disks wiped.
Add explicit activation of systemd-timesyncd service to ensure proper clock synchronization on installed systems. This prevents clock drift issues that can affect TLS and pacman operations, and meets user expectations for accurate system time.
The service is already present in the image but inherited symlinks from the live environment may be ordinary files that systemd ignores, so explicit enablement ensures correct behavior on all installations.
Convert three systemd service configuration files from regular files to symlinks pointing to their respective system libraries. This ensures that the services reference the actual systemd unit files from /usr/lib/systemd/system rather than maintaining duplicate copies.
Add PolicyKit authorization policy file to allow fws-recovery-gui to execute fws-recovery engine via pkexec with administrative privileges. The policy uses auth_admin_keep to require authentication only once per session.
Add a new scalable SVG icon for FWS recovery application featuring a medical cross symbol in FWS brand colors (blues) on a dark background. Icon is placed in the standard hicolor scalable apps directory.
Add desktop entry file for FWS Recovery application launcher in the installed OS. Provides bilingual (French/English) interface for system repair operations including GRUB, initramfs, and pacman restoration. The application runs as a regular user with privilege escalation handled via pkexec.
Add a new script that launches an X session with Openbox and the fws-recovery-gui application. This script is executed by startx during the FWS repair boot entry, providing a minimal graphical environment with Openbox as a fallback if the GUI crashes.
Implement a graphical interface for the FWS system recovery tool using GTK3.
Features:
- Scans for FWS installations on disk
- Provides action buttons for common repairs: GRUB reinstall, initramfs
regeneration, pacman repair, and full system repair
- Displays real-time engine output in a log viewer
- Supports both root session (live mode) and regular user (pkexec elevation)
- Includes terminal access (chroot) for manual diagnostics
- Offers system reboot/poweroff controls
The GUI replaces Arch Linux branding with FWS in output for consistency
while preserving technical identifiers (package names, file paths) for
accurate diagnostics.
Enable compressed swap in RAM (zram) for the live environment to prevent memory saturation issues on systems with limited RAM. This configuration provides necessary headroom during Anaconda installation by leveraging zram's ~3:1 compression ratio on Python heaps. The configuration is automatically copied to installed systems via LiveOS payload, maintaining this safety net post-installation on modest hardware.
Add new systemd target unit for FWS system recovery mode. This target is invoked via GRUB boot menu entry "Reparer FWS" and provides a multi-user environment with network access plus recovery session. The service includes proper dependency management to ensure getty@tty1 is properly handled.
Add systemd service unit for FWS system recovery boot mode. This service handles recovery session initialization on tty1 with fallback from GUI (via startx/openbox) to console assistant if graphical startup fails. The service is only activated via fws-recovery.target kernel command line parameter and does not interfere with normal boot processes.
Add a new GRUB menu entry script that provides system recovery functionality.
The script generates a 'Réparer FWS (récupération du système)' menu entry that boots the system into fws-recovery.target with the fws.recovery=1 marker. This allows the recovery application to launch and perform system repairs via GUI or console fallback.
The script uses the fallback initramfs for maximum hardware compatibility during recovery operations, matching the UUID-based root detection logic of the standard 10_linux script.
nocode
