Download W

There is one image, rebuilt every night from the current release — W is a rolling distribution, and an older image would only install older packages to update on first boot. The card above always shows the build that is published right now.

Requirements #

• x86_64 machine with UEFI firmware
• A disk you are willing to erase
• A working internet connection during installation

Plain or encrypted #

The installer asks one question that decides the boot stack:

• Plain — btrfs and GRUB, with snapshots listed in the boot menu.
• Encrypted — LUKS2 full-disk encryption unlocked by TPM2 where the machine has one, a recovery key, and Limine with snapshots in its menu; Secure Boot can be enabled afterwards.

Both get the same desktop and the same rollback. See Security and Recovery.

Installing #

1. Get an ISO — download the install image.

   There is one image, and it is rebuilt every night from this repository. W is a rolling distribution, so freezing a download per version would only hand you older packages to update on first boot. The file names itself w-<release>-<build date>-x86_64.iso, and the installed system records the same two facts in /etc/os-release as IMAGE_VERSION and W_BUILD_DATE: which version of W's own configuration it is, and which day its packages came from Arch.

   The release page carries the image's SHA-256; the file is replaced by every nightly build, so check it against the download you actually have:

   sha256sum w-*-x86_64.iso

   Or build your own — the same build that produces the published image, and the way to get an image for hardware the default one does not cover.

2. Boot it. The installer starts by itself on the first console. If you leave it, bring it back with bash /root/w/scripts/install.sh.

3. Answer the wizard. It confirms once before touching the disk, and everything after that point is destructive — read that screen.

4. Reboot. The first boot finishes setup (packages, AUR builds, user environment) and logs the whole thing to /var/log/w/.

Checking the image #

The SHA-256 above catches a broken download — but it sits next to the file, so it proves nothing about who made it:

sha256sum w-*-x86_64.iso

The image's signature is its build provenance: a Sigstore attestation, made by the build itself, that this exact file was built by the edge-iso workflow of the W repository from a given commit. Check it with the GitHub CLI:

gh attestation verify w-*-x86_64.iso --repo tarkh/w

The commit it names is a release snapshot, signed with the W release key — the same key every W machine checks before it accepts an update. In a clone of the repository:

git -c gpg.ssh.allowedSignersFile=rootfs/usr/share/w/update/w-release.allowed_signers \
  verify-commit <commit>

There is no key in the build to steal: the release key never leaves its owner, and the attestation's certificate is issued for that one run. How updates are trusted afterwards is in SECURITY.md.

Building your own ISO #

The published image is not special — it is what this repository builds, and you can build the same thing:

git clone https://github.com/tarkh/w
cd w
./scripts/build-iso.sh           # writes to archiso/out/

Run it as your normal user, not with sudo: it elevates only for mkarchiso itself, and the AUR packages it bakes in must not be built as root. It needs archiso and base-devel installed. On a machine that is not Arch — or if you would rather not install those — ci/iso-build-container.sh runs the identical build inside a container; that script is literally what produces the nightly image, so its output is the published one.

The build takes roughly 10–20 minutes and writes w-<release>-<date>-x86_64.iso.

Broadcom Wi-Fi: vintage MacBook Pro and friends #

A handful of older Broadcom chips — BCM43142 [14e4:4365], BCM4360 [14e4:43a0], the ones in machines like the 2013–2015 MacBook Pro — are in no in-kernel driver's table. Linux shows them with no driver bound at all, and they need Broadcom's own wl module.

The installed system handles this by itself: the installer detects such a chip and installs the driver for it. What it cannot help with is the live session, and that matters on a laptop with no Ethernet port: if the installer cannot bring the network up, it cannot install anything. Until September 2026 the image covered this because Arch shipped a prebuilt driver package; that package is gone from the official repositories, and upstream archiso dropped it rather than replacing it. Only a source (DKMS) package remains, so covering the live session again means carrying a compiler and the kernel headers in the image — about 570 MB before compression, a measured 139 MB on the finished ISO (1583 → 1722 MB), to build a 2 MB driver.

That is a bad trade for everyone who does not have such a chip, so it is off by default. If you do have one, build yourself an image with it:

./scripts/build-iso.sh --broadcom-wl

Or, equivalently, set BROADCOM_WL=on near the top of scripts/build-iso.sh — the option is a single line there, with the reasoning next to it.

You do not have to pick a driver version. The Broadcom source needs a fresh patch for each new kernel series, and Arch lands the kernel before the rebuilt driver leaves the testing repository — so during that window the ordinary package does not compile against the kernel the ISO ships. The build resolves the newest driver across all repositories and, if that one is still in testing, pulls in that single package while everything else in the image continues to come from the normal repositories.

The honest limit: if Arch ships a kernel series before the driver has a patch for it at all, no version compiles and the build stops with a compiler error. There is nothing to do about that but wait for the patch — or build with the option off.