
## Abstract

Audiophiles... what a term. Hobbyists craving for audio quality and the best reverse hearing aid enjoyer that loves being deafened by majestic sounds of music. The bastion of audio purity and perfect fidelity.

But all is not well for audiophiles nowadays, too many questionable myths, too many... pseudoscientific claims circulating around the community it reeks of disbelief and utter disappointment.

In this post, I will pretty much debunk and put a burning rod through the magical, somewhat arcane, claims that surrounds the audiophile community with shrouds of uncertainty and inexplicably confusing ambiguity.

Bear with me as I embrace my truly coldhearted, thousand suns rage of rants towards many aspects that corrupts the mind of the audiophiles.

## Claim 1: EQ is bad for whatever reasons

As Crinacle stated in one of his videos:

> EQ is a free upgrade.

...and he is right. A proper EQ can make your listening experience a better one. No snake oils, no placebo, no religious dogma, just pure utterly decades worth of tried and tested method of making the sound better.

If you want more power and flexibility, you can try out doing parametric EQ in tandem of measurements with clearly defined standards (either IEC 711 or B&K 5128 for IEMs and Headphones) or simply tune by your ears using that.

You really can't do it if you have iPhones cause fuck Apple in general, but for other OSes, you have nice quality options. In Windows, you can use EqualizerAPO, easily the best bet. In Linux, you have EasyEffects (I don't know anything else better than that, really). And in Android, you have just too much plethora of options ranging from Poweramp stuffs, Hiby, JamesDSP, Viper4Android, etc.

## Claim 2: Cables or DACs or whatever changes the sound signature

...no. Plain, obvious, scientifically proven, no. Only EQ and the way the transducer is manufactured and tuned actually does. And DSP is... also EQ. Unless your cables are 20 meters long it picks up the hum of someone yanking their baseball bat and has stupid high impedance it won't even make a single dent to the signature. I mean take a look at [this article](https://www.zdnet.com/home-and-office/networking/coat-hanger-wire-is-just-as-good-as-a-high-quality-speaker-cable/). Now what do you think?

The fact that audiophiles glorify this stupid myth as if it's their religious dogma kind of propaganda is beyond annoying.

Sure, AMPs *may* change the sound signature. But a proper DAC is very, and when I said very, I mean *VERY* transparent. Like bruh, all DAC literally do is convert your digital signal to analog one, hence the name Digital to Analog Converter, DAC. They are not supposed to change the sound cause they are supposed to provide an accurate, unfiltered, raw, transparent representation of the digital signal in... an analog one. If your DAC change the sound signature, it's because they have a tuned AMP inside or simply a bad DAC.

## Claim 3: I can hear the difference between FLAC and highest quality MP3

Just... no. You will hear... barely any difference... and that's if you count that there is any difference at all cause there's... none of it. Not that I never used FLAC myself, in fact I heavily use FLACs for my audio files and it's for the right reasons - FLACs are meant to be used as an archiving format rather than your hurr durr muh quality I can hear the difference and everyone saying not is lying.

Yes, it *does* have better quality than MP3 or any lossy format. But lemme tell you something - can you even barely hear **ANYTHING** past 20 kHz? Hell, can you even hear **SOMETHING** past 18 kHz?

Sure, sure. More bit depth will provide better dynamic range. But hear me out - can you even barely comprehend how autistically **LOUD** is everything past 100 decibels? Have you even once suffered from severe tinnitus? Cause that thing will give you one for no amounts of money quite easily.

## Claim 4: Burn-ins help to enhance the sound quality

Nah, this one is only applicable if you own an ancient speaker and want to loose up the movement of the diaphragm inside. And even then it's not really worth the task done.

You know what is better than "burning" your audio peripheral? Yes, do those... stuffs directly on your ears with actual music. Your ears are the ones that needs to adapt, not the IEMs, not the speakers, not the headphones, with an added note that all of those... can be tuned by EQ.

In general, those companies that told you to do burn-ins usually does that to trick you into participating in what I call as the "return window skipping" maneuver. Basically... if your audio peripherals turns out to be shit, you can't send it back for a refund after the amount of time you spent to do burn-ins.

## Conclusion

In conclusion, dear readers, we have embarked on a journey to unravel the elusive world of audiophile claims. We have waded through convoluted discussions of... whatever they believe is the next greatest thing... that promise to transport us to sonic nirvana.

Alas, the veil of mystery has been lifted, revealing a landscape brimming with skeptical eyebrows and eye-rolls. While some audiophiles may genuinely believe in the power of their expensive, snake-oil-infused cables, let us not forget that scientific evidence and rationality lay dormant in the shadows.

So, dear audiophiles, as you prod the edges of plausibility with your golden-tipped tuning forks, remember: the true symphony resides in the humble union of logic and reason.


The amount of snake oil is so obnoxious it annoys me to hell and back.

Demystifying Audiophile Claims


## Abstract

A Telegram userbot is basically something that can help you manage stuffs here and there in Telegram such as groups etc. How it works is that you type the command, for example `.time`, then you send it anywhere in Telegram, the userbot will detect the command and edit your message to show you the output of current time in your local timezone in that message. Take some note that some commands do require specific conditions to be met in order to work properly. An userbot is not like usual Telegram bots which have their dedicated username on it but it acts as a session of your own account. An userbot is safe to use providing you don't use something that Telegram is probably having some sense of dislike to such as `.spam`. Heroku gives you 550 hours of free monthly usage as well as 450 more if you add your credit card as your billing info. Don't worry as it's completely free and you would not have to pay any cents at all.

> Update: This post now includes how to deploy it locally. So cheers!

## Setting Up

1. API Hash and API ID.

   - Login to [my.telegram.org](https://my.telegram.org) with your Telegram account.
   - Go to **API Development Tools**, fill out the form for creating an app. You'll get the required API Hash and API ID there.
     > Note: Nothing really matters, fill in anything that you want.

2. Generate a session string.

   - Go to [here](http://sessiongen.irvanmalik48.repl.run/) and click on run button on top.
   - Enter the API Hash and API ID you've got from the previous step.
   - Enter your phone number with country code (example: +62896xxxxxxxx).
   - Follow further instructions then check your **Saved Messages** in Telegram, there will be your session string.
     > Note: Don't share your session string to anyone, anywhere, anytime. Imagine a key to your house, then imagine if it's in someone's hand.

3. Get BOTLOG_CHATID (Optional but recommended).

   - Create a group with you and add @MissRose_bot to your group.
   - Type `/id` and send it to the group. Rose will give you the group chat ID.
     > Note: Don't leave out the - in there. It is essential.

4. Get Heroku API key (if you use Heroku).

   - Make a Heroku account [here](https://signup.heroku.com).
   - Head [here](https://dashboard.heroku.com/account) and get your Heroku API key.
     > Note: Heroku gives you free 550 hours of usage. Enter in your billing info to receive another free 450 hours.

## Deploying

The next step is to deploy it. There are 2 ways of deploying it:

### Heroku way

1. Head to WeebProject's Github repo [here](https://github.com/BianSepang/WeebProject) or [use this link](https://heroku.com/deploy?template=https://github.com/BianSepang/WeebProject/tree/master) to directly deploy it to Heroku.
2. Fill your app name and choose which region is closest to your location.
3. Fill in the form with everything you got from previous section. Also read through the options of configuration and add/change them according to your own needs.
   > Note: You can change the values anytime you want later on.
4. Leave the logging options as they are (It's enabled by default).
5. Click on **Deploy App** option at the bottom of the page.
6. Click on the **View** button once it's successfully deployed.
7. Navigate to the **Resources** tab, click the pencil icon, and turn the worker on if it's not enabled yet.
8. Click on **More** button on the top right, and then click on **View logs**.
9. If it prints `Congratulations, the bot is up and running! Send .help in any chat for more info.` or something similar, then everything's good.
   > You can send `.help` in any chat for more info. If you want info on specific module, send `.help` followed by the name of module listed in the `.help` section you've opened before.

### Deploy Locally

> Note: You'll need to run Linux to do this and have installed `docker` and `docker-compose` and also enabled the `docker.service` (if you don't know how to enable it then here's a quick command: `sudo systemctl enable --now docker`). Windows user better get their WSL ready.

1. Clone the repository using git and use it as our working directory.

```bash
git clone https://github.com/BianSepang/WeebProject .userbot
cd .userbot
```

2. Copy `sample_config.env` and paste it as `config.env` there.

```bash
cp sample_config.env config.env
```

3. Edit `config.env` using your favorite text editor and add the required values. Set `DATABASE_URL` to `postgresql://USERNAME:PASSWORD@db:5432/weebproject` where USERNAME is your preferred username and PASSWORD is your preferred password.

4. After you done, edit `docker-compose.yml` using your favorite editor and change USERNAME and PASSWORD matching what you set before.

5. Run it using `docker-compose`.

```bash
sudo docker-compose up
```

#### Systemd Service (Optional)

You can do a systemd service to autostart the userbot everytime you boot.

```bash
[Unit]
Description=Userbot
Requires=docker.service
After=docker.service

[Service]
WorkingDirectory=/home/(your-linux-username)/.userbot/
ExecStart=docker-compose up
ExecStop=docker-compose down
TimeoutStartSec=0
Restart=on-failure

[Install]
WantedBy=multi-user.target
```

Save it at `/etc/systemd/system/userbot.service` and change the `WorkingDirectory` value accordingly. Enable and start it using:

```bash
sudo systemctl enable --now userbot
```

## Updates

Send `.update` in any chat. If there's any, send `.update deploy` to update the userbot.

## Wrapping up

There you go! That's all you need to deploy a userbot. As always, thank you for following this guide.

## References

- https://github.com/BianSepang/WeebProject - Weebproject - BianSepang
- https://kenharris.xyz/userbot.html - Setting up a Telegram userbot - KenHV
- https://nru.my.id/post/cara-pasang-userbot-telegram-dengen-docker/ - Cara Pasang Userbot Telegram dengan Docker - んる


Deploy your own userbot with Heroku or locally.

How to Deploy a Telegram Userbot


## Abstract

This is just a tutorial on how to do a LAMP stack manually on Arch Linux. Without further talks, let's cut into this.

## Setting Up

Install the required packages:

```bash
sudo pacman -S php php-apache phpmyadmin apache mariadb
```

> Note: You can find old versions of PHP in AUR

### Configuring MariaDB

MariaDB is a reliable, high performance and full-featured database server which aims to be an 'always Free, backward compatible, drop-in' replacement of MySQL. Since 2013 MariaDB is Arch Linux's default implementation of MySQL.

1. To start configuring, run this command:

```bash
sudo mariadb-install-db --user=mysql --basedir=/usr --datadir=/var/lib/mysql
```

2. Then enable and start `mariadb.service` by issuing this command:

```bash
sudo systemctl enable --now mariadb.service
```

3. Log in as root user on the MySQL server by using the following command:

```bash
sudo mysql -u root -p
```

> Note: Default root user has no password. Press enter to continue.

4. Issue the command to create a user and grant the privileges:

```sql
MariaDB> CREATE USER 'your-name'@'localhost' IDENTIFIED BY 'your-pass';
MariaDB> GRANT ALL PRIVILEGES ON *.* TO 'your-name'@'localhost';
MariaDB> FLUSH PRIVILEGES;
MariaDB> quit
```

> Note: Change `your-name` with your desired username choices. Further informations can be referred from [Arch Wiki MariaDB page](https://wiki.archlinux.org/index.php/MariaDB).

### Configuring PHP

PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. The main PHP configuration file is well documented and located at `/etc/php/php.ini`. In order to make PHP work with MariaDB, uncomment the following lines in `/etc/php/php.ini`:

```php
extension=iconv
extension=pdo_mysql
extension=mysqli
```

> Note: the extension `iconv` is to be uncommented to avoid an error in PHP8 regarding the extension itself. Further informations can be reffered from [Arch Wiki PHP page](https://wiki.archlinux.org/index.php/PHP).

### Configuring Apache

The Apache HTTP Server, or Apache for short, is a very popular web server, developed by the Apache Software Foundation. Apache configuration files are located in `/etc/httpd/conf`. The main configuration file is `/etc/httpd/conf/httpd.conf`, which includes various other configuration files. The default configuration file should be fine for a simple setup. By default, it will serve the directory `/srv/http` to anyone who visits your website. You can start Apache by running `sudo systemctl enable --now httpd.service`. To configure Apache to work with PHP, we'll be using the `libphp` method:

1. Comment the line in `/etc/httpd/conf/httpd.conf`:

```php
#LoadModule mpm_event_module modules/mod_mpm_event.so
```

2. Uncomment the line:

```php
LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
```

> Note: The above is required, because libphp.so included with the package does not work with mod_mpm_event, but will only work mod_mpm_prefork instead.

3. To enable PHP, add these lines to `/etc/httpd/conf/httpd.conf`:

- Place this at the end of the `LoadModule` list:

```php
LoadModule php_module modules/libphp.so
AddHandler php-script .php
```

- Place this at the end of the `Include` list:

```php
include conf / extra / php_module . conf;
```

- Restart `httpd.service` by issuing `sudo systemctl restart httpd.service` command.
  > Note: This method is probably the easiest, but is also the least scalable: it is suitable for a light request load. It also requires you to change the mpm module, which may cause problems with other extensions (e.g. it is not compatible with HTTP2). For further readings, refer to [Arch Wiki Apache page](https://wiki.archlinux.org/index.php/Apache_HTTP_Server).

### Configuring phpMyAdmin

phpMyAdmin is a free and open source administration tool for MySQL and MariaDB. As a portable web application written primarily in PHP, it has become one of the most popular MySQL administration tools, especially for web hosting services.

1. Create the Apache configuration file in `/etc/httpd/conf/extra/phpmyadmin.conf`:

```php
Alias /phpmyadmin "/usr/share/webapps/phpMyAdmin"
<Directory "/usr/share/webapps/phpMyAdmin">
    DirectoryIndex index.php
    AllowOverride All
    Options FollowSymlinks
    Require all granted
</Directory>
```

2. Include the file in `/etc/httpd/conf/httpd.conf`:

```php
include conf / extra / phpmyadmin . conf;
```

3. To allow the usage of the phpMyAdmin setup script (e.g. http://localhost/phpmyadmin/setup), make sure `/usr/share/webapps/phpMyAdmin` is writable for the http user:

```bash
sudo mkdir /usr/share/webapps/phpMyAdmin/config
sudo chown http:http /usr/share/webapps/phpMyAdmin/config
sudo chmod 750 /usr/share/webapps/phpMyAdmin/config
```

4. Add `blowfish_secret` passphrase (You can search a generator for one) in `/usr/share/webapps/phpMyAdmin/config.inc.php`:

```php
$cfg["blowfish_secret"] = "your-passphrase-here";
```

5. In `/usr/share/webapps/phpMyAdmin/config.inc.php`, uncomment and change them correspondingly to the ones you set in MariaDB configuration (`your-name` and `your-pass`):

```php
/* User used to manipulate with storage */
// $cfg['Servers'][$i]['controlhost'] = 'my-host';
// $cfg['Servers'][$i]['controlport'] = '3306';
$cfg["Servers"][$i]["controluser"] = "your-name";
$cfg["Servers"][$i]["controlpass"] = "your-pass";

/* Storage database and tables */
$cfg["Servers"][$i]["pmadb"] = "phpmyadmin";
$cfg["Servers"][$i]["bookmarktable"] = "pma__bookmark";
$cfg["Servers"][$i]["relation"] = "pma__relation";
$cfg["Servers"][$i]["table_info"] = "pma__table_info";
$cfg["Servers"][$i]["table_coords"] = "pma__table_coords";
$cfg["Servers"][$i]["pdf_pages"] = "pma__pdf_pages";
$cfg["Servers"][$i]["column_info"] = "pma__column_info";
$cfg["Servers"][$i]["history"] = "pma__history";
$cfg["Servers"][$i]["table_uiprefs"] = "pma__table_uiprefs";
$cfg["Servers"][$i]["tracking"] = "pma__tracking";
$cfg["Servers"][$i]["userconfig"] = "pma__userconfig";
$cfg["Servers"][$i]["recent"] = "pma__recent";
$cfg["Servers"][$i]["favorite"] = "pma__favorite";
$cfg["Servers"][$i]["users"] = "pma__users";
$cfg["Servers"][$i]["usergroups"] = "pma__usergroups";
$cfg["Servers"][$i]["navigationhiding"] = "pma__navigationhiding";
$cfg["Servers"][$i]["savedsearches"] = "pma__savedsearches";
$cfg["Servers"][$i]["central_columns"] = "pma__central_columns";
$cfg["Servers"][$i]["designer_settings"] = "pma__designer_settings";
$cfg["Servers"][$i]["export_templates"] = "pma__export_templates";
```

6. Execute `mysql -u root -p < /usr/share/webapps/phpMyAdmin/sql/create_tables.sql` in the command line to create the required tables.
7. Remove temporary configuration directory once configuration is done:

```bash
sudo rm -r /usr/share/webapps/phpMyAdmin/config
```

8. Restart the `httpd.service` again just for additional measures. For further readings, refer to [Arch Wiki phpMyAdmin page](https://wiki.archlinux.org/index.php/PhpMyAdmin).

## Finishing

Open http://localhost/phpmyadmin/index.php and login to see if everything works well.

## Sources

1. Arch Wiki. https://wiki.archlinux.org/.
2. Wikipedia. https://en.wikipedia.org/.


Setup Apache, MySQL, and phpMyAdmin manually on Arch.

Arch Apache, MySQL, and PMA Manual Setup


## Abstract

Secure boot is a security standard developed by members of the PC industry to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM). When the PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers (also known as Option ROMs), EFI applications, and the operating system. If the signatures are valid, the PC boots, and the firmware gives control to the operating system.

## Implementing Secure Boot

### Disclaimer

> I am not responsible for any hardware bricks. You do it on yourself, you agree to be responsible on what you do.

### Before you do anything

Install `efitools` package as it will be needed throughout the tutorial. You also have to install `sbsigntools` and `openssl` as it'll be needed for the tutorial. Make sure your Secure Boot is still disabled and you have done nothing to it aside from disabling it.

#### Backup all old stuffs

```bash
mkdir -p SB/old && cd SB
efi-readvar -v PK -o old_PK.esl
efi-readvar -v KEK -o old_KEK.esl
efi-readvar -v db -o old_db.esl
efi-readvar -v dbx -o old_dbx.esl
```

#### Create your own keys

You'll find these kinds of file: _.key_, _.crt_, _.cer_, _.esl_, _.auth_ commonly throughout the tutorial.\
As per Arch Wiki's reference:

- `.key` : PEM format private keys for EFI binary and EFI signature list signing.
- `.crt` : PEM format certificates for `sbsign`, `sbvarsign` and `sign-efi-sig-list`.
- `.cer` : DER format certificates for firmware.
- `.esl` : Certificates in an EFI Signature List for `sbvarsign`, `efi-updatevar`, KeyTool and firmware.
- `.auth` : Certificates in an EFI Signature List with an authentication header (i.e. a signed certificate update file) for `efi-updatevar`, `sbkeysync`, KeyTool and firmware.

First, create a GUID for owner identification:

```bash
uuidgen --random > GUID.txt
```

Platform Key:

```bash
openssl req -newkey rsa:4096 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj "/CN=my Platform Key/" -out PK.crt
openssl x509 -outform DER -in PK.crt -out PK.cer
cert-to-efi-sig-list -g "$(< GUID.txt)" PK.crt PK.esl
sign-efi-sig-list -g "$(< GUID.txt)" -k PK.key -c PK.crt PK PK.esl PK.auth
```

Sign an empty file to allow removing Platform Key when in "User Mode":

```bash
sign-efi-sig-list -g "$(< GUID.txt)" -c PK.crt -k PK.key PK /dev/null rm_PK.auth
```

Key Exchange Key:

```bash
openssl req -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj "/CN=my Key Exchange Key/" -out KEK.crt
openssl x509 -outform DER -in KEK.crt -out KEK.cer
cert-to-efi-sig-list -g "$(< GUID.txt)" KEK.crt KEK.esl
sign-efi-sig-list -g "$(< GUID.txt)" -k PK.key -c PK.crt KEK KEK.esl KEK.auth
```

Signature Database Key:

```bash
openssl req -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj "/CN=my Signature Database key/" -out db.crt
openssl x509 -outform DER -in db.crt -out db.cer
cert-to-efi-sig-list -g "$(< GUID.txt)" db.crt db.esl
sign-efi-sig-list -g "$(< GUID.txt)" -k KEK.key -c KEK.crt db db.esl db.auth
```

#### Optional: Adding Microsoft keys

This is useful when you're dualbooting Windows.

Download this stuffs and copy it to the SB folder we made previously:

- [Microsoft Windows Production PCA 2011 for Windows](https://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt)
- [Microsoft Corporation UEFI CA 2011 for third-party binaries like UEFI drivers, option ROMs etc.](https://www.microsoft.com/pkiops/certs/MicCorUEFCA2011_2011-06-27.crt)

Create EFI Signature Lists from Microsoft's DER format certificates using Microsoft's GUID (`77fa9abd-0359-4d32-bd60-28f4e78f784b`) and combine them in one file for simplicity:

```bash
sbsiglist --owner 77fa9abd-0359-4d32-bd60-28f4e78f784b --type x509 --output MS_Win_db.esl MicWinProPCA2011_2011-10-19.crt
sbsiglist --owner 77fa9abd-0359-4d32-bd60-28f4e78f784b --type x509 --output MS_UEFI_db.esl MicCorUEFCA2011_2011-06-27.crt
cat MS_Win_db.esl MS_UEFI_db.esl > MS_db.esl
```

Sign a db update with your KEK. Use `sign-efi-sig-list` with option `-a` to add not replace a db certificate:

```bash
sign-efi-sig-list -a -g 77fa9abd-0359-4d32-bd60-28f4e78f784b -k KEK.key -c KEK.crt db MS_db.esl add_MS_db.auth
```

#### Reinstalling GRUB

There are some issues in Arch's GRUB currently that throws `Error : verification requested but nobody cares.` and to fix that, you need to reinstall GRUB first with `tpm` module and shim lock disabled:

```bash
sudo grub-install --target=x86_64-efi --efi-directory=your-esp --bootloader-id=Arch --modules="tpm" --disable-shim-lock
sudo grub-mkconfig -o /boot/grub/grub.cfg
```

> Change your-esp to, well, your esp path.

See [references](#references) for more info.

#### Signing EFI binaries

```bash
sudo sbsign --key db.key --cert db.crt --output /boot/vmlinuz-linux /boot/vmlinuz-linux # You can do others too
sudo sbsign --key db.key --cert db.crt --output /path/to/esp/Arch/grubx64.efi /path/to/esp/EFI/Arch/grubx64.efi
```

> Change accordingly into your esp partition path e.g mine's /boot/EFI and your EFI path.

#### Prepare pacman hook for automatic kernel signing

```bash
sudo mkdir -p /etc/pacman.d/hooks && sudo mkdir -p /usr/share/libalpm/scripts
sudo cp /usr/share/libalpm/hooks/90-mkinitcpio-install.hook /etc/pacman.d/hooks/
sudo cp /usr/share/libalpm/scripts/mkinitcpio-install /usr/local/share/libalpm/scripts/
```

Edit `/etc/pacman.d/hooks/90-mkinitcpio-install.hook` and replace:

```bash
Exec = /usr/share/libalpm/scripts/mkinitcpio-install
```

with:

```bash
Exec = /usr/local/share/libalpm/scripts/mkinitcpio-install
```

Edit `/usr/local/share/libalpm/scripts/mkinitcpio-install` and replace:

```bash
install -Dm644 "${line}" "/boot/vmlinuz-${pkgbase}"
```

with:

```bash
sbsign --key /path/to/db.key --cert /path/to/db.crt --output "/boot/vmlinuz-${pkgbase}" "${line}"
```

#### Put your firmware to "Setup Mode"

Go to firmware settings and erase all certificates. This will put Secure Boot into setup mode. You can verify that by booting to the OS and run `bootctl status`.

#### Enroll your keys

Create the necessary folders then get in to the SB directory we created previously (since you're rebooting, duh):

```bash
sudo mkdir -p /etc/secureboot/keys/{db,dbx,KEK,PK}
cd SB
```

Then copy all the `.auth` files into their respective directory:

```bash
sudo cp PK.auth /etc/secureboot/keys/PK/
sudo cp KEK.auth /etc/secureboot/keys/KEK/
sudo cp db.auth /etc/secureboot/keys/db/

## If you're doing Windows keys
sudo cp add_MS_db.auth /etc/secureboot/keys/db/
```

See what changes will `sbkeysync` shall do to your system's UEFI keystore:

```bash
sudo sbkeysync --pk --dry-run --verbose
```

Before enrolling, change efivars file attributes so that no write errors are present using:

```bash
sudo chattr -i /sys/firmware/efi/efivars/{PK,KEK,db}*
```

Finally, use `sbkeysync` to enroll your keys.

```bash
sudo sbkeysync --verbose
```

We're not enrolling the PK yet, so in order to avoid some invalid arguments issues, use `efi-updatevar` instead:

```bash
sudo efi-updatevar -f PK.auth PK
```

> If you got write errors when doing `efi-updatevar` then do `sudo chattr -i /sys/firmware/efi/efivars/{PK,KEK,db}*` once again before enrolling PK.

After enrolling your PK, Secure Boot will enter "User Mode" again.

### Finishing Touch

After all the hassles, you might want to get into your firmware settings and enable Secure Boot. Try booting your Arch Linux now with Secure Boot enabled. It should be all good.

## Verdict

Well, no more words to say. Enjoy playing Valorant if you have Windows 11 installed!

## References

- https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot - Unified Extensible Firmware Interface/Secure Boot - Arch Wiki
- https://www.mail-archive.com/bug-grub@gnu.org/msg17028.html - [bug #60211] error: verification requested but nobody cares | Reported by Giancarlo Razzolini - bug-grub - The Mail Archive


Arch Linux Secure Boot Tutorial


## Abstract

So I want to show you how to install Arch Linux with btrfs dual booting with Windows. You can read about Arch here: [Arch Wiki - Arch Linux](https://wiki.archlinux.org/title/Arch_Linux).

## Prerequisite

- A USB drive for Arch ISO (8 GB recommended)
- Arch ISO ([Get it here](https://archlinux.org/download/))
- x86_64 device
- UEFI
- Minimum 512 MB of RAM (more than 2 GB recommended)
- 20-30 GB free disk space (60 GB upwards recommended)
- Internet connection

## Installation Process

Even tho I'll show you how-to, Arch Wiki itself has substantial informations regarding the installation. Be sure to check out the official wiki for reference while also following this guide: [Arch Wiki - Installation Guide](https://wiki.archlinux.org/title/Installation_guide).

### Preparing installation medium

At this step, I assume you already have the Arch ISO and know how to burn ISO files to USB. Now, burn the ISO to your USB using Etcher, Rufus, or any tools that you like. I recommend Ventoy as you only need to copy the ISO to your flashdisk.

Make sure to shrink your Windows partition and then create 3 empty partitions from Windows Partition Manager (or something like that idk) consisting of:

- 512 MB empty partition (EFI partition)
- 20-30 GB or more empty partition (root partition)
- 4 GB or more empty partition (Swap partition)

### Keymapping (Optional)

> Note: If you use standard QWERTY layout, skip this step.

Check the list of keymaps available using:

```bash
localectl list-keymaps
```

Then set your preferred keymap by using:

```bash
loadkeys [your-keymap]
```

### Connecting to the internet

Arch uses `iwctl` for connecting to the internet via Wifi. If you're using USB tethering or Ethernet, skip this step.\
Run `iwctl` by issuing:

```bash
iwctl
```

First, if you do not know your wireless device name, list all Wi-Fi devices:

```markdown
[iwd]# device list
```

Then, to scan for networks:

```markdown
[iwd]# station _device_ scan
```

You can then list all available networks:

```markdown
[iwd]# station _device_ get-networks
```

Finally, to connect to a network:

```markdown
[iwd]# station _device_ connect _SSID_
```

You can check your network by just:

```bash
ping 8.8.8.8 -c 3
```

### Set time

Use `timedatectl` to ensure the system clock is accurate:

```bash
timedatectl set-ntp true
```

### Partitioning

Since we've already created 3 partitions in Windows, we can just jump on to formatting the partitions. But first, you must check which partitions are going to be used.\
The command is:

```bash
fdisk -l
```

For example, my layout looks like this:

- /dev/nvme0n1p6 | 512 MB => This is going to be the EFI partition.
- /dev/nvme0n1p7 | 4 GB => This will be the swap partition.
- /dev/nvme0n1p8 | 71.7 GB => This is going to be the root partition.

Yours might look different, but the concept is the same.\
Then we format our partitions using `mkfs` and `mkswap`.

For the EFI boot entry:

```bash
mkfs.fat -F32 /dev/nvme0n1p6
```

For the swap partition, we need to make and also activate it:

```bash
mkswap /dev/nvme0n1p7
swapon /dev/nvme0n1p7
```

For the root partition, we need to format it as btrfs:

```bash
mkfs.btrfs /dev/nvme0n1p8
```

### Mounting the partitions

Now that we have formatted the partitions, we need to mount it (exception for swap).

#### Mounting the root partition

To mount the root partition, issue the command:

```bash
mount /dev/nvme0n1p8 /mnt
```

#### Creating and mounting btrfs subvolumes

Since we've mounted the root partition, we can proceed into creating btrfs subvolumes.\
We'll create 6 different subvolumes:

- @ => root directory.
- @home => home directory. Contains all your personal data.
- @var => var directory. Contains logs, etc.
- @opt => opt directory. Contains third party products.
- @tmp => tmp directory. Contains temp files, etc.
- @.snapshot => snapshot directory. Contains btrfs snapshots. (Can be excluded if you want to use Timeshift)

Create the subvolumes:

```bash
btrfs su cr /mnt/@
btrfs su cr /mnt/@home
btrfs su cr /mnt/@var
btrfs su cr /mnt/@opt
btrfs su cr /mnt/@tmp
btrfs su cr /mnt/@.snapshots
umount /mnt
```

Now to mount them:

```bash
mount -o noatime,commit=120,compress-force=zstd:7,discard=async,space_cache,subvol=@ /dev/nvme0n1p8 /mnt
mkdir /mnt/{boot,home,var,opt,tmp,.snapshots} # You must create the folders before proceeding
mount -o noatime,commit=120,compress-force=zstd:7,discard=async,space_cache,subvol=@home /dev/nvme0n1p8 /mnt/home
mount -o noatime,commit=120,compress-force=zstd:7,discard=async,space_cache,subvol=@tmp /dev/nvme0n1p8 /mnt/tmp
mount -o noatime,commit=120,compress-force=zstd:7,discard=async,space_cache,subvol=@opt /dev/nvme0n1p8 /mnt/opt
mount -o noatime,commit=120,compress-force=zstd:7,discard=async,space_cache,subvol=@.snapshots /dev/nvme0n1p8 /mnt/.snapshots
mount -o discard=async,subvol=@var /dev/nvme0n1p8 /mnt/var
```

A little review about the options:

- noatime: No access time. Improves performance by not writing time when the file was accessed.
- commit: Perodic interval (in seconds) in which data is synchronized to permanent storage.
- compress-force: Activating forced compression and choosing the algorithm for compression. (Believe me, this is good, no joke)
- discard=async: Frees unused block from an SSD drive supporting the command. With discard=async, freed extents are not discarded immediately, but grouped together and trimmed later by a separate worker thread, improving commit latency. You can opt out of this if you use HDD.
- space_cache: Enables kernel to know where block of free space is on a disk to enable it to write data immediately after file creation.
- subvol: Choosing the subvolume to mount.

#### Mounting the EFI (boot) partition

To mount it, just issue:

```bash
mount /dev/nvme0n1p6 /mnt/boot
```

#### Verify if you are doing it correctly

To check what is being mounted, issue:

```bash
lsblk
```

### Base system installation

For AMD CPUs:

```bash
pacstrap /mnt base linux linux-firmware nano amd-ucode btrfs-progs
```

For Intel CPUs:

```bash
pacstrap /mnt base linux linux-firmware nano intel-ucode btrfs-progs
```

### Generating fstab

After the base system installation is done, now we need to generate the fstab to define what and how partitions should be mounted.\
Generate it by issuing:

```bash
genfstab -U /mnt >> /mnt/etc/fstab
```

Verify it by issuing:

```bash
cat /mnt/etc/fstab
```

### Chroot into the root partition

Now enter your Arch install:

```bash
arch-chroot /mnt
```

#### Setting up timezone

Before you set up timezone, you might want to check which timezones are available by issuing:

```bash
timedatectl list-timezones
```

> Press 'q' to quit the list.

Now set up your timezone by using:

```bash
ln -sf /usr/share/zoneinfo/Region/City /etc/localtime
```

#### Sync hardware and system clock

Issue this command:

```bash
hwclock --systohc
```

#### Generating system locale

Issue this command to edit the locale.gen:

```bash
nano /etc/locale.gen
```

Scroll and uncomment your language. Most people would prefer US English so scroll down and uncomment this line:

```bash
en_US.UTF-8 UTF8
```

Save the file by using CTRL + S and exit it with CTRL + X.

Now generate locale:

```bash
locale-gen
```

Set the locale in locale.conf file:

```bash
echo LANG=en_US.UTF-8 >> /etc/locale.conf
```

> Change en_US.UTF-8 to your preferred language (if true).

#### Setting keymap

> Note: This is only if you use keymaps other than the standard QWERTY.

```bash
echo KEYMAP=[keymap] >> /etc/vconsole.conf
```

Replace [keymap] with the ones you choose before.

#### Setting network configuration

Set your hostname with:

```bash
echo example >> /etc/hostname
```

Replace the `example` with anything you want.

Now for the hostfile:

```bash
nano /etc/hosts
```

Reffering to Arch Wiki, the format should look like this:

```bash
127.0.0.1   localhost
::1         localhost
127.0.1.1   example.localdomain example
```

Save the file by using CTRL + S and exit it with CTRL + X.

#### Setting up the root user

Set up password for the root user with:

```bash
passwd
```

> Note: Visual feedbacks are disabled by default in Linux because of security reasons.

#### Installing remaining essentials

```bash
pacman -S grub grub-btrfs efibootmgr base-devel linux-headers networkmanager network-manager-applet wpa_supplicant dialog os-prober mtools dosfstools reflector git
```

These are some basic sets of packages you will need if you plan to use Arch in the long run. I would recommend that you google all packages to understand what they do. After entering the command, press Enter to select all of the base-devel packages to install. Then wait for the installation to finish.

#### Modifying mkinitcpio

```bash
nano /etc/mkinitcpio.conf
```

Add btrfs into MODULES so that it looks like:

```bash
...
MODULES=(btrfs)
...
```

Save the file by using CTRL + S and exit it with CTRL + X.

#### Installing GRUB

To install GRUB into the /boot partition, issue these commands:

```bash
grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=Arch
grub-mkconfig -o /boot/grub/grub.cfg
```

#### Creating a user

Issue this command to create a new user:

```bash
useradd -mG wheel example
```

Above command creates a user with name `example` and adds the user to the `wheel` group (for sudo privileges). Replace `example` with whatever name you want.

Then create the password for the user:

```bash
passwd example
```

#### Giving user sudo permission

```bash
EDITOR=nano visudo
```

Uncomment the line `%wheel ALL=(ALL) ALL`

#### Enabling NetworkManager

```bash
systemctl enable NetworkManager.service
```

### Finishing and restarting

Issue these commands to finish installation:

```bash
exit
umount -l /mnt
reboot
```

## Post Installation

Ah yes, the pain is gone ultimately. You've installed Arch Linux successfully! Go ahead and install some DE or WM on top.

For some post install recommendations:\
[Arch Wiki - General Recommendations](https://wiki.archlinux.org/index.php/General_recommendations)

As always, thank you for your time!

## References

- https://www.nishantnadkarni.tech/posts/arch_installation/ - Arch Linux with BTRFS Installation (Base) - NishantN
- https://wiki.archlinux.org/title/Installation_guide - Installation Guide - Arch Wiki
- https://wiki.archlinux.org/title/btrfs - Btrfs - Arch Wiki
- https://wiki.archlinux.org/title/Iwd#iwctl - Iwd/iwctl - Arch Wiki


Arch Linux installation with btrfs filesystem dual booting with Windows.

Posts

Demystifying Audiophile Claims

How to Deploy a Telegram Userbot

Arch Apache, MySQL, and PMA Manual Setup

Arch Linux Secure Boot Tutorial

Arch Linux - Btrfs Installation (Dual Boot)