28allday
3dc211a7a1
Patches the Omarchy ISO to install alongside Windows with a firmware-proof Limine-first boot (bootmgfw spoof), LUKS2 encryption, and btrfs snapshots. Includes repair mode for re-applying Limine after a Windows feature update. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1371 lines
52 KiB
Bash
Executable file
1371 lines
52 KiB
Bash
Executable file
#!/bin/bash
|
|
#===============================================================================
|
|
# PATCH OMARCHY ISO FOR DUAL-BOOT
|
|
#
|
|
# This version hooks into the original Omarchy installer (archinstall)
|
|
# We just handle partitioning, then let archinstall do everything else
|
|
#
|
|
# Usage: sudo ./patch-omarchy-dualboot.sh omarchy-3.x.x.iso
|
|
#===============================================================================
|
|
|
|
set -e
|
|
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
NC='\033[0m'
|
|
|
|
log() { echo -e "${GREEN}[✓]${NC} $1"; }
|
|
warn() { echo -e "${YELLOW}[!]${NC} $1"; }
|
|
error() { echo -e "${RED}[✗]${NC} $1"; exit 1; }
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
|
|
[[ $EUID -ne 0 ]] && error "Run as root: sudo $0"
|
|
|
|
# Auto-detect ISO if not provided
|
|
if [[ -z "$1" ]]; then
|
|
SOURCE_ISO=$(find "$SCRIPT_DIR" -maxdepth 1 -name "omarchy-*.iso" ! -name "omarchy-dualboot-*" ! -name "omarchy-installer-*" ! -name "win-omarchy-*" 2>/dev/null | head -1)
|
|
if [[ -z "$SOURCE_ISO" ]]; then
|
|
error "No Omarchy ISO found in $SCRIPT_DIR
|
|
|
|
Please either:
|
|
1. Place omarchy-*.iso in the same directory as this script
|
|
2. Or specify the path: sudo $0 /path/to/omarchy.iso"
|
|
fi
|
|
log "Auto-detected ISO: $(basename "$SOURCE_ISO")"
|
|
else
|
|
SOURCE_ISO="$1"
|
|
fi
|
|
|
|
[[ ! -f "$SOURCE_ISO" ]] && error "ISO not found: $SOURCE_ISO"
|
|
WORK_DIR="$SCRIPT_DIR/.omarchy-patch-$$"
|
|
OUTPUT_ISO="$SCRIPT_DIR/win-omarchy-$(date +%Y.%m.%d).iso"
|
|
|
|
# Check and install dependencies
|
|
MISSING_PKGS=""
|
|
command -v xorriso &>/dev/null || MISSING_PKGS="$MISSING_PKGS xorriso"
|
|
command -v unsquashfs &>/dev/null || MISSING_PKGS="$MISSING_PKGS squashfs-tools"
|
|
command -v isoinfo &>/dev/null || MISSING_PKGS="$MISSING_PKGS cdrtools"
|
|
|
|
if [[ -n "$MISSING_PKGS" ]]; then
|
|
log "Installing missing dependencies:$MISSING_PKGS"
|
|
pacman -S --noconfirm --needed $MISSING_PKGS || error "Failed to install dependencies"
|
|
log "Dependencies installed"
|
|
fi
|
|
|
|
log "Patching: $SOURCE_ISO"
|
|
|
|
# Cleanup on exit
|
|
cleanup() {
|
|
umount "$WORK_DIR/iso" 2>/dev/null || true
|
|
rm -rf "$WORK_DIR"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
mkdir -p "$WORK_DIR"/{iso,extracted,newiso}
|
|
|
|
#===============================================================================
|
|
# EXTRACT ISO
|
|
#===============================================================================
|
|
|
|
log "Extracting ISO..."
|
|
mount -o loop,ro "$SOURCE_ISO" "$WORK_DIR/iso"
|
|
cp -a "$WORK_DIR/iso/"* "$WORK_DIR/newiso/"
|
|
umount "$WORK_DIR/iso"
|
|
|
|
# Find squashfs
|
|
SQUASHFS="$WORK_DIR/newiso/arch/x86_64/airootfs.sfs"
|
|
[[ ! -f "$SQUASHFS" ]] && error "Squashfs not found at expected path"
|
|
|
|
log "Extracting squashfs (this takes a few minutes)..."
|
|
unsquashfs -d "$WORK_DIR/extracted" "$SQUASHFS"
|
|
|
|
# Verify squashfs structure
|
|
if [[ ! -d "$WORK_DIR/extracted/root" ]]; then
|
|
error "Unexpected squashfs structure: /root directory not found!"
|
|
fi
|
|
|
|
log "Original /root contents:"
|
|
ls -la "$WORK_DIR/extracted/root/" | grep -E '\.(zlogin|zprofile|automated|bash)' || echo " (no matching files)"
|
|
|
|
#===============================================================================
|
|
# CREATE DUAL-BOOT WRAPPER SCRIPT
|
|
#===============================================================================
|
|
|
|
log "Creating dual-boot wrapper..."
|
|
|
|
# This script runs BEFORE the original installer
|
|
# It handles partitioning, then lets archinstall do the rest
|
|
cat > "$WORK_DIR/extracted/root/dualboot-setup.sh" << 'DUALBOOT_SCRIPT'
|
|
#!/bin/bash
|
|
#===============================================================================
|
|
# DUAL-BOOT PARTITION SETUP
|
|
# Creates partitions in free space, then hands off to archinstall
|
|
#===============================================================================
|
|
|
|
set -e
|
|
|
|
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
|
|
CYAN='\033[0;36m'; BOLD='\033[1m'; NC='\033[0m'
|
|
|
|
log() { echo -e "${GREEN}[✓]${NC} $1"; }
|
|
warn() { echo -e "${YELLOW}[!]${NC} $1"; }
|
|
error() { echo -e "${RED}[✗]${NC} $1"; exit 1; }
|
|
info() { echo -e "${CYAN}[i]${NC} $1"; }
|
|
|
|
header() {
|
|
echo ""
|
|
echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
|
|
echo -e "${BOLD} $1${NC}"
|
|
echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
|
|
echo ""
|
|
}
|
|
|
|
cleanup_and_exit() {
|
|
warn "Setup cancelled or failed. Cleaning up..."
|
|
umount -R /mnt 2>/dev/null || true
|
|
cryptsetup close cryptroot 2>/dev/null || true
|
|
exit 1
|
|
}
|
|
|
|
#===============================================================================
|
|
# CLEANUP FUNCTION FOR FAILED INSTALLATIONS
|
|
#===============================================================================
|
|
|
|
cleanup_failed_install() {
|
|
header "CLEANUP FAILED INSTALLATION"
|
|
|
|
echo "This will remove Linux partitions from a failed installation attempt."
|
|
echo "Windows partitions will NOT be touched."
|
|
echo ""
|
|
|
|
echo "Available drives:"
|
|
lsblk -d -o NAME,SIZE,MODEL | grep -E "^(nvme|sd|vd)"
|
|
echo ""
|
|
|
|
read -p "Enter drive to clean (e.g., nvme0n1): " drive_input
|
|
DRIVE="/dev/$drive_input"
|
|
|
|
[[ ! -b "$DRIVE" ]] && error "Drive not found: $DRIVE"
|
|
[[ "$DRIVE" == *"nvme"* ]] && PART_PREFIX="${DRIVE}p" || PART_PREFIX="$DRIVE"
|
|
|
|
echo ""
|
|
echo "Current partitions:"
|
|
lsblk -o NAME,SIZE,FSTYPE,LABEL "$DRIVE"
|
|
echo ""
|
|
|
|
cryptsetup close cryptroot 2>/dev/null || true
|
|
umount -R /mnt 2>/dev/null || true
|
|
|
|
LINUX_EFI=""
|
|
LINUX_ROOT=""
|
|
|
|
for part in ${PART_PREFIX}*; do
|
|
[[ "$part" == "$DRIVE" || "$part" == "${PART_PREFIX}" ]] && continue
|
|
[[ ! -b "$part" ]] && continue
|
|
|
|
LABEL=$(lsblk -n -o LABEL "$part" 2>/dev/null | tr -d ' ')
|
|
FSTYPE=$(lsblk -n -o FSTYPE "$part" 2>/dev/null | tr -d ' ')
|
|
|
|
if [[ "$LABEL" == "LINUXEFI" ]]; then
|
|
LINUX_EFI="$part"
|
|
echo -e "${YELLOW}Found Linux EFI partition: $part${NC}"
|
|
elif [[ "$FSTYPE" == "crypto_LUKS" ]]; then
|
|
LINUX_ROOT="$part"
|
|
echo -e "${YELLOW}Found LUKS partition: $part${NC}"
|
|
fi
|
|
done
|
|
|
|
if [[ -z "$LINUX_EFI" && -z "$LINUX_ROOT" ]]; then
|
|
echo ""
|
|
info "No Linux partitions found from failed installation."
|
|
read -p "Press Enter to continue..." _
|
|
return 1
|
|
fi
|
|
|
|
echo ""
|
|
echo -e "${RED}WARNING: The following partitions will be DELETED:${NC}"
|
|
[[ -n "$LINUX_EFI" ]] && echo " - $LINUX_EFI (Linux EFI)"
|
|
[[ -n "$LINUX_ROOT" ]] && echo " - $LINUX_ROOT (Linux Root/LUKS)"
|
|
echo ""
|
|
|
|
read -p "Type 'DELETE' to confirm removal: " confirm
|
|
if [[ "$confirm" != "DELETE" ]]; then
|
|
echo "Cancelled."
|
|
return 1
|
|
fi
|
|
|
|
if [[ -n "$LINUX_ROOT" ]]; then
|
|
PART_NUM=$(echo "$LINUX_ROOT" | grep -oE '[0-9]+$')
|
|
log "Deleting partition $PART_NUM..."
|
|
sgdisk -d "$PART_NUM" "$DRIVE"
|
|
fi
|
|
|
|
if [[ -n "$LINUX_EFI" ]]; then
|
|
PART_NUM=$(echo "$LINUX_EFI" | grep -oE '[0-9]+$')
|
|
log "Deleting partition $PART_NUM..."
|
|
sgdisk -d "$PART_NUM" "$DRIVE"
|
|
fi
|
|
|
|
partprobe "$DRIVE"
|
|
|
|
for entry in $(efibootmgr 2>/dev/null | grep -i "Omarchy" | sed -n 's/^Boot\([0-9A-Fa-f]*\).*/\1/p'); do
|
|
efibootmgr -b "$entry" -B 2>/dev/null || true
|
|
done
|
|
|
|
# Restore the genuine Windows bootloader if the install spoofed it. The
|
|
# dual-boot install replaces \EFI\Microsoft\Boot\bootmgfw.efi with Limine
|
|
# and saves the real loader as bootmgfwbackup.efi. Without restoring it,
|
|
# removing the Linux partitions leaves a now-configless Limine as Windows'
|
|
# bootloader and Windows won't boot. The Windows ESP is never deleted, so
|
|
# the backup is still there.
|
|
log "Restoring genuine Windows bootloader if it was spoofed..."
|
|
for part in ${PART_PREFIX}*; do
|
|
[[ "$part" == "$DRIVE" || "$part" == "${PART_PREFIX}" ]] && continue
|
|
[[ ! -b "$part" ]] && continue
|
|
[[ "$(lsblk -no FSTYPE "$part" 2>/dev/null)" != "vfat" ]] && continue
|
|
RMNT=$(mktemp -d)
|
|
if mount "$part" "$RMNT" 2>/dev/null; then
|
|
WB="$RMNT/EFI/Microsoft/Boot"
|
|
if [[ -f "$WB/bootmgfwbackup.efi" ]]; then
|
|
if cp "$WB/bootmgfwbackup.efi" "$WB/bootmgfw.efi"; then
|
|
rm -f "$WB/bootmgfwbackup.efi"
|
|
sync
|
|
log "Restored genuine Windows bootloader on $part"
|
|
else
|
|
warn "Failed to restore bootmgfw.efi on $part — Windows may not boot!"
|
|
fi
|
|
fi
|
|
umount "$RMNT"
|
|
fi
|
|
rmdir "$RMNT"
|
|
done
|
|
|
|
log "Cleanup complete!"
|
|
echo ""
|
|
lsblk -o NAME,SIZE,FSTYPE,LABEL "$DRIVE"
|
|
echo ""
|
|
read -p "Press Enter to continue..." _
|
|
return 0
|
|
}
|
|
|
|
#===============================================================================
|
|
# REPAIR DUAL-BOOT (re-apply the bootmgfw spoof after a Windows update)
|
|
#===============================================================================
|
|
#
|
|
# A Windows feature update can reinstall \EFI\Microsoft\Boot\bootmgfw.efi,
|
|
# overwriting our Limine spoof. The machine then boots straight to Windows and
|
|
# the Limine menu disappears. This repair re-installs Limine over bootmgfw.efi
|
|
# (refreshing the backup with the now-current Windows loader) so Limine loads
|
|
# first again. Neither Windows nor the Omarchy install is otherwise touched.
|
|
|
|
repair_dualboot() {
|
|
header "REPAIR DUAL-BOOT — RE-APPLY LIMINE"
|
|
|
|
echo "Use this if the machine started booting straight to Windows and the"
|
|
echo "Limine menu disappeared (usually after a Windows feature update"
|
|
echo "overwrote the boot file)."
|
|
echo ""
|
|
echo "This re-installs Limine as the Windows boot file. Windows and your"
|
|
echo "Omarchy install are NOT modified."
|
|
echo ""
|
|
|
|
echo "Available drives:"
|
|
lsblk -d -o NAME,SIZE,MODEL | grep -E "^(nvme|sd|vd)"
|
|
echo ""
|
|
read -p "Enter the drive with the dual-boot install (e.g., nvme0n1): " drive_input
|
|
DRIVE="/dev/$drive_input"
|
|
[[ ! -b "$DRIVE" ]] && error "Drive not found: $DRIVE"
|
|
[[ "$DRIVE" == *"nvme"* ]] && PART_PREFIX="${DRIVE}p" || PART_PREFIX="$DRIVE"
|
|
|
|
# Locate the LINUXEFI partition (holds Limine + limine.conf) and the Windows
|
|
# ESP (holds bootmgfw.efi).
|
|
LINUXEFI_PART=""
|
|
WIN_ESP_PART=""
|
|
WIN_ESP_PARTUUID=""
|
|
for part in ${PART_PREFIX}*; do
|
|
[[ "$part" == "$DRIVE" || "$part" == "${PART_PREFIX}" ]] && continue
|
|
[[ ! -b "$part" ]] && continue
|
|
[[ "$(lsblk -no FSTYPE "$part" 2>/dev/null)" != "vfat" ]] && continue
|
|
if [[ "$(lsblk -no LABEL "$part" 2>/dev/null | tr -d ' ')" == "LINUXEFI" ]]; then
|
|
LINUXEFI_PART="$part"
|
|
continue
|
|
fi
|
|
TMP=$(mktemp -d)
|
|
if mount -o ro "$part" "$TMP" 2>/dev/null; then
|
|
[[ -f "$TMP/EFI/Microsoft/Boot/bootmgfw.efi" ]] && {
|
|
WIN_ESP_PART="$part"
|
|
WIN_ESP_PARTUUID=$(lsblk -no PARTUUID "$part")
|
|
}
|
|
umount "$TMP"
|
|
fi
|
|
rmdir "$TMP"
|
|
done
|
|
|
|
[[ -z "$LINUXEFI_PART" ]] && error "LINUXEFI partition not found on $DRIVE — is this the right drive?"
|
|
[[ -z "$WIN_ESP_PART" ]] && error "Windows ESP (with bootmgfw.efi) not found on $DRIVE"
|
|
log "LINUXEFI: $LINUXEFI_PART"
|
|
log "Windows ESP: $WIN_ESP_PART (PARTUUID=$WIN_ESP_PARTUUID)"
|
|
|
|
# Pull the exact Limine binary from the install's LINUXEFI partition.
|
|
LMNT=$(mktemp -d)
|
|
mount -o ro "$LINUXEFI_PART" "$LMNT" || error "Could not mount $LINUXEFI_PART"
|
|
LIMINE_SRC="$LMNT/EFI/BOOT/BOOTX64.EFI"
|
|
if [[ ! -f "$LIMINE_SRC" ]]; then
|
|
umount "$LMNT"; rmdir "$LMNT"
|
|
error "Limine EFI not found at LINUXEFI:/EFI/BOOT/BOOTX64.EFI"
|
|
fi
|
|
cp "$LIMINE_SRC" /tmp/limine-repair.efi
|
|
umount "$LMNT"; rmdir "$LMNT"
|
|
|
|
# Re-apply the spoof on the Windows ESP.
|
|
WMNT=$(mktemp -d)
|
|
mount "$WIN_ESP_PART" "$WMNT" || error "Could not mount $WIN_ESP_PART"
|
|
WB="$WMNT/EFI/Microsoft/Boot"
|
|
|
|
if cmp -s "$WB/bootmgfw.efi" /tmp/limine-repair.efi; then
|
|
log "bootmgfw.efi is already Limine — spoof is intact, no repair needed"
|
|
echo ""
|
|
info "If the Limine menu still doesn't appear, the cause is the firmware"
|
|
info "boot order, not the spoof. Use the firmware boot menu (F8/F11/F12)"
|
|
info "to select 'Windows Boot Manager' once — it will load Limine."
|
|
else
|
|
log "bootmgfw.efi is the Windows loader — re-applying the spoof"
|
|
# Refresh the backup with the CURRENT (post-update) Windows loader so the
|
|
# Windows menu entry chainloads the newest genuine loader.
|
|
if cp "$WB/bootmgfw.efi" "$WB/bootmgfwbackup.efi"; then
|
|
log "Saved current Windows loader -> bootmgfwbackup.efi"
|
|
else
|
|
warn "Could not refresh bootmgfwbackup.efi — keeping any existing backup"
|
|
fi
|
|
if cp /tmp/limine-repair.efi "$WB/bootmgfw.efi"; then
|
|
sync
|
|
log "Installed Limine as bootmgfw.efi — Limine will load first on next boot"
|
|
else
|
|
umount "$WMNT"; rmdir "$WMNT"; rm -f /tmp/limine-repair.efi
|
|
error "Failed to install Limine over bootmgfw.efi"
|
|
fi
|
|
fi
|
|
umount "$WMNT"; rmdir "$WMNT"
|
|
rm -f /tmp/limine-repair.efi
|
|
|
|
# Make sure limine.conf still has a Windows entry pointing at the backup.
|
|
# limine.conf lives on LINUXEFI and isn't touched by Windows updates, so this
|
|
# is just a safety net for an edge case.
|
|
CMNT=$(mktemp -d)
|
|
if mount "$LINUXEFI_PART" "$CMNT" 2>/dev/null; then
|
|
if [[ -f "$CMNT/limine.conf" ]] && ! grep -q "bootmgfwbackup.efi" "$CMNT/limine.conf"; then
|
|
warn "limine.conf has no Windows entry — adding one"
|
|
cat >> "$CMNT/limine.conf" <<WINREPAIR
|
|
|
|
/Windows Boot Manager
|
|
comment: Chainload the genuine Windows bootloader from the Windows ESP
|
|
protocol: efi_chainload
|
|
image_path: guid($WIN_ESP_PARTUUID):/EFI/Microsoft/Boot/bootmgfwbackup.efi
|
|
WINREPAIR
|
|
sync
|
|
fi
|
|
umount "$CMNT"
|
|
fi
|
|
rmdir "$CMNT"
|
|
|
|
echo ""
|
|
log "Repair finished — reboot to get the Limine menu back"
|
|
echo ""
|
|
read -p "Press Enter to continue..." _
|
|
return 0
|
|
}
|
|
|
|
#===============================================================================
|
|
# MAIN MENU
|
|
#===============================================================================
|
|
|
|
header "OMARCHY DUAL-BOOT INSTALLER"
|
|
|
|
echo "This installer will set up Omarchy alongside Windows."
|
|
echo "Windows partitions will NOT be touched."
|
|
echo ""
|
|
echo "Options:"
|
|
echo " 1) Dual Boot (Heaven and Hell mode) — install Omarchy alongside Windows"
|
|
echo " 2) Consider that a divorce (remove a failed install)"
|
|
echo " 3) Nuke the site from orbit — it's the only way to be sure (wipe drive, install Omarchy)"
|
|
echo " 4) Exit to Ghost in the... (drop to a terminal)"
|
|
echo " 5) I'll be back (re-apply Limine after a Windows update)"
|
|
echo ""
|
|
read -p "Select option [1]: " MENU_CHOICE
|
|
MENU_CHOICE=${MENU_CHOICE:-1}
|
|
|
|
case $MENU_CHOICE in
|
|
2)
|
|
cleanup_failed_install || true
|
|
exec /root/dualboot-setup.sh
|
|
;;
|
|
3)
|
|
# Run original installer
|
|
info "Starting standard Omarchy installer..."
|
|
exec /root/.automated_script.sh.orig
|
|
;;
|
|
4)
|
|
echo "Type '/root/dualboot-setup.sh' to restart installer."
|
|
exit 0
|
|
;;
|
|
5)
|
|
repair_dualboot || true
|
|
exec /root/dualboot-setup.sh
|
|
;;
|
|
1)
|
|
# Continue with dual-boot setup
|
|
;;
|
|
*)
|
|
exec /root/dualboot-setup.sh
|
|
;;
|
|
esac
|
|
|
|
#===============================================================================
|
|
# PRE-FLIGHT CHECKS
|
|
#===============================================================================
|
|
|
|
[[ ! -d /sys/firmware/efi ]] && error "UEFI mode required for dual-boot"
|
|
|
|
# Secure Boot check — Limine BOOTX64.EFI is unsigned, so firmware with
|
|
# Secure Boot enabled will silently reject it and fall through to the
|
|
# Windows Boot Manager, defeating the whole "Limine is the bootloader"
|
|
# design. Detect it now so the user can disable it in firmware first.
|
|
SB_STATE="unknown"
|
|
if command -v mokutil &>/dev/null; then
|
|
SB_STATE=$(mokutil --sb-state 2>/dev/null | head -1)
|
|
elif [[ -d /sys/firmware/efi/efivars ]]; then
|
|
SB_VAR=$(find /sys/firmware/efi/efivars -maxdepth 1 -name 'SecureBoot-*' 2>/dev/null | head -1)
|
|
if [[ -n "$SB_VAR" ]]; then
|
|
# 4-byte attributes header, then 1 byte: 0x00 = disabled, 0x01 = enabled
|
|
SB_BYTE=$(od -An -tu1 -j4 -N1 "$SB_VAR" 2>/dev/null | tr -d ' ')
|
|
case "$SB_BYTE" in
|
|
1) SB_STATE="SecureBoot enabled" ;;
|
|
0) SB_STATE="SecureBoot disabled" ;;
|
|
esac
|
|
fi
|
|
fi
|
|
|
|
if echo "$SB_STATE" | grep -qi "enabled"; then
|
|
warn "Secure Boot is ENABLED in firmware."
|
|
echo ""
|
|
echo " Limine is unsigned. With Secure Boot on, the firmware will"
|
|
echo " silently reject Limine on every boot and fall through to"
|
|
echo " Windows Boot Manager — defeating this installer's whole point."
|
|
echo ""
|
|
echo " Reboot, enter firmware setup (F2/Del), DISABLE Secure Boot,"
|
|
echo " then re-run this installer."
|
|
echo ""
|
|
read -p "Continue anyway (not recommended)? (y/N): " sb_cont
|
|
[[ ! "$sb_cont" =~ ^[Yy]$ ]] && error "Cancelled — disable Secure Boot first"
|
|
else
|
|
log "Secure Boot: $SB_STATE"
|
|
fi
|
|
|
|
header "SELECT DRIVE"
|
|
|
|
echo "Available drives:"
|
|
echo ""
|
|
lsblk -d -o NAME,SIZE,MODEL | grep -E "^(nvme|sd|vd)"
|
|
echo ""
|
|
|
|
mapfile -t DRIVES < <(lsblk -d -n -o NAME,TRAN | awk '$2!="usb" {print $1}' | grep -E "^(nvme|sd|vd)")
|
|
|
|
if [[ ${#DRIVES[@]} -eq 1 ]]; then
|
|
DRIVE="/dev/${DRIVES[0]}"
|
|
info "Found: $DRIVE"
|
|
read -p "Use this drive? (Y/n): " confirm
|
|
[[ "$confirm" =~ ^[Nn]$ ]] && error "Cancelled"
|
|
else
|
|
read -p "Enter drive (e.g., nvme0n1): " drive_input
|
|
DRIVE="/dev/$drive_input"
|
|
fi
|
|
|
|
[[ ! -b "$DRIVE" ]] && error "Drive not found: $DRIVE"
|
|
[[ "$DRIVE" == *"nvme"* ]] && PART_PREFIX="${DRIVE}p" || PART_PREFIX="$DRIVE"
|
|
|
|
echo ""
|
|
echo "Current partitions on $DRIVE:"
|
|
lsblk -o NAME,SIZE,FSTYPE,LABEL "$DRIVE"
|
|
echo ""
|
|
|
|
# Check for Windows
|
|
if lsblk -o FSTYPE "$DRIVE" | grep -q ntfs; then
|
|
log "Windows detected - it will be preserved"
|
|
|
|
# BitLocker + TPM/PCR warning. Changing the boot path (and what the
|
|
# firmware loads first) changes the TPM PCR measurements Windows
|
|
# uses to unseal the BitLocker key. On next Windows boot this can
|
|
# demand the 48-digit recovery key. Same chain of consequences
|
|
# applies if Windows uses TPM-backed device encryption (default on
|
|
# most Win 11 OEM installs) even without explicit BitLocker setup.
|
|
header "BITLOCKER / DEVICE ENCRYPTION WARNING"
|
|
|
|
echo "Windows 11 typically has BitLocker or 'Device Encryption' on"
|
|
echo "by default, sealed to the TPM and current boot configuration."
|
|
echo ""
|
|
echo "After this install:"
|
|
echo " • Limine becomes the first thing the firmware loads"
|
|
echo " • TPM PCR measurements (PCR 4/7) will differ"
|
|
echo " • Next Windows boot can demand the 48-digit recovery key"
|
|
echo ""
|
|
echo -e "${BOLD}Before continuing, in Windows:${NC}"
|
|
echo -e " 1. Sign in and open ${BOLD}Settings → Privacy → Find My Device${NC}"
|
|
echo " and confirm your BitLocker recovery key is saved to your"
|
|
echo " Microsoft account (or print/save it locally)."
|
|
echo " 2. Open an admin PowerShell and run:"
|
|
echo -e " ${CYAN}manage-bde -protectors -disable C: -RebootCount 0${NC}"
|
|
echo " This suspends BitLocker until you re-enable it from Windows."
|
|
echo " 3. Shut down Windows fully (not 'restart' — Fast Startup will"
|
|
echo " leave the NTFS dirty and Windows will run chkdsk on next boot)."
|
|
echo ""
|
|
echo "If you skip this and don't have the recovery key, you may be"
|
|
echo "permanently locked out of your Windows installation."
|
|
echo ""
|
|
read -p "Type 'I HAVE MY RECOVERY KEY' to continue: " bl_confirm
|
|
if [[ "$bl_confirm" != "I HAVE MY RECOVERY KEY" ]]; then
|
|
error "Cancelled — back up your BitLocker recovery key first"
|
|
fi
|
|
else
|
|
warn "Windows not detected on this drive"
|
|
read -p "Continue anyway? (y/N): " cont
|
|
[[ ! "$cont" =~ ^[Yy]$ ]] && error "Cancelled"
|
|
fi
|
|
|
|
# Check free space
|
|
FREE_SECTORS=$(sgdisk -p "$DRIVE" 2>/dev/null | grep "Total free space" | awk '{print $5}')
|
|
if [[ "$FREE_SECTORS" =~ ^[0-9]+$ ]]; then
|
|
FREE_GB=$((FREE_SECTORS * 512 / 1024 / 1024 / 1024))
|
|
[[ $FREE_GB -lt 20 ]] && error "Need 20GB+ free space, found ${FREE_GB}GB"
|
|
log "Free space: ${FREE_GB}GB"
|
|
else
|
|
warn "Could not determine free space"
|
|
fi
|
|
|
|
#===============================================================================
|
|
# ENCRYPTION PASSWORD
|
|
#===============================================================================
|
|
|
|
header "DISK ENCRYPTION"
|
|
|
|
echo "Your Linux partition will be encrypted with LUKS2."
|
|
echo "You'll enter your user password in the next step (configurator)."
|
|
echo ""
|
|
|
|
while true; do
|
|
read -s -p "Enter LUKS encryption password: " LUKS_PASS; echo ""
|
|
read -s -p "Confirm password: " LUKS_PASS2; echo ""
|
|
[[ "$LUKS_PASS" == "$LUKS_PASS2" ]] && break
|
|
warn "Passwords don't match, try again"
|
|
done
|
|
|
|
#===============================================================================
|
|
# CONFIRMATION
|
|
#===============================================================================
|
|
|
|
header "CONFIRM PARTITIONING"
|
|
|
|
echo "The following will be created in FREE SPACE on $DRIVE:"
|
|
echo ""
|
|
echo " • 1GB EFI partition (for Linux bootloader)"
|
|
echo " • Rest: LUKS2 encrypted partition (for Linux root)"
|
|
echo ""
|
|
echo -e "${GREEN}Windows partitions will NOT be touched.${NC}"
|
|
echo ""
|
|
read -p "Type 'yes' to continue: " confirm
|
|
[[ "$confirm" != "yes" ]] && error "Cancelled"
|
|
|
|
#===============================================================================
|
|
# CREATE PARTITIONS
|
|
#===============================================================================
|
|
|
|
header "CREATING PARTITIONS"
|
|
|
|
trap cleanup_and_exit ERR
|
|
|
|
DRIVE_NAME=$(basename "$DRIVE")
|
|
LAST_PART=$(lsblk -n -o NAME "$DRIVE" | grep -v "^${DRIVE_NAME}$" | grep -oE '[0-9]+$' | sort -n | tail -1)
|
|
LAST_PART=${LAST_PART:-0}
|
|
|
|
# Create EFI partition
|
|
log "Creating Linux EFI partition (1GB)..."
|
|
NEXT=$((LAST_PART + 1))
|
|
sgdisk -n "${NEXT}:0:+1G" -t "${NEXT}:ef00" "$DRIVE"
|
|
EFI_PART="${PART_PREFIX}${NEXT}"
|
|
partprobe "$DRIVE"; udevadm settle; sleep 2
|
|
mkfs.fat -F32 -n "LINUXEFI" "$EFI_PART"
|
|
log "Created: $EFI_PART"
|
|
|
|
# Create root partition
|
|
log "Creating Linux root partition..."
|
|
NEXT=$((NEXT + 1))
|
|
sgdisk -n "${NEXT}:0:0" -t "${NEXT}:8300" "$DRIVE"
|
|
ROOT_PART="${PART_PREFIX}${NEXT}"
|
|
partprobe "$DRIVE"; udevadm settle; sleep 2
|
|
log "Created: $ROOT_PART"
|
|
|
|
#===============================================================================
|
|
# SETUP ENCRYPTION & FILESYSTEM
|
|
#===============================================================================
|
|
|
|
header "SETTING UP ENCRYPTION"
|
|
|
|
log "Formatting LUKS2..."
|
|
echo -n "$LUKS_PASS" | cryptsetup luksFormat --type luks2 --key-file=- "$ROOT_PART"
|
|
|
|
log "Opening encrypted volume..."
|
|
echo -n "$LUKS_PASS" | cryptsetup open --key-file=- "$ROOT_PART" cryptroot
|
|
LUKS_UUID=$(blkid -s UUID -o value "$ROOT_PART")
|
|
|
|
log "Creating btrfs filesystem..."
|
|
mkfs.btrfs -f /dev/mapper/cryptroot
|
|
|
|
log "Creating subvolumes..."
|
|
mount /dev/mapper/cryptroot /mnt
|
|
btrfs subvolume create /mnt/@
|
|
btrfs subvolume create /mnt/@home
|
|
btrfs subvolume create /mnt/@log
|
|
btrfs subvolume create /mnt/@pkg
|
|
# NOTE: Do NOT create @snapshots - snapper will create .snapshots as nested subvolume
|
|
umount /mnt
|
|
|
|
log "Mounting filesystems..."
|
|
mount -o compress=zstd,subvol=@ /dev/mapper/cryptroot /mnt
|
|
mkdir -p /mnt/{home,var/log,var/cache/pacman/pkg,boot}
|
|
mount -o compress=zstd,subvol=@home /dev/mapper/cryptroot /mnt/home
|
|
mount -o compress=zstd,subvol=@log /dev/mapper/cryptroot /mnt/var/log
|
|
mount -o compress=zstd,subvol=@pkg /dev/mapper/cryptroot /mnt/var/cache/pacman/pkg
|
|
# NOTE: Do NOT mount .snapshots - snapper creates it as nested subvolume in @
|
|
mount "$EFI_PART" /mnt/boot
|
|
|
|
log "Partitions ready!"
|
|
|
|
# Save info for later
|
|
echo "$LUKS_UUID" > /tmp/luks_uuid
|
|
echo "$EFI_PART" > /tmp/efi_part
|
|
echo "$ROOT_PART" > /tmp/root_part
|
|
echo "$DRIVE" > /tmp/install_drive
|
|
|
|
trap - ERR
|
|
|
|
#===============================================================================
|
|
# HAND OFF TO ARCHINSTALL
|
|
#===============================================================================
|
|
|
|
header "STARTING OMARCHY INSTALLER"
|
|
|
|
echo "Partitions are ready. Now the Omarchy installer will collect your"
|
|
echo "user information and install the system."
|
|
echo ""
|
|
info "The disk is already partitioned - just enter your user details."
|
|
echo ""
|
|
read -p "Press Enter to continue to Omarchy setup..." _
|
|
|
|
# Run the configurator to get user info.
|
|
# The configurator is a separate child process that re-sources its helpers via
|
|
# $OMARCHY_INSTALL and calls helper functions like clear_logo. Without these
|
|
# exported it prints "/helpers/all.sh: No such file or directory" and repeated
|
|
# "clear_logo: command not found" noise. Export them using Omarchy's own
|
|
# convention (OMARCHY_INSTALL=$OMARCHY_PATH/install) so the configurator runs
|
|
# clean.
|
|
cd /root
|
|
export OMARCHY_PATH=/root/omarchy
|
|
export OMARCHY_INSTALL=/root/omarchy/install
|
|
source "$OMARCHY_INSTALL/helpers/all.sh" 2>/dev/null || true
|
|
|
|
# Set colors
|
|
if [[ $(tty) == "/dev/tty"* ]]; then
|
|
echo -en "\e]P01a1b26"
|
|
echo -en "\e]P7a9b1d6"
|
|
echo -en "\e]PFc0caf5"
|
|
echo -en "\033[0m"
|
|
clear
|
|
fi
|
|
|
|
# Drain any buffered keystrokes / stray terminal bytes left over from the
|
|
# "Press Enter" prompt and the logo animation, so they don't leak into the
|
|
# configurator's first input field (was showing up as a phantom "A" in the
|
|
# Username prompt before the user typed anything).
|
|
read -r -t 0.2 -N 100000 _drain 2>/dev/null || true
|
|
|
|
# Run configurator
|
|
./configurator
|
|
|
|
# Get username from generated config
|
|
OMARCHY_USER=$(jq -r '.users[0].username' user_credentials.json 2>/dev/null)
|
|
|
|
if [[ -z "$OMARCHY_USER" || "$OMARCHY_USER" == "null" ]]; then
|
|
error "Failed to get username from configurator"
|
|
fi
|
|
|
|
log "User: $OMARCHY_USER"
|
|
|
|
#===============================================================================
|
|
# MODIFY CONFIG FOR PRE-MOUNTED PARTITIONS
|
|
#===============================================================================
|
|
|
|
header "CONFIGURING INSTALLATION"
|
|
|
|
log "Updating configuration for dual-boot..."
|
|
|
|
# Only modify disk_config and remove bootloader, preserve everything else from generated config
|
|
# This keeps the correct kernel, locale, packages, profile, etc.
|
|
# We MUST remove bootloader because archinstall crashes when trying to
|
|
# detect root device with pre_mounted_config - it fails BEFORE installing packages
|
|
# We install limine manually after archinstall completes
|
|
jq '.disk_config = {"config_type": "pre_mounted_config", "mountpoint": "/mnt"} | del(.bootloader)' \
|
|
user_configuration.json > user_configuration.json.tmp
|
|
mv user_configuration.json.tmp user_configuration.json
|
|
|
|
# Extract kernel name for later use in bootloader config
|
|
KERNEL_NAME=$(jq -r '.kernels[0] // "linux"' user_configuration.json)
|
|
echo "$KERNEL_NAME" > /tmp/kernel_name
|
|
log "Using kernel: $KERNEL_NAME"
|
|
|
|
log "Configuration updated for pre-mounted partitions"
|
|
|
|
#===============================================================================
|
|
# RUN ARCHINSTALL
|
|
#===============================================================================
|
|
|
|
header "INSTALLING SYSTEM"
|
|
|
|
log "Running archinstall..."
|
|
info "This will take several minutes..."
|
|
|
|
# Initialize keyring
|
|
pacman-key --init
|
|
pacman-key --populate archlinux
|
|
pacman-key --populate omarchy 2>/dev/null || true
|
|
|
|
# For offline install, ensure we use the offline-only pacman config
|
|
# and skip database sync since the database is already on the ISO
|
|
cat > /tmp/pacman-offline.conf << 'PACCONF'
|
|
[options]
|
|
HoldPkg = pacman glibc
|
|
Architecture = auto
|
|
SigLevel = Required DatabaseOptional
|
|
LocalFileSigLevel = Optional
|
|
|
|
[offline]
|
|
SigLevel = Optional TrustAll
|
|
Server = file:///var/cache/omarchy/mirror/offline/
|
|
PACCONF
|
|
|
|
# Overwrite system pacman.conf with offline-only version
|
|
cp /tmp/pacman-offline.conf /etc/pacman.conf
|
|
|
|
# Debug: verify config
|
|
log "Pacman config set to offline-only:"
|
|
grep -E "^\[|^Server" /etc/pacman.conf
|
|
|
|
# Skip pacman -Sy for offline install - database already exists on ISO
|
|
# Check for either offline.db or offline.db.tar.gz
|
|
if [[ -f /var/cache/omarchy/mirror/offline/offline.db ]] || [[ -f /var/cache/omarchy/mirror/offline/offline.db.tar.gz ]]; then
|
|
log "Offline package database found - skipping sync"
|
|
else
|
|
warn "Offline database not found - attempting sync..."
|
|
pacman --config /tmp/pacman-offline.conf -Sy --noconfirm
|
|
fi
|
|
|
|
# Run archinstall with our config (same flags as original Omarchy installer)
|
|
# bootloader=none prevents archinstall from crashing on pre_mounted_config
|
|
archinstall \
|
|
--config user_configuration.json \
|
|
--creds user_credentials.json \
|
|
--silent \
|
|
--skip-ntp \
|
|
--skip-wkd \
|
|
--skip-wifi-check
|
|
|
|
# Verify archinstall created the user
|
|
if [[ ! -d /mnt/home/$OMARCHY_USER ]]; then
|
|
error "archinstall failed - user $OMARCHY_USER not created"
|
|
fi
|
|
|
|
log "Base system installed!"
|
|
|
|
# Install limine bootloader package (archinstall didn't because we removed bootloader config)
|
|
log "Installing limine bootloader..."
|
|
# Copy offline pacman config to chroot and mount offline mirror first
|
|
cp /tmp/pacman-offline.conf /mnt/etc/pacman.conf
|
|
mkdir -p /mnt/var/cache/omarchy/mirror/offline
|
|
mount --bind /var/cache/omarchy/mirror/offline /mnt/var/cache/omarchy/mirror/offline
|
|
# Install limine using offline repo (no -Sy needed, packages are local)
|
|
arch-chroot /mnt pacman --noconfirm --needed -S limine
|
|
|
|
#===============================================================================
|
|
# POST-INSTALL CONFIGURATION
|
|
#===============================================================================
|
|
|
|
header "CONFIGURING BOOTLOADER"
|
|
|
|
LUKS_UUID=$(cat /tmp/luks_uuid)
|
|
KERNEL_NAME=$(cat /tmp/kernel_name)
|
|
|
|
# Configure mkinitcpio for encryption using Omarchy's drop-in approach
|
|
log "Configuring initramfs for encryption..."
|
|
|
|
# Install required packages
|
|
log "Installing plymouth and limine tools..."
|
|
arch-chroot /mnt pacman --noconfirm --needed -S plymouth limine-snapper-sync limine-mkinitcpio-hook || warn "Some packages may already be installed"
|
|
|
|
# Create Omarchy-style mkinitcpio drop-in config with encryption support
|
|
# This uses the same hooks as Omarchy but includes encrypt for LUKS
|
|
mkdir -p /mnt/etc/mkinitcpio.conf.d
|
|
cat > /mnt/etc/mkinitcpio.conf.d/omarchy_hooks.conf << 'MKINIT'
|
|
HOOKS=(base udev plymouth keyboard autodetect microcode modconf kms keymap consolefont block encrypt filesystems fsck btrfs-overlayfs)
|
|
MKINIT
|
|
|
|
cat > /mnt/etc/mkinitcpio.conf.d/thunderbolt_module.conf << 'MKINIT'
|
|
MODULES+=(thunderbolt)
|
|
MKINIT
|
|
|
|
# Rebuild initramfs (warnings about missing firmware are OK)
|
|
log "Building initramfs (warnings about missing firmware are normal)..."
|
|
if ! arch-chroot /mnt mkinitcpio -P; then
|
|
warn "mkinitcpio reported warnings - checking if initramfs was created..."
|
|
fi
|
|
|
|
# Verify the initramfs was actually created for our kernel
|
|
if [[ -f /mnt/boot/initramfs-${KERNEL_NAME}.img ]]; then
|
|
log "initramfs-${KERNEL_NAME}.img created successfully"
|
|
elif [[ -f /mnt/boot/initramfs-linux.img ]]; then
|
|
log "initramfs-linux.img created successfully"
|
|
else
|
|
error "initramfs was not created! Check mkinitcpio output above."
|
|
fi
|
|
|
|
# Verify kernel was installed
|
|
if [[ ! -f /mnt/boot/vmlinuz-$KERNEL_NAME ]]; then
|
|
error "Kernel vmlinuz-$KERNEL_NAME not found in /mnt/boot/"
|
|
fi
|
|
log "Found kernel: vmlinuz-$KERNEL_NAME"
|
|
|
|
# Configure Limine bootloader using Omarchy's approach
|
|
log "Configuring Limine bootloader..."
|
|
mkdir -p /mnt/boot/EFI/BOOT /mnt/boot/EFI/limine
|
|
|
|
# Copy Limine EFI files
|
|
cp /mnt/usr/share/limine/BOOTX64.EFI /mnt/boot/EFI/BOOT/
|
|
cp /mnt/usr/share/limine/BOOTX64.EFI /mnt/boot/EFI/limine/
|
|
|
|
# Create /etc/default/limine for limine-update (Omarchy style)
|
|
CRYPT_CMDLINE="cryptdevice=UUID=$LUKS_UUID:cryptroot root=/dev/mapper/cryptroot rootflags=subvol=@"
|
|
cat > /mnt/etc/default/limine << LIMINEDEF
|
|
TARGET_OS_NAME="Omarchy"
|
|
|
|
ESP_PATH="/boot"
|
|
|
|
KERNEL_CMDLINE[default]="$CRYPT_CMDLINE rw quiet splash"
|
|
|
|
ENABLE_UKI=yes
|
|
CUSTOM_UKI_NAME="omarchy"
|
|
|
|
ENABLE_LIMINE_FALLBACK=yes
|
|
|
|
# Find and add other bootloaders (Windows)
|
|
FIND_BOOTLOADERS=yes
|
|
|
|
BOOT_ORDER="*, *fallback, Snapshots"
|
|
|
|
MAX_SNAPSHOT_ENTRIES=5
|
|
|
|
SNAPSHOT_FORMAT_CHOICE=5
|
|
LIMINEDEF
|
|
|
|
# Create base limine.conf (limine-update will add entries)
|
|
cat > /mnt/boot/limine.conf << 'LIMINE'
|
|
default_entry: 2
|
|
interface_branding: Omarchy Bootloader
|
|
interface_branding_color: 2
|
|
hash_mismatch_panic: no
|
|
|
|
term_background: 1a1b26
|
|
backdrop: 1a1b26
|
|
|
|
term_palette: 15161e;f7768e;9ece6a;e0af68;7aa2f7;bb9af7;7dcfff;a9b1d6
|
|
term_palette_bright: 414868;f7768e;9ece6a;e0af68;7aa2f7;bb9af7;7dcfff;c0caf5
|
|
|
|
term_foreground: c0caf5
|
|
term_foreground_bright: c0caf5
|
|
term_background_bright: 24283b
|
|
LIMINE
|
|
|
|
# Run limine-update to generate boot entries (including snapshots)
|
|
log "Running limine-update to generate boot entries..."
|
|
arch-chroot /mnt limine-update || warn "limine-update had issues"
|
|
|
|
# Enable btrfs quota for space-aware snapshot cleanup
|
|
log "Enabling btrfs quota..."
|
|
btrfs quota enable /mnt || warn "Could not enable btrfs quota"
|
|
|
|
#===============================================================================
|
|
# INSTALL OMARCHY
|
|
#===============================================================================
|
|
|
|
header "INSTALLING OMARCHY PACKAGES"
|
|
|
|
# Mount offline mirror if available
|
|
if [[ -d /var/cache/omarchy/mirror/offline ]]; then
|
|
mkdir -p /mnt/var/cache/omarchy/mirror/offline
|
|
mount --bind /var/cache/omarchy/mirror/offline /mnt/var/cache/omarchy/mirror/offline
|
|
fi
|
|
|
|
if [[ -d /opt/packages ]]; then
|
|
mkdir -p /mnt/opt/packages
|
|
mount --bind /opt/packages /mnt/opt/packages
|
|
fi
|
|
|
|
# Backup system pacman.conf and use ISO's version temporarily for offline install
|
|
cp /mnt/etc/pacman.conf /mnt/etc/pacman.conf.bak
|
|
cp /etc/pacman.conf /mnt/etc/pacman.conf
|
|
|
|
# Copy omarchy to user's home
|
|
mkdir -p /mnt/home/$OMARCHY_USER/.local/share/
|
|
cp -a /root/omarchy /mnt/home/$OMARCHY_USER/.local/share/
|
|
# Ensure all scripts are executable
|
|
chmod -R +x /mnt/home/$OMARCHY_USER/.local/share/omarchy/bin/
|
|
chmod -R +x /mnt/home/$OMARCHY_USER/.local/share/omarchy/install/
|
|
find /mnt/home/$OMARCHY_USER/.local/share/omarchy -name "*.sh" -exec chmod +x {} \;
|
|
arch-chroot /mnt chown -R $OMARCHY_USER:$OMARCHY_USER /home/$OMARCHY_USER/.local/
|
|
|
|
# Get user info from configurator-generated files
|
|
USER_FULL_NAME=""
|
|
USER_EMAIL=""
|
|
[[ -f /root/user_full_name.txt ]] && USER_FULL_NAME=$(<user_full_name.txt)
|
|
[[ -f /root/user_email_address.txt ]] && USER_EMAIL=$(<user_email_address.txt)
|
|
OMARCHY_MIRROR=""
|
|
[[ -f /root/omarchy_mirror ]] && OMARCHY_MIRROR=$(<omarchy_mirror)
|
|
|
|
# Run omarchy installer in chroot (with proper environment like original installer).
|
|
# Pass OMARCHY_CHROOT_INSTALL=1 and the rest on the sudo command line — `sudo -E`
|
|
# alone isn't enough because sudo's default env_reset strips unknown vars regardless.
|
|
# Without OMARCHY_CHROOT_INSTALL=1 the install/post-install/finished.sh script
|
|
# prompts the user with a gum-confirm "Reboot Now" dialog and then runs
|
|
# `sudo reboot`, which kills the archiso live env before our wrapper can finish
|
|
# (no plymouth/snapper/Windows entry/BootOrder lock would ever run).
|
|
log "Installing Omarchy packages and configuration..."
|
|
arch-chroot /mnt /bin/bash -c "
|
|
export HOME=/home/$OMARCHY_USER
|
|
export USER=$OMARCHY_USER
|
|
cd /home/$OMARCHY_USER/.local/share/omarchy
|
|
sudo -u $OMARCHY_USER \
|
|
OMARCHY_CHROOT_INSTALL=1 \
|
|
OMARCHY_USER_NAME='$USER_FULL_NAME' \
|
|
OMARCHY_USER_EMAIL='$USER_EMAIL' \
|
|
OMARCHY_MIRROR='$OMARCHY_MIRROR' \
|
|
bash -c 'source install.sh' || true
|
|
" || warn "Omarchy install script had some issues (this may be OK)"
|
|
|
|
# Set up proper pacman.conf for the installed system
|
|
log "Configuring pacman for installed system..."
|
|
cat > /mnt/etc/pacman.conf << 'PACMANCONF'
|
|
[options]
|
|
Color
|
|
ILoveCandy
|
|
VerbosePkgLists
|
|
HoldPkg = pacman glibc
|
|
Architecture = auto
|
|
CheckSpace
|
|
ParallelDownloads = 5
|
|
DownloadUser = alpm
|
|
|
|
SigLevel = Required DatabaseOptional
|
|
LocalFileSigLevel = Optional
|
|
|
|
[core]
|
|
Include = /etc/pacman.d/mirrorlist
|
|
|
|
[extra]
|
|
Include = /etc/pacman.d/mirrorlist
|
|
|
|
[multilib]
|
|
Include = /etc/pacman.d/mirrorlist
|
|
|
|
[omarchy]
|
|
SigLevel = Optional TrustAll
|
|
Server = https://pkgs.omarchy.org/stable/$arch
|
|
PACMANCONF
|
|
|
|
# Set up mirrorlist
|
|
cat > /mnt/etc/pacman.d/mirrorlist << 'MIRRORLIST'
|
|
Server = https://stable-mirror.omarchy.org/$repo/os/$arch
|
|
MIRRORLIST
|
|
|
|
log "Pacman configured with Omarchy stable repos"
|
|
|
|
# Now that Omarchy is installed, set Plymouth theme and rebuild initramfs
|
|
log "Setting Omarchy Plymouth theme..."
|
|
if [[ -d /mnt/usr/share/plymouth/themes/omarchy ]]; then
|
|
arch-chroot /mnt plymouth-set-default-theme omarchy
|
|
log "Rebuilding initramfs with Omarchy Plymouth theme..."
|
|
arch-chroot /mnt mkinitcpio -P
|
|
else
|
|
warn "Omarchy Plymouth theme not found"
|
|
fi
|
|
|
|
#===============================================================================
|
|
# FINAL SETUP
|
|
#===============================================================================
|
|
|
|
header "FINAL CONFIGURATION"
|
|
|
|
# Enable services
|
|
log "Enabling services..."
|
|
arch-chroot /mnt systemctl enable sddm 2>/dev/null || true
|
|
arch-chroot /mnt systemctl enable NetworkManager 2>/dev/null || true
|
|
arch-chroot /mnt systemctl enable iwd 2>/dev/null || true
|
|
arch-chroot /mnt systemctl enable bluetooth 2>/dev/null || true
|
|
|
|
# Snapper configuration
|
|
log "Installing and configuring snapper..."
|
|
arch-chroot /mnt pacman --noconfirm --needed -S snapper 2>/dev/null || true
|
|
|
|
# Create snapper config for root - this creates .snapshots as nested subvolume in @
|
|
# --no-dbus is required: the arch-iso environment has no running DBus daemon,
|
|
# so snapper's default IPC path fails with org.freedesktop.DBus.Error.ServiceUnknown.
|
|
log "Creating snapper root config..."
|
|
arch-chroot /mnt snapper --no-dbus -c root create-config / || warn "snapper create-config had issues"
|
|
|
|
# Enable snapper services
|
|
arch-chroot /mnt systemctl enable snapper-cleanup.timer 2>/dev/null || true
|
|
arch-chroot /mnt systemctl enable snapper-timeline.timer 2>/dev/null || true
|
|
arch-chroot /mnt systemctl enable limine-snapper-sync.service 2>/dev/null || true
|
|
|
|
# Create initial snapshot
|
|
log "Creating initial snapshot..."
|
|
arch-chroot /mnt snapper --no-dbus -c root create -d "Fresh install" || warn "Could not create initial snapshot"
|
|
|
|
# Sync snapshots to limine boot menu
|
|
log "Syncing snapshots to limine..."
|
|
arch-chroot /mnt limine-snapper-sync 2>/dev/null || warn "limine-snapper-sync had issues (may need to run after first boot)"
|
|
|
|
log "Snapper configured with bootable snapshots"
|
|
|
|
# Add Windows Boot Manager entry to limine.conf.
|
|
# This MUST happen after every tool that auto-rewrites limine.conf:
|
|
# - limine-update / limine-mkinitcpio-hook (regenerates kernel entries)
|
|
# - limine-snapper-sync (regenerates snapshot entries)
|
|
# Both wipe unrecognised entries. Appending here is the only place the
|
|
# entry survives to first boot. limine-entry-tool --add-efi only supports
|
|
# entries on the same ESP, so we hand-write the entry to chainload the
|
|
# Windows ESP.
|
|
#
|
|
# IMPORTANT: reference the partition by its GPT PARTUUID via guid(), NOT the
|
|
# FAT filesystem serial via uuid(). Limine's guid()/uuid() resolves GPT
|
|
# partition GUIDs; it does NOT match FAT32 volume serials (e.g. uuid(XXXX-XXXX)),
|
|
# which panics at boot with "Failed to open image". lsblk -no PARTUUID gives the
|
|
# GPT GUID we want.
|
|
log "Looking for a Windows ESP on $DRIVE..."
|
|
WIN_ESP_PARTUUID=""
|
|
WIN_ESP_PART=""
|
|
for p in $(lsblk -ln -o NAME "$DRIVE" | tail -n +2); do
|
|
PART="/dev/$p"
|
|
[[ "$PART" == "$EFI_PART" ]] && continue
|
|
[[ "$(lsblk -no FSTYPE "$PART" 2>/dev/null)" != "vfat" ]] && continue
|
|
TMPMNT=$(mktemp -d)
|
|
if mount -o ro "$PART" "$TMPMNT" 2>/dev/null; then
|
|
if [[ -f "$TMPMNT/EFI/Microsoft/Boot/bootmgfw.efi" ]]; then
|
|
WIN_ESP_PARTUUID=$(lsblk -no PARTUUID "$PART")
|
|
WIN_ESP_PART="$PART"
|
|
log "Found Windows ESP: $PART (PARTUUID=$WIN_ESP_PARTUUID)"
|
|
fi
|
|
umount "$TMPMNT"
|
|
fi
|
|
rmdir "$TMPMNT"
|
|
[[ -n "$WIN_ESP_PARTUUID" ]] && break
|
|
done
|
|
|
|
if [[ -n "$WIN_ESP_PARTUUID" ]]; then
|
|
# bootmgfw spoof. Many consumer firmwares (confirmed on AMI-based mini-PCs)
|
|
# ignore the efibootmgr BootOrder lock entirely and always boot
|
|
# \EFI\Microsoft\Boot\bootmgfw.efi, landing straight in Windows and never
|
|
# showing Limine. To guarantee "Limine first, no F12" we replace bootmgfw.efi
|
|
# with Limine and stash the genuine Windows loader as bootmgfwbackup.efi,
|
|
# which the Windows menu entry chainloads.
|
|
#
|
|
# CAVEAT: a Windows *feature* update can reinstall bootmgfw.efi, overwriting
|
|
# Limine and reverting to straight-to-Windows. Re-run option 1 (or just the
|
|
# spoof) to restore it.
|
|
log "Applying bootmgfw spoof (firmware-proof Limine-first boot)..."
|
|
SPOOF_OK=0
|
|
SPOOFMNT=$(mktemp -d)
|
|
if mount "$WIN_ESP_PART" "$SPOOFMNT" 2>/dev/null; then
|
|
WINBOOT="$SPOOFMNT/EFI/Microsoft/Boot"
|
|
LIMINE_EFI="/mnt/boot/EFI/BOOT/BOOTX64.EFI"
|
|
if [[ -f "$WINBOOT/bootmgfw.efi" && -f "$LIMINE_EFI" ]]; then
|
|
# Back up the genuine Windows loader only once — never clobber a real
|
|
# backup with Limine on a re-run.
|
|
if [[ ! -f "$WINBOOT/bootmgfwbackup.efi" ]]; then
|
|
cp "$WINBOOT/bootmgfw.efi" "$WINBOOT/bootmgfwbackup.efi" &&
|
|
log "Backed up Windows loader -> bootmgfwbackup.efi"
|
|
else
|
|
warn "bootmgfwbackup.efi already exists — keeping existing backup"
|
|
fi
|
|
if cp "$LIMINE_EFI" "$WINBOOT/bootmgfw.efi"; then
|
|
sync
|
|
log "Spoof applied: bootmgfw.efi is now Limine"
|
|
SPOOF_OK=1
|
|
else
|
|
warn "Could not copy Limine over bootmgfw.efi — spoof skipped"
|
|
fi
|
|
else
|
|
warn "bootmgfw.efi or Limine EFI missing — spoof skipped"
|
|
fi
|
|
umount "$SPOOFMNT"
|
|
else
|
|
warn "Could not mount Windows ESP for spoof — skipped"
|
|
fi
|
|
rmdir "$SPOOFMNT"
|
|
|
|
# If the spoof succeeded, the Windows menu entry must chainload the
|
|
# backed-up real loader (bootmgfw.efi is now Limine — chainloading it would
|
|
# loop). If it didn't, fall back to the original bootmgfw.efi.
|
|
if [[ "$SPOOF_OK" == "1" ]]; then
|
|
WIN_LOADER="bootmgfwbackup.efi"
|
|
else
|
|
WIN_LOADER="bootmgfw.efi"
|
|
fi
|
|
|
|
# Reference the Windows ESP by GPT PARTUUID via guid(), NOT the FAT serial
|
|
# via uuid() — Limine resolves GPT GUIDs, not FAT32 volume serials.
|
|
log "Adding Windows entry to limine.conf (chainloading $WIN_LOADER)"
|
|
cat >> /mnt/boot/limine.conf <<WINENTRY
|
|
|
|
/Windows Boot Manager
|
|
comment: Chainload the genuine Windows bootloader from the Windows ESP
|
|
protocol: efi_chainload
|
|
image_path: guid($WIN_ESP_PARTUUID):/EFI/Microsoft/Boot/$WIN_LOADER
|
|
WINENTRY
|
|
else
|
|
warn "No Windows ESP detected — Limine menu will not include a Windows entry"
|
|
fi
|
|
|
|
# Configure SDDM auto-login (Omarchy uses hyprland-uwsm session)
|
|
log "Configuring auto-login for $OMARCHY_USER..."
|
|
mkdir -p /mnt/etc/sddm.conf.d
|
|
cat > /mnt/etc/sddm.conf.d/autologin.conf << SDDMCONF
|
|
[Autologin]
|
|
User=$OMARCHY_USER
|
|
Session=hyprland-uwsm
|
|
[Theme]
|
|
Current=breeze
|
|
SDDMCONF
|
|
|
|
# Create UEFI boot entry
|
|
log "Creating UEFI boot entry..."
|
|
DRIVE=$(cat /tmp/install_drive)
|
|
EFI_PART=$(cat /tmp/efi_part)
|
|
EFI_PART_NUM=$(echo "$EFI_PART" | grep -oE '[0-9]+$')
|
|
|
|
# Remove any existing Omarchy or Limine entries to avoid duplicates
|
|
for entry in $(efibootmgr 2>/dev/null | grep -iE "Omarchy|Limine" | sed -n 's/^Boot\([0-9A-Fa-f]*\).*/\1/p'); do
|
|
log "Removing old boot entry: $entry"
|
|
efibootmgr -b "$entry" -B >/dev/null 2>&1 || true
|
|
done
|
|
|
|
# Create single Omarchy entry
|
|
efibootmgr --create --disk "$DRIVE" --part "$EFI_PART_NUM" \
|
|
--loader '\\EFI\\BOOT\\BOOTX64.EFI' --label 'Omarchy' >/dev/null 2>&1 || \
|
|
warn "Could not create UEFI entry - use F12 boot menu"
|
|
|
|
# Force Limine to the top of BootOrder so firmware lands on Limine first on
|
|
# well-behaved firmware. NOTE: this is best-effort only — many consumer
|
|
# firmwares ignore BootOrder and always boot bootmgfw.efi, which is why the
|
|
# bootmgfw spoof above is the real guarantee. The Windows menu entry is added
|
|
# by us explicitly (FIND_BOOTLOADERS does NOT detect Windows — it only scans
|
|
# for systemd-boot/rEFInd/EFI-fallback on the same ESP).
|
|
log "Locking BootOrder so Limine is the default bootloader..."
|
|
NEW_ID=$(efibootmgr 2>/dev/null | grep -i "Omarchy" | head -1 | sed -n 's/^Boot\([0-9A-Fa-f]*\)\*\?.*/\1/p')
|
|
BOOTORDER_LOCKED=0
|
|
if [[ -n "$NEW_ID" ]]; then
|
|
CURRENT=$(efibootmgr 2>/dev/null | sed -n 's/^BootOrder: //p')
|
|
if [[ -n "$CURRENT" ]]; then
|
|
REST=$(echo "$CURRENT" | tr ',' '\n' | grep -v "^${NEW_ID}$" | paste -sd, -)
|
|
if [[ -n "$REST" ]]; then
|
|
if efibootmgr -o "${NEW_ID},${REST}" >/dev/null 2>&1; then
|
|
log "BootOrder set: ${NEW_ID} (Omarchy) first, then ${REST}"
|
|
BOOTORDER_LOCKED=1
|
|
else
|
|
warn "Could not set BootOrder - firmware may still default to Windows"
|
|
fi
|
|
else
|
|
efibootmgr -o "${NEW_ID}" >/dev/null 2>&1 && BOOTORDER_LOCKED=1
|
|
fi
|
|
else
|
|
warn "No existing BootOrder found - firmware may auto-rebuild it"
|
|
fi
|
|
else
|
|
warn "New Omarchy entry not visible to efibootmgr - cannot lock BootOrder"
|
|
fi
|
|
|
|
# Verify the change actually stuck — some buggy firmware (notably Insyde
|
|
# on Acer) silently ignores efibootmgr -o and rebuilds BootOrder pointing
|
|
# at Windows. If verification fails, surface it loudly so the user knows
|
|
# they may need approach #3 (bootmgfw spoof) rather than discovering it
|
|
# on first reboot.
|
|
if [[ "$BOOTORDER_LOCKED" == "1" && -n "$NEW_ID" ]]; then
|
|
sleep 1
|
|
VERIFY=$(efibootmgr 2>/dev/null | sed -n 's/^BootOrder: //p' | cut -d, -f1)
|
|
if [[ "$VERIFY" == "$NEW_ID" ]]; then
|
|
log "BootOrder verified — Limine is first (${VERIFY})"
|
|
else
|
|
warn "BootOrder did NOT stick! Firmware reset it to: ${VERIFY:-<empty>}"
|
|
echo ""
|
|
echo " Your firmware (likely Insyde / Acer / HP) is ignoring efibootmgr."
|
|
echo " After first boot, if the machine goes straight to Windows:"
|
|
echo " 1. Use the firmware boot menu (F12/F8/Esc) once to pick Omarchy"
|
|
echo " 2. Inside Omarchy, consider the 'bootmgfw spoof' workaround"
|
|
echo " (install Limine at \\EFI\\Microsoft\\Boot\\bootmgfw.efi)"
|
|
echo ""
|
|
fi
|
|
fi
|
|
|
|
#===============================================================================
|
|
# CLEANUP
|
|
#===============================================================================
|
|
|
|
header "CLEANING UP"
|
|
|
|
umount /mnt/var/cache/omarchy/mirror/offline 2>/dev/null || true
|
|
umount /mnt/opt/packages 2>/dev/null || true
|
|
|
|
# Recursive unmount of /mnt. If something inside is still busy (lingering
|
|
# chroot pid, snapshot mount, etc), fall back to a lazy unmount so we still
|
|
# reach the success banner — the kernel will release the mount once the
|
|
# holder exits, and the user is about to reboot anyway.
|
|
if ! umount -R /mnt 2>/dev/null; then
|
|
warn "/mnt busy — attempting lazy unmount"
|
|
fuser -km /mnt 2>/dev/null || true
|
|
sleep 1
|
|
umount -R -l /mnt 2>/dev/null || warn "Could not fully unmount /mnt — reboot will clear"
|
|
fi
|
|
cryptsetup close cryptroot 2>/dev/null || warn "cryptsetup close deferred until reboot"
|
|
|
|
rm -f /tmp/luks_uuid /tmp/efi_part /tmp/root_part /tmp/install_drive /tmp/kernel_name
|
|
|
|
#===============================================================================
|
|
# DONE
|
|
#===============================================================================
|
|
|
|
header "INSTALLATION COMPLETE!"
|
|
|
|
echo ""
|
|
echo -e "${GREEN}╔══════════════════════════════════════════════════════════════╗${NC}"
|
|
echo -e "${GREEN}║ ║${NC}"
|
|
echo -e "${GREEN}║ Omarchy has been installed alongside Windows! ║${NC}"
|
|
echo -e "${GREEN}║ ║${NC}"
|
|
echo -e "${GREEN}╚══════════════════════════════════════════════════════════════╝${NC}"
|
|
echo ""
|
|
echo "To boot:"
|
|
echo " 1. Reboot your computer"
|
|
echo " 2. Press F12/F8/DEL at startup for boot menu"
|
|
echo " 3. Select 'Omarchy' for Linux"
|
|
echo " 4. Select 'Windows Boot Manager' for Windows"
|
|
echo ""
|
|
echo " Username: $OMARCHY_USER"
|
|
echo ""
|
|
read -p "Press Enter to reboot..." _
|
|
reboot
|
|
DUALBOOT_SCRIPT
|
|
|
|
chmod +x "$WORK_DIR/extracted/root/dualboot-setup.sh"
|
|
|
|
#===============================================================================
|
|
# MODIFY BOOT SEQUENCE
|
|
#===============================================================================
|
|
|
|
log "Configuring boot sequence..."
|
|
|
|
# Backup original automated script
|
|
if [[ -f "$WORK_DIR/extracted/root/.automated_script.sh" ]]; then
|
|
mv "$WORK_DIR/extracted/root/.automated_script.sh" "$WORK_DIR/extracted/root/.automated_script.sh.orig"
|
|
fi
|
|
|
|
# Replace .zlogin to run our dual-boot setup
|
|
# When a serial port exists (e.g. running under QEMU with -serial), tee the
|
|
# installer's full stdout+stderr to it so the host can capture a forensic log
|
|
# of the install run without scraping the QEMU window.
|
|
cat > "$WORK_DIR/extracted/root/.zlogin" << 'EOF'
|
|
# Omarchy Dual-Boot Installer
|
|
if [[ $(tty) == "/dev/tty1" ]]; then
|
|
if [[ -w /dev/ttyS0 ]]; then
|
|
/root/dualboot-setup.sh 2>&1 | tee /dev/ttyS0
|
|
else
|
|
/root/dualboot-setup.sh
|
|
fi
|
|
fi
|
|
EOF
|
|
|
|
log "Boot sequence configured"
|
|
|
|
#===============================================================================
|
|
# REPACK SQUASHFS
|
|
#===============================================================================
|
|
|
|
log "Repacking squashfs (this takes several minutes)..."
|
|
rm "$SQUASHFS"
|
|
mksquashfs "$WORK_DIR/extracted" "$SQUASHFS" -comp zstd -Xcompression-level 3
|
|
|
|
if [[ ! -f "$SQUASHFS" ]]; then
|
|
error "Failed to create squashfs!"
|
|
fi
|
|
log "New squashfs created: $(du -h "$SQUASHFS" | cut -f1)"
|
|
|
|
#===============================================================================
|
|
# UPDATE AIROOTFS CHECKSUM
|
|
#===============================================================================
|
|
|
|
# Recompute the airootfs.sha512 to match the new squashfs. archiso checks
|
|
# this only when the kernel cmdline includes verify=y (3.6 doesn't), but
|
|
# keeping it in sync is cheap insurance against future versions enabling it.
|
|
log "Updating airootfs.sha512..."
|
|
NEW_HASH=$(sha512sum "$SQUASHFS" | awk '{print $1}')
|
|
echo "$NEW_HASH airootfs.sfs" > "$WORK_DIR/newiso/arch/x86_64/airootfs.sha512"
|
|
|
|
#===============================================================================
|
|
# CREATE ISO (faithful boot-layout replay)
|
|
#===============================================================================
|
|
# Replay the original ISO's boot setup byte-for-byte and overlay only the
|
|
# files we changed (patched squashfs + its checksum). This preserves MBR,
|
|
# GPT, El Torito, the appended EFI partition, archisosearchuuid, and the
|
|
# archiso layout flags (--mbr-force-bootable, -partition_offset 16,
|
|
# -iso_mbr_part_type 0x00, -partition_cyl_align off) that mkarchiso emits.
|
|
# Recreating from scratch via -as mkisofs tends to drop those and breaks
|
|
# boot on stricter UEFI firmware (Acer Insyde, Lenovo, MSI). Works for any
|
|
# Omarchy/archiso version (3.4, 3.5, 3.6, future) without per-version tweaks.
|
|
|
|
log "Building new ISO via boot-image replay..."
|
|
rm -f "$OUTPUT_ISO"
|
|
|
|
xorriso \
|
|
-indev "$SOURCE_ISO" \
|
|
-outdev "$OUTPUT_ISO" \
|
|
-boot_image any replay \
|
|
-map "$SQUASHFS" /arch/x86_64/airootfs.sfs \
|
|
-map "$WORK_DIR/newiso/arch/x86_64/airootfs.sha512" /arch/x86_64/airootfs.sha512 \
|
|
-commit
|
|
|
|
#===============================================================================
|
|
# DONE
|
|
#===============================================================================
|
|
|
|
echo ""
|
|
echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
|
|
echo -e "${GREEN} SUCCESS!${NC}"
|
|
echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
|
|
echo ""
|
|
echo " Created: $OUTPUT_ISO"
|
|
echo " Size: $(du -h "$OUTPUT_ISO" | cut -f1)"
|
|
echo ""
|
|
echo " This ISO provides:"
|
|
echo " • Option 1: Dual-boot install (preserves Windows)"
|
|
echo " • Option 3: Standard install (original Omarchy installer)"
|
|
echo ""
|
|
echo " Next steps:"
|
|
echo " 1. Copy ISO to Ventoy USB drive"
|
|
echo " 2. Boot from Ventoy"
|
|
echo " 3. Select option 1 for dual-boot"
|
|
echo ""
|