FreezeOS Install USB Creator (Linux / Debian-based)
===================================================

Creates a bootable FreezeOS install USB from your Debian/Ubuntu machine. The USB
is written as a real hard-drive-style install (GPT + FAT32 ESP), not a raw ISO
dump, so it boots cleanly on modern UEFI hardware.

REQUIREMENTS
  - A Debian/Ubuntu-based Linux machine (uses apt)
  - A FreezeOS fleet account (email/username + password)
  - A USB drive (≥8 GB; ALL DATA ON IT WILL BE ERASED)
  - Internet access to os.freeze2k.net

RUN
  1. Extract:   tar -xzf freezeos-usb-creator.tar.gz
  2. Enter:     cd freezeos-usb-creator
  3. Launch:    ./freezeos-usb-creator
     (On first launch it will apt-install everything it needs — GTK, gdisk,
      dosfstools, parted, curl, polkit — prompting for your sudo password.)

IN THE APP
  0. What to make — TWO modes:
       • Install FreezeOS ONTO the USB — a portable, bootable FreezeOS that runs
         off the stick itself (needs a >=32 GB stick). The fleet builds a
         personalized image and the tool writes it to the stick.
       • Make an installer USB — boots an installer that installs FreezeOS to a
         PC's internal disk.
  1. Fleet account — enter your account + password, then "Log in". This loads
     the list of supported devices.
  2. Device — pick your exact model to get its optimized performance kernel, or
     "Generic / other hardware" for the stock kernel.
  3. Channel — stable, beta, or dev.
  4. WiFi (optional) — a network to auto-join on first boot.
  5. Target USB — pick the stick, then "Create USB".

  "Update tool" checks for a newer version of THIS creator tool and, if one is
  published, updates itself and restarts. (The FreezeOS installer image is
  downloaded automatically when you click Create — always the latest.)

The USB never stores your password or any token — the install preset carries
your account name/email/region (and WiFi, channel, device payload). When the
target machine boots the installer, your account is already pre-filled; you
just type your fleet password there to enroll the machine under your account
on the chosen channel.

SECURE BOOT
  The USB is signed with the FreezeOS key and carries MOK Manager + the certs on
  its ESP. If the target machine has Secure Boot ON, the FIRST boot lands in the
  blue "Shim UEFI key management" (MOK Manager) screen:
     Enroll MOK -> Continue -> Yes -> (pick freezeos-mok.cer if asked) -> Reboot.
  After enrolling once, it boots normally. You can reopen it from the boot-menu
  entry "Enroll / Manage Secure Boot Key (MOK Manager)". Secure Boot OFF = just
  boots, nothing to do. (The tool shows these steps when it finishes.)

FILES
  freezeos-usb-creator      launcher + dependency installer (run this)
  freezeos_usb_creator.py   the GTK application
  usb-helper.sh             root worker (download + GPT/ESP write, via pkexec)
