Installer

FAQ › EUZOS Desktop › Installer · Nederlands

What is it?

The installer puts EUZOS Desktop on the internal disk (SATA via AHCI, or NVMe) of a PC, so that it boots without a stick. The whole disk is wiped; that only happens after you type the last four characters of the disk's serial number. There are three ways in:

From the stick itself (main way, no network or Mac needed): boot from an EUZOS stick and choose Install on this PC on the choice screen, or hold I while switching on (see Boot). Screen logic: euzos_ui::installation; kernel side: kernel/src/setup_choice.rs.
The older graphical installer from a release on the network: installer [url], or automatically on an installation stick (automatic=yes in INSTALL.TXT; legacy automatisch=ja still read). Screen logic: euzos_ui::installer; kernel side: kernel/src/installer.rs.
The console: install <url>|stick a<port>|n<nr> … (no screen needed, also over SSH).

EUZOS Server has its own installer: see Server installer.

How do I…?

How do I install EUZOS from the stick?

Boot from the stick, choose Install on this PC ("Installeren op deze pc"), then follow the steps in the step bar:

Drive – choose an internal disk.
Account – sign in or create an account (for the Chromium download).
Apps – Chromium on or off.
Network – only if Chromium is chosen and there is no internet yet.
Warning – what will be erased; quick or thorough erase, or a test install without erasing.
Confirm – type the last 4 characters of the serial number.
Install – progress per phase.
Done – shut down completely, remove the stick, switch on.

Back goes one step back; on the Disk step it returns to the choice screen (without countdown).

Which language does the installer use?

The PC's language: \EOS\FW\LANG.TXT if a language was chosen earlier (for example on the login screen), otherwise the language in PROFILE.TXT. The desktop choice screen has no language button of its own; the server choice screen does (to verify: whether a language step is planned for the desktop installer).

Which disks are offered?

Only internal SATA and NVMe disks, never the boot stick or other USB disks. Each disk shows model, size, what is on it now (empty, Windows, Linux, EUZOS with its version, other data, unreadable), the space left for profiles, and for hard disks the SMART state. A disk is greyed out with the reason when it:

is smaller than 32 GB;
has no usable serial number (never wiped without a code);
reports through SMART that it is failing;
is locked with a password (an interrupted erase), see below;
is refused by the driver for another reason (for example the boot disk).

If the boot stick itself cannot be found safely, the step says "Installing is not safe: …" and lists nothing.

Chromium is on the download server download.euzos.eu, and only a PC with a download token from a profile server may download it. The Account step therefore offers three routes:

Sign in with e-mail address and password (the same credentials as in the EUZOS app; POST /api/pc/login).
Create account: first name, last name, city, e-mail address, password twice (POST /api/pc/register), then the 6-digit code from the mail (POST /api/pc/verify); after a correct code the installer signs in at once. "Resend code" asks for a new mail.
Sign in with Microsoft (work account): a device code with an address and a QR code; you confirm at Microsoft on your phone or another computer (see Login and docs/WORK-LOGIN.md).

After signing in: "Signed in as …" and Other account. The PC token lives only in the installer's RAM; it does not go to the new disk, and after a successful installation the installer logs it out. Passwords are kept only in the kernel (a Secret, wiped after use).

Without internet, or if signing in is not possible right now (server unreachable, old server, registration closed), you may continue: Chromium then comes after the first start, as soon as someone signs in. With internet and a reachable server, Next only works after signing in.

The EUZOS Server installer has an extra route: the admin signs in, and the server is registered with the admin's organisation (see Server installer).

How do I choose the environment (SBX or PROD)?

Only in a test build: the Account step shows "Environment: Sandbox / Production" below the form. The sign-in, the app catalogue and the download token belong to that environment; switching logs out an earlier sign-in. The choice goes to the new disk as PROFILE.TXT (environment=). A production build does not show the choice and always uses production. See docs/ENVIRONMENTS.md.

How does the Chromium option work?

The Apps step has a checkbox Chromium (on by default, about 411 MiB). Chromium is not on the stick:

With internet (and a sign-in): after writing and reading back, the installer fetches Chromium through the profile server's app catalogue with a download token and puts it in apps/ on partition 2 of the new disk (phase "Downloading apps"). An interrupted download resumes with Range.
Without internet (or on an error): \EOS\FW\APPS.TXT with chromium=yes goes to the new disk, and the PC installs Chromium in the background after the first start (a status bar at the bottom of the screen).

See Apps and downloads and Browser and Chromium.

How do I get internet during the installation?

If Chromium is chosen and there is no connection, the Network step follows Apps: Choose Wi-Fi opens the Wi-Fi panel (with the on-screen keyboard), or plug in a cable. If you connect to Wi-Fi here, Take this Wi-Fi network along to the new PC is on at once: WIFI.TXT with the connection's key (never the password) goes to the new disk.

What is the difference between quick and thorough erase?

The Warning step offers Quick erase (default) and Thorough erase (for a disk that leaves the company), with an honest line about what that means for the chosen disk:

Mode	Methods, in order	Notes
Quick	SANITIZE (block or crypto erase) → Security Erase (if not frozen) → TRIM / Deallocate over the whole disk (only if the disk promises zeros after TRIM) → overwrite	then a sample check; if not zero, overwrite after all
Thorough	SANITIZE → Security Erase → overwrite	never TRIM

Quick is only possible on an SSD (NVMe always; SATA only if IDENTIFY word 217 says it is not rotating). A hard disk or a disk in doubt only gets thorough. After the erase a sample of sectors must read back as zero. If some sectors cannot be overwritten, they are skipped and counted, and the Done screen reports "Erase not complete".

My SSD reads back random data after the erase. Did it fail?

No, not if the check says CRYPTOGRAPHICALLY ERASED. A self-encrypting SSD (e.g. Samsung 840 EVO) stores everything encrypted; Security Erase or a cryptographic Format only replaces its internal key and is done in a few seconds. The old sectors then read back as noise. EUZOS reads the same sample of sectors (about 1128) before and after the erase and accepts this only when every sector is empty or changed into random-looking data, and no sector with old data is still the same. The Done screen and the log then say "The disk was erased cryptographically: its contents changed into random data and the old key is gone." Overwrite and TRIM keep the strict check (zeros only).

Can I install quickly for testing, without erasing?

Yes: the third choice on the Warning step, Test install, no erase: "Quick install for testing: don't erase, only repartition (old data can still be recovered). Takes minutes instead of an hour or more." It is available for every disk but never the default (that stays quick on an SSD, thorough on a hard disk; another disk starts with its own default again).

The title and the red box then say: "Not erased: the old data (…) stays on this drive and can be recovered with simple tools. Only choose this if nothing confidential is on the drive."
Extra confirmation: the first Next shows "Old data stays recoverable. Choose Next again to install without erasing."; only the second Next continues (going back to the Warning step asks again). The Confirm step then has the button Install without erasing.
What happens: the secrets of an old EUZOS on the disk are wiped, the first and last 4 MiB of the disk (old partition tables, boot sectors, backup GPT) and the first 4 MiB of every new partition are overwritten with zeros, then the same GPT and file systems as always are written, the files written and read back. No full overwrite, no SANITIZE, Security Erase or TRIM.
The SMART check for hard disks stays the same.
The progress shows "Repartitioning the drive (not erased)", the Done screen "Not erased (repartitioned only): the old data can still be recovered.", and the log disk preparation: not wiped (repartitioned only).

Never use it for a disk that leaves the company or held anything confidential: then choose Thorough erase.

What does the SMART check do?

For hard disks only, while searching the disks the installer reads SMART (return status and attributes 5 reallocated, 197 pending, 198 unreadable):

healthy: "The hard disk itself reports (SMART): healthy";
counters above 0: a warning; install only after choosing Next again;
the disk reports a threshold exceeded: refused ("…that it is failing").

SSDs, NVMe disks and disks without SMART show nothing.

What if the disk is "Locked with a password"?

A Security Erase uses a temporary drive password. If an erase was interrupted (for example a power failure), the disk stays locked. The disk list then shows "Locked with a password (interrupted erase, e.g. power failure)" and the button Unlock and continue erasing: the installer removes the temporary password (ahci wipelock <port> on the console does the same), after which the disk can be chosen and is wiped again during the installation.

How do I confirm?

Type the last 4 characters of the serial number (shown in blue; case does not matter; the on-screen keyboard appears on a tablet). Without the right four characters, Erase and install stays grey and nothing is wiped. The screen then passes on the two confirmation words WIPE-<serial> and WIPE-ALL to the kernel.

Since 27-10-2026 EUZOS writes English config file names, keys, values and confirmation words (for example WIPE-…, environment= in PROFILE.TXT); the old Dutch names (marked legacy here) are still read and accepted (docs/ENGLISH.md).

Can I cancel?

Only during Checking the files on the stick, before the erase starts. After that it cannot be cancelled (a half-wiped disk is worse than a fully installed one). If something fails, the screen says whether the disk was already wiped, that the stick has not been touched, and the technical reason; Back starts again at the disk choice.

Why "shut down" and not "restart" at the end?

After a SANITIZE or Security Erase, the AHCI driver on the CF-33 only saw the SSD again after a cold boot. The Done screen therefore offers Shut down: "Shut the PC down completely, remove the stick and turn it back on". On the first boot from the SSD, the boot loader creates the UEFI boot entry (UEFIBOOT.TXT, see Boot).

How do I install from the console instead?

disks – the internal disks as [a<port>] (SATA) or [n<nr>] (NVMe) with model, serial number and contents.
Trial, nothing is wiped: install stick a0 --trial (or install <https://…/MANIFEST.TXT> a0 --trial).
For real: install stick a0 WIPE-<serial> WIPE-ALL (add --thorough for a thorough erase).
Quick install for testing, not erased (only repartitioned): install stick a0 --no-wipe WIPE-<serial> WIPE-ALL NO-WIPE.

Without the two words, install only shows the plan and the exact command; with --no-wipe but without NO-WIPE likewise (with the warning).

How do I write a new EUZOS stick from a running EUZOS?

install <https://…/MANIFEST.TXT> <disk> with the USB disk number from disks: without the code it only shows what would happen; with WIPE-<MiB>-<disk> (and WIPE-ALL for a disk that is not empty and not an EUZOS stick) it writes. --trial fetches and checks everything without writing; --wifi takes WIFI.TXT along. Never the boot stick, never a disk with Windows, Apple, NTFS, exFAT or APFS traces, never a disk larger than 256 GiB.

What does the older graphical installer (`installer [url]`) do?

It installs a release from an HTTPS address (the argument, or manifest= in INSTALL.TXT). Steps: Welcome → Network (cable automatic; Wi-Fi: choose a network and type the password) → Use (Work or school, with the workplace server's pairing key, or Private) → Disk → Confirm (type the code) → Progress (fetch, wipe, install, read back) → Done. Esc on the welcome screen returns to the console. For Work or school the pairing key goes to \EOS\FW\PAIR.TXT on the new disk. Its step names are Dutch texts in the code (Welkom, Netwerk, Gebruik, Schijf, Bevestigen, Installeren, Klaar), not yet in the translation files.

Details

What goes onto the internal disk

A GPT with three entries: (1) the ESP of 1 GiB (FAT32, label EUZOS); (2) Profiles from 8 GiB to the end (the users' encrypted directories); (3) EUZOS reserved from the end of the ESP to 8 GiB. System requirement: EUZOS uses 8 GB; the rest is for profiles (see Storage).
The release (boot loaders, kernels, programs, firmware), checked against the signed manifest: signature with SIGNPUB.TXT, version against FETCH.TXT, size and SHA-256 of every file. Only when everything matches is anything wiped.
From the boot stick: SIGNPUB.TXT (required), AUTHKEYS.TXT (if present; without it no SSH to the PC), HOSTKEY.TXT (copy, so SSH shows the same fingerprint; without one a new key is made), PROFILE.TXT (legacy name PROFIEL.TXT is still read), WIFI.TXT (unless --no-wifi), and the settings files present: RESET.TXT, DRIVERS.TXT, SCREEN.TXT, SSHD.TXT, TIME.TXT, INPUT.TXT, SOUND.TXT, SMP.TXT (and the legacy names SCHERM.TXT, TIJD.TXT, INVOER.TXT, GELUID.TXT if the stick still has them). A fresh FETCH.TXT is written; the stick's is not copied. Never EXTRA.PEM (test CA).
APPS.TXT (chromium=yes|no), PAIR.TXT (work or school, pairing key), and the marker UEFIBOOT.TXT for the boot entry.

Safety in brief

Never the disk it booted from; the boot disk is never unlocked or wiped.
Two words needed (WIPE-<serial> and WIPE-ALL); on screen: the last 4 characters of the serial number.
Fetch and check everything first, then wipe; a fresh IDENTIFY right before writing; a sample after the erase; read everything back after writing.
Power lost during the installation: the stick is untouched and boots normally.

Phases on the progress screen

Phase (`euzos_ui::installer::Phase`)	Screen text
`Fetch`	Checking the files on the stick
`Wiping`	Erasing the drive (with time left; "Disk is erasing itself" for SANITIZE/Security Erase); without erasing: "Repartitioning the drive (not erased)"
`Install`	Writing EUZOS
`ReadBack`	Reading everything back
`Apps`	Downloading apps (Chromium, with MiB, speed and time left)

Reference

Console commands

Command	Arguments	What it does
`installer`	`[url]`	the older graphical installer (release from HTTPS; default: `manifest=` in `INSTALL.TXT`)
`disks`	–	all USB storage (partitions, labels, the protected boot stick, whether it may be a target, the `WIPE-<MiB>-<disk>` code) and the internal SATA and NVMe disks (model, serial number, size; read only)
`install`	`<url> <disk> [--trial] [--wifi] [WIPE-<MiB>-<disk>] [WIPE-ALL]`	write a new EUZOS stick (USB disk number from `disks`)
`install`	`<url>\|stick a<port>\|n<nr> [--trial] [--thorough\|--no-wipe] [--wifi] [--no-wifi] [--pair=<key>] [WIPE-<serial> WIPE-ALL [NO-WIPE]]`	install on an internal disk (`a` = SATA port, `n` = NVMe number; `stick` = the release on the boot stick, no network)
`ahci wipelock`	`<port>`	remove the temporary erase password of an interrupted erase (see Storage)

Flags and legacy aliases of install:

Flag	Legacy alias	Meaning
`--trial`	`--proef`	fetch and check everything, write nothing
`--thorough`	`--grondig`	thorough erase (internal disk only)
`--no-wipe`	–	quick install for testing: not erased, only repartitioned (internal disk only; also needs the word `NO-WIPE`; not with `--thorough`)
`--wifi`	–	require `WIFI.TXT` from the stick to go along
`--no-wifi`	`--zonder-wifi`	do not take `WIFI.TXT` along (internal disk only)
`--pair=<key>`	`--koppel=<key>`	work or school: the workplace server's pairing key (6 to 64 letters, digits or `-`); redacted in the log and history

Command legacy alias: installeer = install. The confirmation words WIS-<serial>, WIS-<MiB>-<disk> and ALLES-WISSEN (legacy) are still accepted, also mixed with the new ones. help lists --thorough and the stick source too.

Functions and modules

Function / module	Role
`kernel::setup_choice::show`	choice screen / installer from the stick
`kernel::setup_choice::carry_out`	carry out a screen action (search disks, unlock, install, cancel, account) in a thread
`kernel::setup_choice::disks`	list internal disks with content, version, SMART, erase capability, refusal
`kernel::setup_choice::account_action`	the Account step: login, register, confirm, resend, logout, Microsoft
`kernel::setup_choice::pc_session` / `forget_pc`	the PC token in RAM, and logging it out
`kernel::setup_choice::run_install`	the installation from the stick (`Source::Stick`)
`kernel::installer::command`	`installer [url]`
`kernel::installer::automatic`	`automatic=yes` in `INSTALL.TXT` (legacy `automatisch=ja`)
`kernel::install::command`	`install`
`kernel::install::disks`	`disks`
`kernel::install::install_internal`	install on an internal disk (source stick or HTTPS)
`kernel::app_install::apps_txt_for_disk`	`APPS.TXT` for the new disk
`euzos_ui::installation`	screen logic: `Step`, `Disk`, `WipeCapability`, `Health`, `Refusal`, `code_matches` (`CODE_CHARS` = 4)
`euzos_ui::installer`	screen logic of the older installer (`Step`, `Kind`, `Phase`)
`euzos_install`	decisions without hardware: disk inspection, confirmation codes (`code`, `WIPE_ALL` = `WIPE-ALL`), layout, manifest check (`stick.rs`), `apps.rs`
`euzos_ata::WipeMode`	`Fast` / `Thorough`
`euzos_install::WipeKind`	`Fast` / `Thorough` / `NoWipe` (`default_for(ssd)`, `summary`); `NO_WIPE`, `confirmed_internal_kind`, `repartition_ranges`, `repartition`
`euzos_ui::installation::WipeChoice`	the three buttons on the Warning step

Config files

File	Key	Values	Meaning
`\EOS\FW\INSTALL.TXT` (stick)	`choice` (legacy `keuze`)	`no` (legacy `nee`)	no choice screen
`\EOS\FW\INSTALL.TXT` (stick)	`automatic` (legacy `automatisch`)	`yes` (legacy `ja`)	installation stick: the older graphical installer starts by itself
`\EOS\FW\INSTALL.TXT` (stick)	`manifest`	`https://…/MANIFEST.TXT`	release address for `installer`
`\EOS\FW\APPS.TXT`	`chromium`	`yes` / `no` (legacy `ja` / `nee`)	install Chromium (after the first start if not done during installation)
`\EOS\FW\APPS.TXT`	`chromium_url`	`https://…/….APP`	test override: skip the catalogue
`\EOS\FW\PROFILE.TXT`	`environment` (legacy `omgeving`)	`sandbox`, `production`, … (legacy `productie`)	environment chosen in the installer (test build)
`\EOS\FW\PAIR.TXT` (legacy name `KOPPEL.TXT`)	`kind`, `pairing-key` (legacy `soort`, `koppelsleutel`)	`work` (legacy `werk`), the key	work or school, with the pairing key (secret); written, nothing reads it yet
`\EOS\FW\WIFI.TXT`	–	network and key	the Wi-Fi network taken along (key, never the password)
`\EOS\FW\UEFIBOOT.TXT`	–	partition GUID	marker for the boot entry

The code writes and reads automatic=yes; the legacy automatisch=ja is still read.