Add PolicyKit policy configuration that authorizes gameboot launchers (desktop entries) to execute /usr/local/bin/fws-gameboot via pkexec.
The policy allows active users (physically present) to switch to Windows without password prompt since the switch is non-destructive (FWS hibernates and restores the session on return). Remote or inactive sessions require admin authentication.
Add a new SVG icon for the FWS gameboot launcher application. The icon features a gradient blue background with stylized game controller handles and a play triangle, designed as a neutral generic gameboot icon without brand-specific logos.
Add desktop application entry for launching Valorant via gameboot, which hibernates FWS and switches to bare-metal Windows. Includes French and English translations for name, description, and keywords.
Add fws-play-lol.desktop file that provides a graphical launcher for switching to bare-metal Windows to play League of Legends with Vanguard anticheat support. Includes localized French and English labels and descriptions.
Add unattend.offline.xml.tmpl for Windows 11 deployment via fws-windows-deploy.
This offline answer file handles specialize and oobeSystem passes after wimlib
image application. It configures:
- Computer name and locale settings
- BitLocker and OOBE registry tweaks
- Local admin gaming account with temporary auto-login
- FirstBoot PowerShell script execution
Tokens (__HOSTNAME__, __USER__, __DISPLAY__, __LOCALE__, __INPUT__,
__FIRSTBOOT__) are substituted by fws-windows-deploy via sed.
Add a new script that constructs a Windows BCD store offline from Linux using hivex.
The script copies the BCD-Template from Windows and patches string elements.
However, the binary device element encoding (GPT partition info) is not reliably
encoded in this implementation, so the script returns exit code 1 to trigger
fallback to the WinPE-based fws-windows-bcdfix which uses the official bcdboot tool.
Args: ESP_MOUNT WIN_MOUNT WINDOWS_PARTUUID DISK_GUID
Exit codes: 0 = BCD written safely; 1 = fallback to WinPE approach
Add new script to make Windows bootable by executing bcdboot in WinPE launched once via BootNext after FWS installation.
The script:
1. Stages bootable WinPE from ISO (bootmgr + BCD + boot.wim) to ESP
2. Injects automation (winpeshl.ini + fwspe.cmd) into boot.wim boot image
- WinPE finds Windows drive and ESP partition
- Executes bcdboot and reboots
3. Creates UEFI entry with one-shot BootNext to WinPE
Note: Not validated on real hardware. Recommended path: bcdboot writes correct BCD with one automatic WinPE reboot before returning to FWS.
Add fws_windows.glade UI definition for Windows 11 dual-boot configuration screen in Anaconda installer. Implements spoke interface with disk selection, partition size configuration, Windows ISO image selection, and validation feedback. Supports UEFI/TPM 2.0 requirements for kernel-anticheat game compatibility.
Add new FWSWindowsSpoke to handle dual-boot Windows gaming configuration in the Anaconda GUI. This spoke allows users to:
- Enable/disable dual-boot Windows gaming mode
- Select a disk to dedicate to Windows
- Configure NTFS partition size (100-200 GiB default)
- Provide path to Windows 11 ISO
The spoke persists configuration to /tmp/fws-windows for processing by the kickstart script. It implements validation for disk selection, ISO path, and partition size constraints. Platform detection ensures the feature only appears on UEFI systems.
Update documentation to reflect Windows 11 25H2 as the current default version in three locations:
- Initial requirements section
- BitLocker risk mitigation (row 5)
- VBS/Hyper-V validation note (row 11)
These changes align the documentation with the latest Windows 11 release cycle.
Add executable permissions configuration for three new Windows deployment related utilities:
- fws-windows-deploy
- fws-windows-bcdfix
- fws-bcd-write library script
Add support for Secure Boot preparation and Windows dual-boot deployment during Anaconda installation.
- Implement Secure Boot chain preparation using sbctl when Windows gaming dual-boot is selected
- Add Windows deployment phase via fws-windows-deploy in nochroot post-installation hook
- Include safety checks: literal file inspection to prevent code injection, fail-closed guards
- Deployment is non-blocking: failures don't prevent FWS from booting
- Add comprehensive comments explaining the Windows spoke integration and deployment flow
Change GRUB bootloader identity from GRUB to FWS to match kickstart configuration.
Add signing of both primary (\EFI\FWS\grubx64.efi) and fallback removable
(\EFI\BOOT\BOOTX64.EFI) boot paths, as these are the paths actually loaded
by the firmware.
Extract GRUB_MODULES to a variable for reuse in both standard and removable
installation commands. Add objdump availability check before attempting SBAT
verification. Add sbat.csv existence check before reinstalling GRUB.
Add packages required for offline Windows gaming dual-boot deployment with Secure Boot support:
- wimlib: for applying Windows install.wim/.esd images
- hivex: for offline BCD and anti-BitLocker modifications
- sbctl/sbsigntools/mokutil: for Secure Boot management
- binutils: for objdump (.sbat) inspection
Note: nvidia driver is conditional and managed separately via fws-setup-hardware.
Clean up residual 'FWS WinPE' boot entries left over from Windows deployment fallback (bcdboot one-shot already consumed). These entries were cluttering the boot menu and needed to be removed during the boot fix process.
Replace terse die message with user-friendly notification before the error.
When Windows Boot Manager entry is not found, first notify the user with
clear instructions about installing gaming Windows and checking UEFI boot
entries before terminating with the technical error message.
Add wimlib, hivex, sbctl, sbsigntools, mokutil, and binutils packages required for dual-boot Windows gaming support and Secure Boot setup. These are universal tools used by fws-windows-deploy and fws-secureboot-setup scripts.
Add installers.json configuration file with official installation sources for Valorant and League of Legends. This file specifies download URLs from Riot's CDN and installation parameters for the game installer script.
Note: URLs are region-specific (EU default) and may require periodic verification as Riot frequently updates these resources.
Add Install-Games.ps1 script that downloads and launches official game installers marked with autoinstall=true in installers.json.
The script:
- Downloads installers from official Riot servers (not redistributed by FWS)
- Supports silent installation via configurable arguments
- Handles TLS 1.2 compatibility for older .NET stacks
- Provides user feedback and error handling for download/launch failures
- Note: Valorant installation requires manual confirmation due to Vanguard kernel driver and mandatory restart
Add PowerShell script to orchestrate first-boot initialization on Windows gaming system.
The script executes on first boot only:
1. Install-FwsGameboot.ps1 for gaming account setup and auto-login
2. Install-Games.ps1 to download and install configured games from official sources
A marker file prevents re-execution on subsequent boots. Idempotent and safe to re-run.
- Add FirstBoot-FwsGameboot.ps1 script for automated first boot setup
- Document Install-Games.ps1 for downloading official Riot game installers
- Add installers.json for managing Riot installer URLs
- Explain why games cannot be pre-bundled (licensing and Vanguard constraints)
- Provide two methods for triggering first boot: autounattend.xml integration and manual execution
- Clarify prerequisites: local admin account, no password, Secure Boot/TPM/VBS-HVCI
- Expand complete flow documentation with first boot step
- Add security reminders about BitLocker and physical access implications
- Reorganize sections for better clarity and structure
Extend the file deployment loop to include installers.json and Install-Games.ps1 files. Add conditional path validation before copying to gracefully handle missing files instead of failing on non-existent paths.
Add games.json configuration file with support for Riot client games (Valorant and League of Legends). This file defines launchable games with their process names and patchline information for fws-gameboot to-windows command.
Add recommended GRUB parameters for faster hibernation and resume:
- hibernation.compressor=lz4 for faster compression with lower CPU overhead
- GRUB_TIMEOUT and GRUB_TIMEOUT_STYLE settings for faster boot experience
These optimizations are particularly beneficial for large swap images (60-90 GB).
Replace hardcoded Valorant launch with flexible game resolution system:
- Add Get-RequestedGame() to read and consume launch.json tokens from all ESP partitions (dual-disk support)
- Add Resolve-RiotClient() to locate Riot Client via RiotClientInstalls.json canonical source instead of hardcoded paths
- Add Start-Game() to support multiple game types (riot, uri, exe) via games.json configuration
- Implement token consume-once pattern to prevent replay of stale launch requests
- Remove scheduled task management (FWS-Return-OnStart) - now handled purely via BootNext assertions
- Add re-assertion of BootNext=Windows after 25s delay to win race against ONSTART task
- Validate requested game against games.json with fallback to valorant
- Improve robustness: handle dual disks, missing tokens, unreadable tokens, and missing processes gracefully
- Update documentation to reflect new auto-launch architecture and admin requirement
Update README to reflect the complete automated game launch flow:
- Clarify that fws-play reads the requested game from launch.json on ESP
- Add games.json registration system allowing users to add custom games
- Document auto-login setup and password handling in installer
- Update workflow steps with auto-login and logon task details
- Add section explaining how to register new games
- Improve clarity on security considerations and boot fallback mechanism
- Refine status notes and technical details for better accuracy
Add ability to specify which game to launch on Windows via --game CLI argument.
- Introduce FWS_DEFAULT_GAME environment variable (defaults to 'valorant')
- Parse --game option in to-windows command to override default
- Sanitize game identifiers using lowercase and allowed chars [a-z0-9_-]
- Write atomic game token (launch.json) to ESP FAT partition for Windows to consume
- Purge stale tokens on write failure to prevent replay of old choices
- Update help text with new option and game identifier constraints
Add FWS_DEFAULT_GAME configuration parameter to specify the default game launched when fws-gameboot to-windows is called without the --game argument. The game identifier must exist in the Windows games.json file (e.g., valorant, lol).
Add a new libalpm hook that automatically re-signs bootloader binaries with sbctl after kernel or GRUB updates. This ensures that Secure Boot remains functional after system updates that modify unsigned binaries.
The hook triggers on updates to kernel, GRUB, and EFI files, and runs sbctl sign-all to maintain signature consistency. This is idempotent and harmless if sbctl has no enrolled keys.
Add PowerShell scripts to manage dual-boot transitions between FWS and Windows 11 for gaming sessions with Valorant.
Includes:
- fws-return.ps1: Arms firmware boot-next (one-shot) to target OS via bcdedit
- fws-play.ps1: Orchestrates Valorant session with robust crash recovery
- Install-FwsGameboot.ps1: Deploys scripts, disables hibernation, creates ONSTART task
- README.md: Documentation on dual-boot workflow and prerequisites
Design principles:
- Minimal footprint, no Vanguard interference (no injection/kernel hooks)
- Permanent fallback: BootOrder[0]=FWS catches unmanaged reboots
- Robust locale-independent bcdedit parsing via EFI paths and GUIDs
- Crash-proof game session: ONSTART task disabled during play to prevent mid-match boot changes
Add a new script that prepares FWS to boot signed under Secure Boot without enabling kernel lockdown, preserving hibernation capability.
The script:
- Checks UEFI firmware availability
- Installs sbctl if needed
- Locates ESP and GRUB EFI binary
- Reinstalls GRUB with SBAT section if missing
- Creates and enrolls sbctl keys while preserving Microsoft keys
- Signs GRUB and available kernel images
- Provides instructions for manual firmware setup steps
- Enables automatic re-signing after kernel/GRUB updates via pacman hooks
This allows FWS to meet Vanguard's Secure Boot requirement without sacrificing hibernation support.
Add boot fix script that executes at every FWS startup to reassert BootOrder[0] = FWS.
This serves as a permanent safety net to handle cases where Windows Update or system crashes might reorder the EFI boot options, ensuring the system always boots into FWS when no explicit BootNext is set, preventing the system from becoming stuck in Windows.
The script is inactive on live systems via ConditionPathExists check.
Implement fws-gameboot, an orchestrator for seamless dual-boot between FWS and Windows
bare-metal using hibernate-swap mechanism. Enables playing kernel anticheat games
(e.g., Valorant/Vanguard) without persistent virtualization by hibernating FWS
to swap, setting BootNext to Windows UEFI one-shot, and rebooting. Upon Windows
shutdown, the kernel resumes the FWS session via resume= parameter.
Features:
- doctor/status subcommand: validates hibernation readiness (swap size, resume=
parameter, VRAM usage, Secure Boot status)
- to-windows subcommand: hibernates FWS, unmounts NTFS filesystems, arms BootNext,
and initiates hibernation; resumes FWS session on return from Windows
- Safety mechanisms: BootOrder[0] fallback to FWS via fws-gameboot-bootfix,
permanent BootNext cleanup on resume, optional simple reboot fallback
- Configuration via /etc/fws/gameboot.conf (Windows boot entry number, swap margin,
hibernation fallback mode)
- User notification via D-Bus notify-send for graphical feedback
- Comprehensive error handling and preflight validation
Requires validated hardware support for NVIDIA GPU hibernation/resume and firmware
BootNext semantics.
Add a new systemd service that reasserts BootOrder=FWS and the Windows boot marker on gameboot systems. This service runs only on installed UEFI systems (not on live media) and is designed to be best-effort without delaying boot. It handles unavailable efivars gracefully by not failing the boot process.
Add gameboot.conf configuration file for the FWS orchestrator. This file defines settings for dual-boot hibernation-swap mode including:
- Windows boot entry detection
- Hibernation preflight failure behavior (reboot or abort)
- Swap margin for hibernation image sizing
See docs/hibernate-swap-dualboot.md for details.
expand explanation of why timeout/watchdog approaches fail for S4 hangs since the process is frozen. document the actual viable mitigations: strict preflight validation, auto-recovery via reset, and BootOrder fallback. add note about testing and post-hang recovery documentation.
Add permission entries for three new executable scripts:
- fws-gameboot
- fws-gameboot-bootfix
- fws-secureboot-setup
All scripts are set with 0:0:755 permissions (owner:group:mode).
Replace hardcoded msdos disklabel with firmware-aware configuration:
- UEFI systems now use GPT, allowing ESP creation for grub-install EFI
- BIOS systems continue using MBR/msdos where core.img fits in post-MBR space
This fixes the bug where forcing msdos on UEFI prevented ESP creation,
resulting in non-bootable installations. The disklabel is now dynamically
generated by a %pre script that detects firmware type and writes the
appropriate clearpart command to /tmp/fws-clearpart.ks for inclusion.
Clarifies that clearpart --all only affects GUI-selected disks, addressing
multi-disk scenarios where users may not want all disks wiped.
Adds comprehensive documentation for FWS Hibernate-Swap Dual-Boot feature, enabling seamless switching between Arch Linux and Windows 11 bare-metal for Valorant gameplay.
Covers:
- System architecture and boot flow with UEFI BootNext
- Hardware prerequisites (RTX 5090, NVMe, TPM 2.0)
- Phased implementation roadmap from disk reconnaissance to end-to-end testing
- Secure Boot integration with sbctl while maintaining hibernation capability
- UEFI boot orchestration and failsafe mechanisms
- Installer integration for both new installations and existing systems
- GPU NVIDIA-specific hibernation handling
- Windows integration via PowerShell scripts for automatic boot target management
- Vanguard anti-cheat compatibility constraints
Add preflight package resolution step in build-offi.sh to validate all profile
packages against pacman repositories before mkarchiso execution. This prevents
'target not found' errors during ISO creation by catching missing packages early
with helpful error messages and recovery instructions.
Introduce fws-dnd package (D&D 5e manager for FWS with GTK4 interface) to the
local package build process in setup-aur.sh. Include PKGBUILD definition and
source tarball.
When package resolution fails, the build now exits with clear feedback pointing
users to run setup-aur.sh to build missing dependencies like fws-dnd.
Add entries for:
- Machine name selection at installation
- Interactive build script with versioning and naming
- systemd-timesyncd explicit activation
- Keyboard layout derivation from full locale
- DNS in build container configuration
Add explicit activation of systemd-timesyncd service to ensure proper clock synchronization on installed systems. This prevents clock drift issues that can affect TLS and pacman operations, and meets user expectations for accurate system time.
The service is already present in the image but inherited symlinks from the live environment may be ordinary files that systemd ignores, so explicit enablement ensures correct behavior on all installations.
nocode
