V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

.archive/func/4230_update_grub.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+#######################################
+# Detects and collects all boot devices for GRUB installation.
+# Supports /dev/sdX, /dev/vdX, /dev/hdX, /dev/nvmeXn1, /dev/mmcblkX.
+# Globals:
+#   VAR_RECIPE_HIGHEST_DEVICE
+#   ary_bootdev_all
+#   grub_bootdev
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+get_all_boot_devs() {
+  ### Declare Arrays, HashMaps, and Variables.
+  declare -ag ary_bootdev_all=()
+  declare     dev="" dev_prefix="" dev_path="" letter=""
+  declare -i  ascii=0 ascii_end=0 ascii_start=0
+
+  ### Determine prefix from grub_bootdev (e.g., "sd", "vd", "nvme", "mmcblk")
+  dev_prefix=$(basename "${grub_bootdev}" | sed -E 's/^([a-z]+)[a-z0-9]*$/\1/')
+
+  case "${dev_prefix}" in
+
+    sd|vd|hd)
+      ascii_start=$(printf '%d' "'a")
+      ascii_end=$(printf '%d' "'${VAR_RECIPE_HIGHEST_DEVICE}")
+      for ((ascii = ascii_start; ascii <= ascii_end; ascii++)); do
+        letter=$(printf "%b" "\\$(printf '%03o' "${ascii}")")
+        dev_path="/dev/${dev_prefix}${letter}"
+        [[ -b "${dev_path}" ]] && ary_bootdev_all+=("${dev_path}")
+      done
+      ;;
+
+    nvme)
+    # shellcheck disable=SC2312
+      while read -r dev; do
+        ary_bootdev_all+=("/dev/${dev}")
+      done < <(lsblk -dn -o NAME | grep -E '^nvme[0-9]+n1$')
+      ;;
+
+    mmcblk)
+    # shellcheck disable=SC2312
+      while read -r dev; do
+        ary_bootdev_all+=("/dev/${dev}")
+      done < <(lsblk -dn -o NAME | grep -E '^mmcblk[0-9]+$')
+      ;;
+
+    *)
+      do_log "warning" "file_only" "4230() Unrecognized boot device prefix: ${dev_prefix}"
+      ;;
+
+  esac
+
+  return 0
+}

.preseed/partitioning.yaml

@@ -48,7 +48,7 @@ recipe:
       version: "1.2.0"
     dev:
       sda:
-        1:
+        1:                     # MUST be always 'ESP' for [UEFI|GPT] or 'BIOS' for [BIOS|GPT].
           begin: "min"
           end: "1024MiB"
           bootable: false

.preseed/preseed.yaml

@@ -404,7 +404,7 @@ grub_parameter:
 grub:
   background:                  # RECOMMENDED settings: JPG 1280 x 1024 px or JPG 1920 x 1080 px
     enable: true               # If you want to add a GRUB background.
-    path: "/root/CISS.2025.debian.installer/.assets/background/background_hexagon_1280.jpg"
+    path: "/includes/target/etc/default/grub.d/hexagon.png"
   bootdev: "/dev/sda"          # Due notably to potential USB sticks, the location of the primary drive cannot be determined
                                # safely in general, so this needs to be specified.
   force_efi: false             # Force GRUB installation to the EFI removable media path?
@@ -549,8 +549,6 @@ software:
   # btrfs-progs
   # busybox
   # bzip2
-  # cryptsetup
-  # cryptsetup-initramfs
   # dirmngr
   # dmsetup
   # dosfstools
@@ -594,6 +592,11 @@ software:
   ##############################################################################################################################
   # chrony
   ##############################################################################################################################
+  ### Installed by 4220_installation_cryptsetup.sh
+  ##############################################################################################################################
+  # cryptsetup
+  # cryptsetup-initramfs
+  ##############################################################################################################################
   ### Installed by 4230_update_grub.sh
   ##############################################################################################################################
   # grub2

ciss_debian_installer.sh

@@ -19,7 +19,6 @@
 # TODO: Check Packages for installation. Refactor preseed.yaml, 4130_installation_toolset.sh, 4700_setup_packages.sh
 # TODO: What do we need for CISS environment?
 # TODO: Any changes to the NTPSec Servers?
-# TODO: Hibernate deactivation
 # TODO: Hardening Scripts Integration
 # TODO: SSH 2fa integration
 # TODO: Recovery Partition Integration
@@ -257,6 +256,8 @@ echo "MAIN PROGRAM SEQUENCE: 4131_installation_systemd.sh ..."
 installation_systemd
 echo "MAIN PROGRAM SEQUENCE: 4132_installation_machineid.sh ..."
 installation_machineid
+echo "MAIN PROGRAM SEQUENCE: 4133_installation_masking.sh ..."
+installation_masking
 echo "MAIN PROGRAM SEQUENCE: 4140_installation_microcode.sh ..."
 installation_microcode
 echo "MAIN PROGRAM SEQUENCE: 4150_installation_chrony.sh ..."
@@ -267,8 +268,8 @@ echo "MAIN PROGRAM SEQUENCE: 4200_generate_fstab.sh ..."
 generate_fstab
 echo "MAIN PROGRAM SEQUENCE: 4210_generate_crypttab.sh ..."
 generate_crypttab
-echo "MAIN PROGRAM SEQUENCE: 4220_update_initramfs.sh ..."
+echo "MAIN PROGRAM SEQUENCE: 4220_installation_cryptsetup.sh ..."
-update_initramfs
+installation_cryptsetup
 echo "MAIN PROGRAM SEQUENCE: 4230_update_grub.sh ..."
 update_grub # TODO: Checks ongoing
 echo "MAIN PROGRAM SEQUENCE: 4240_update_grub_password.sh ..."
@@ -285,6 +286,8 @@ echo "MAIN PROGRAM SEQUENCE: 4311_dropbear_initramfs.sh ..."
 dropbear_initramfs
 echo "MAIN PROGRAM SEQUENCE: 4312_dropbear_setup.sh ..."
 dropbear_setup
+echo "MAIN PROGRAM SEQUENCE: 4320_update_initramfs.sh ..."
+update_initramfs
 
 ### CDI_4400
 echo "MAIN PROGRAM SEQUENCE: 4400_kernel_modules.sh ..."

func/cdi_1250_yaml/1250_yaml_parser.sh

@@ -62,16 +62,31 @@ yaml_parser() {
     fi
   done < <(compgen -v)
 
-  ### Delete the respective 'key:value'-variables in the global variable set.
+  ### Remove obsolete variables, normalize empty assignments, wrap remaining values in single quotes
-  sed -i '/^grub_parameter_[0-9]\+=/d' "${VAR_PRESEED}"
+  sed -i -E '
-  sed -i '/^locale_locale_[0-9]\+=/d' "${VAR_PRESEED}"
+    # --- Deletions --------------------------------------------------------
-  sed -i '/^ntp_server_[0-9]\+=/d' "${VAR_PRESEED}"
+    /^grub_parameter_[0-9]+=/d         # delete grub parameter variables
-  sed -i '/^software_[0-9]\+=/d' "${VAR_PRESEED}"
+    /^locale_locale_[0-9]+=/d          # delete locale variables
+    /^ntp_server_[0-9]+=/d             # delete NTP server variables
+    /^software_[0-9]+=/d               # delete software list variables
 
-  ### Substitute all key= by key=""
+    # --- Empty-value normalisation ---------------------------------------
-  sed -i -E 's/^(.*)=\s*$/\1=""/' "${VAR_PRESEED}"
+    s/^(.*)=\s*$/\1=""/                # turn key=  into key=""
-  ### Wrap each key=value by '' e.g., key='value'
+
-  sed -i -E "s/^(.*)=([^'\"]+)$/\1='\2'/" "${VAR_PRESEED}"
+    # --- Quote unquoted values -------------------------------------------
+    s/^(.*)=([^'\''"]+)/\1='\''\2'\''/ # wrap value in single quotes
+' "${VAR_PRESEED}"
+
+#  ### Delete the respective 'key:value'-variables in the global variable set.
+#  sed -i '/^grub_parameter_[0-9]\+=/d' "${VAR_PRESEED}"
+#  sed -i '/^locale_locale_[0-9]\+=/d' "${VAR_PRESEED}"
+#  sed -i '/^ntp_server_[0-9]\+=/d' "${VAR_PRESEED}"
+#  sed -i '/^software_[0-9]\+=/d' "${VAR_PRESEED}"
+
+#  ### Substitute all key= by key=""
+#  sed -i -E 's/^(.*)=\s*$/\1=""/' "${VAR_PRESEED}"
+#  ### Wrap each key=value by '' e.g., key='value'
+#  sed -i -E "s/^(.*)=([^'\"]+)$/\1='\2'/" "${VAR_PRESEED}"
 
   # shellcheck disable=SC1090
   . "${VAR_PRESEED}"

func/cdi_1250_yaml/1251_yaml_reader.sh

@@ -164,7 +164,7 @@ END { print max }
 
   elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
 
-    do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP on MBR needs partition type '0xEF'."
+    do_log "warn" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP on MBR needs partition type '0xEF'."
 
   elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
 

func/cdi_3200_partitioning/3200_partitioning.sh

@@ -69,7 +69,7 @@ partitioning() {
 
   declare -a  ary_devs=() ary_parts=() ary_paths_unsorted=()
 
-  declare -i  i=0 var_dev_size=0 var_dev_end=0
+  declare -i  i=0 var_dev_size=0 var_dev_end=0 var_multi_boot=0 var_multi_esp=0
 
   ### Iterate over all devices in the recipe.
   # shellcheck disable=SC2312

func/cdi_3200_partitioning/3220_partition_encryption.sh

@@ -191,6 +191,7 @@ partition_encryption() {
     var_uuid=$(blkid -s UUID -o value "/dev/${var_dev}")
 
     [[ "${var_encryption_path}" == "/" ]] && declare -grx VAR_CRYPT_ROOT="${var_uuid}"
+    [[ "${var_encryption_path}" == "/boot" ]] && declare -grx VAR_CRYPT_BOOT="${var_uuid}"
     [[ "${var_encryption_path}" == "/recovery" ]] && declare -grx VAR_CRYPT_RECOVERY="${var_uuid}"
 
     HMP_PATH_LUKSUUID["${var_encryption_path}"]="${var_uuid}"

func/cdi_4100_base/4130_installation_toolset.sh

@@ -42,8 +42,6 @@ installation_toolset() {
     [echo]="coreutils"
     [ln]="coreutils"
     [mkdir]="coreutils"
-    [cryptsetup]="cryptsetup"
-    [cryptsetup-initramfs]="cryptsetup-initramfs"
     [curl]="curl"
     [dirmngr]="dirmngr"
     [dmsetup]="dmsetup"

func/cdi_4100_base/4133_installation_masking.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Turn off Energy saving mode and ctrl-alt-del.
+# Globals:
+#   TARGET
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+installation_masking() {
+  do_in_target_script "${TARGET}" "
+    systemctl mask ctrl-alt-del.target sleep.target suspend.target hibernate.target hybrid-sleep.target
+  "
+
+  do_log "info" "file_only" "4133() Masked: [ctrl-alt-del.target sleep.target suspend.target hibernate.target hybrid-sleep.target]."
+
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4200_boot/4200_generate_fstab.sh

@@ -199,6 +199,8 @@ tmpfs                                      /run                        tmpfs
 # vim: number et ts=2 sw=2 sts=2 ai tw=200 ft=sh
 EOF
 
+  do_log "info" "file_only" "4200() fstab generated successfully."
+
   return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4200_boot/4210_generate_crypttab.sh

@@ -136,6 +136,8 @@ EOF
 # vim: number et ts=2 sw=2 sts=2 ai tw=200 ft=sh
 EOF
 
+  do_log "info" "file_only" "4210() crypttab generated successfully."
+
   return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4200_boot/4220_installation_cryptsetup.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Installation of 'cryptsetup' and 'cryptsetup-initramfs' after '/etc/crypttab' generation.
+# Globals:
+#   TARGET
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+installation_cryptsetup() {
+  ### Declare Arrays, HashMaps, and Variables.
+  declare -r  var_logfile="/root/.ciss/cdi/log/4220_installation_cryptsetup.log"
+
+  touch "${TARGET}${var_logfile}" && chmod 0600 "${TARGET}${var_logfile}"
+
+  do_in_target_script "${TARGET}" "
+    apt-get install -y --no-install-recommends --no-install-suggests cryptsetup cryptsetup-initramfs 2>&1 | tee -a ${var_logfile}
+    echo ExitCode: \$? >> ${var_logfile}
+  "
+
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4200_boot/4230_update_grub.sh

@@ -27,29 +27,30 @@ guard_sourcing
 # Installation and setup of the GRUB2 (backported) version.
 # The backported version MUST be installed for LUKS2 '/boot' encryption.
 # Globals:
-#   ERR_GRUB_BACKGROUND
-#   ERR_GRUB_EFI_FORCE
 #   TARGET
+#   VAR_ARCHITECTURE
 #   VAR_RECIPE_FIRMWARE
-#   VAR_RECIPE_TABLE
+#   VAR_SETUP_PATH
 #   grub_background_enable
 #   grub_background_path
-#   grub_bootdev
-#   grub_force_efi
 #   grub_latest
 #   grub_prober
 #   grub_skip
+#   var_update_grub_required
 # Arguments:
 #   None
 # Returns:
+#   0: on success
 #   ERR_GRUB_BACKGROUND
 #   ERR_GRUB_EFI_FORCE
-#   0: on success
 #######################################
 update_grub() {
-  declare -gx var_update_grub_required="false"
+  ### Declare Arrays, HashMaps, and Variables.
+  declare -g  var_update_grub_required="false" grub_update_nvram=${grub_update_nvram:-false}
+  declare -r  var_logfile="/root/.ciss/cdi/log/4230_update_grub.log"
+  declare     var_background=""
 
-  get_all_boot_devs
+  touch "${TARGET}${var_logfile}" && chmod 0600 "${TARGET}${var_logfile}"
 
   if [[ "${grub_skip,,}" != "true" ]]; then
 
@@ -60,15 +61,15 @@ update_grub() {
       if [[ "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
 
         case "${VAR_ARCHITECTURE,,}" in
-          amd64)  do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-efi-amd64 ;;
+          amd64)  do_in_target "${TARGET}" apt-get install -y --no-install-recommends -t bookworm-backports grub2 grub2-common grub-efi-amd64 ;;
-          arm64)  do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-efi-arm64 ;;
+          arm64)  do_in_target "${TARGET}" apt-get install -y --no-install-recommends -t bookworm-backports grub2 grub2-common grub-efi-arm64 ;;
-          i386)   do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-efi-ia32  ;;
+          i386)   do_in_target "${TARGET}" apt-get install -y --no-install-recommends -t bookworm-backports grub2 grub2-common grub-efi-ia32  ;;
-          *)      do_log "emergency" "file_only" "4140() Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
+          *)      do_log "emergency" "file_only" "4230() Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
         esac
 
       else
 
-        do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-pc
+        do_in_target "${TARGET}" apt-get install -y --no-install-recommends -t bookworm-backports grub2 grub2-common grub-pc
 
       fi
 
@@ -78,46 +79,28 @@ update_grub() {
       if [[ "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
 
         case "${VAR_ARCHITECTURE,,}" in
-          amd64)  do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-efi-amd64 ;;
+          amd64)  do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-efi-amd64 ;;
-          arm64)  do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-efi-arm64 ;;
+          arm64)  do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-efi-arm64 ;;
-          i386)   do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-efi-ia32  ;;
+          i386)   do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-efi-ia32  ;;
-          *)      do_log "emergency" "file_only" "4140() Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
+          *)      do_log "emergency" "file_only" "4230() Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
         esac
 
       else
 
-        do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-pc
+        do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-pc
 
       fi
 
     fi
 
     ### Install grub on the specific device.
-    if [[ "${grub_force_efi,,}" == "false" ]]; then
-
     if [[ "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
 
-        install_grub_uefi_all
+      install_grub_uefi
 
     elif [[ "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
 
-        install_grub_bios_all
+      install_grub_bios
-
-      fi
-
-    elif [[ "${grub_force_efi,,}" == "true" ]]; then
-
-      if [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
-
-        do_in_target "${TARGET}" grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=Debian --no-nvram --modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 part_gpt" --force-extra-removable
-        var_update_grub_required="true"
-
-      else
-
-        do_log "emergency" "file_only" "4140() Unsupported combination of partition table: '${VAR_RECIPE_TABLE,,}' and setting:  grub_force_efi '${grub_force_efi,,}'."
-        return "${ERR_GRUB_EFI_FORCE}"
-
-      fi
 
     fi
 
@@ -134,10 +117,9 @@ EOF
     ### Install a boot menu background.
     if [[ "${grub_background_enable,,}" == "true" ]]; then
 
-      declare var_background
       var_background=$(basename "${grub_background_path}")
-      cp --no-preserve=ownership "${grub_background_path}" "${TARGET}/etc/default/grub.d/${var_background}" || return "${ERR_GRUB_BACKGROUND}"
+      install -m 0640 -o root -g root "${VAR_SETUP_PATH}${grub_background_path}" "${TARGET}/etc/default/grub.d/${var_background}"
-      chmod 0640 "${TARGET}/etc/default/grub.d/${var_background}" || return "${ERR_GRUB_BACKGROUND}"
+
       cat << EOF >> "${TARGET}/etc/default/grub"
 # Enable boot menu background.
 GRUB_BACKGROUND="/etc/default/grub.d/${var_background}"
@@ -154,7 +136,7 @@ EOF
 
     fi
 
-    ### Change GRUB OS detection configuration accordingly.
+    ### Change the GRUB OS detection configuration accordingly.
     if [[ "${grub_prober,,}" == "true" ]]; then
 
       cat << EOF >> "${TARGET}/etc/default/grub"
@@ -187,152 +169,104 @@ EOF
 
   else
 
-    do_log "info" "file_only" "414() GRUB2 setup skipped."
+    do_log "info" "file_only" "4230() GRUB2 setup skipped."
 
   fi
 
   [[ "${var_update_grub_required}" == "true" ]] && do_in_target "${TARGET}" update-grub
 
   ### Setting the permissions to read and write for root only prevents non-root users from seeing the boot parameters or changing them.
+  if [[ -f "${TARGET}/boot/grub/grub.cfg" ]]; then
     chown root:root "${TARGET}/boot/grub/grub.cfg"
     chmod 0640 "${TARGET}/boot/grub/grub.cfg"
+  fi
   chmod -R 0700 "${TARGET}/etc/grub.d"
 
   return 0
 }
 
 #######################################
-# Detects and collects all boot devices for GRUB installation.
+# Installs GRUB to BIOS in BIOS mode.
-# Supports /dev/sdX, /dev/vdX, /dev/hdX, /dev/nvmeXn1, /dev/mmcblkX.
 # Globals:
-#   VAR_RECIPE_HIGHEST_DEVICE
+#   TARGET
-#   ary_bootdev_all
 #   grub_bootdev
-# Arguments:
-#   None
-# Returns:
-#   0: on success
-#######################################
-get_all_boot_devs() {
-  declare -ag ary_bootdev_all=()
-  declare dev="" dev_prefix="" dev_path="" letter=""
-  declare -i ascii=0 ascii_end=0 ascii_start=0
-
-  ### Determine prefix from grub_bootdev (e.g., "sd", "vd", "nvme", "mmcblk")
-  dev_prefix=$(basename "${grub_bootdev}" | sed -E 's/^([a-z]+)[a-z0-9]*$/\1/')
-
-  case "${dev_prefix}" in
-
-    sd|vd|hd)
-      ascii_start=$(printf '%d' "'a")
-      ascii_end=$(printf '%d' "'${VAR_RECIPE_HIGHEST_DEVICE}")
-      for ((ascii = ascii_start; ascii <= ascii_end; ascii++)); do
-        letter=$(printf "%b" "\\$(printf '%03o' "${ascii}")")
-        dev_path="/dev/${dev_prefix}${letter}"
-        [[ -b "${dev_path}" ]] && ary_bootdev_all+=("${dev_path}")
-      done
-      ;;
-
-    nvme)
-      # shellcheck disable=SC2312
-      while read -r dev; do
-        ary_bootdev_all+=("/dev/${dev}")
-      done < <(lsblk -dn -o NAME | grep -E '^nvme[0-9]+n1$')
-      ;;
-
-    mmcblk)
-      # shellcheck disable=SC2312
-      while read -r dev; do
-        ary_bootdev_all+=("/dev/${dev}")
-      done < <(lsblk -dn -o NAME | grep -E '^mmcblk[0-9]+$')
-      ;;
-
-    *)
-      do_log "warning" "file_only" "Unrecognized boot device prefix: ${dev_prefix}"
-      ;;
-
-  esac
-
-  return 0
-}
-
-#######################################
-# Installs GRUB in BIOS mode on all block devices.
-# Globals:
-#   TARGET
-#   VAR_RECIPE_TABLE
-#   ary_bootdev_all
 #   var_update_grub_required
 # Arguments:
 #   None
 # Returns:
 #   0: on success
-#   ERR_PARTITIONTBL on failure
+#   ERR_GRUB_INSTALL
 #######################################
-install_grub_bios_all() {
+install_grub_bios() {
-  declare dev="" partmod=""
+  ### Declare Arrays, HashMaps, and Variables.
+  declare -a ary_bios_arg=()
+  declare    var_bios_mod=""
 
-  case "${VAR_RECIPE_TABLE,,}" in
+  ### Cryptographic modules.
-    gpt)       partmod="part_gpt"   ;;
+  var_bios_mod+="cryptodisk gcry_rijndael gcry_sha256 gcry_sha512 gcry_whirlpool gcry_serpent gcry_twofish luks luks2"
-    msdos|mbr) partmod="part_msdos" ;;
+  ### Filesystem modules.
-    *)         do_log "emergency" "file_only" "4140() Unknown partition table type: '${VAR_RECIPE_TABLE}'."; return "${ERR_PARTITIONTBL}" ;;
+  var_bios_mod+="btrfs ext2"
-  esac
+  ### Partitioning / Device / GPT
+  var_bios_mod+="biosdisk mdraid1x part_gpt"
+  ### Device / Terminal modules.
+  var_bios_mod+="boot linux efi_gop efi_uga gfxterm gfxterm_background gfxterm_menu normal search search_fs_uuid search_label"
+  ### Debug modules.
+  var_bios_mod+="cat echo hexdump ls test terminfo"
 
-  declare var_modules="biosdisk btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 ${partmod}"
+  ary_bios_arg+=( --target=i386-pc --boot-directory=/boot "--modules=${var_bios_mod}" )
-  declare -a args=(--target=i386-pc --boot-directory=/boot "--modules=${var_modules}")
-  args+=(--recheck)
 
-  for dev in "${ary_bootdev_all[@]}"; do
+  do_in_target "${TARGET}" grub-install "${ary_bios_arg[@]}" "${grub_bootdev}"  || return "${ERR_GRUB_INSTALL}"
-    do_in_target "${TARGET}" grub-install "${args[@]}" "${dev}"
+  do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [BIOS]."
-    do_log "info" "file_only" "Installed: GRUB on Device: '${dev}' (BIOS)."
   var_update_grub_required="true"
-  done
 
   return 0
 }
 
 #######################################
-# Installs GRUB to all ESPs in UEFI mode.
+# Installs GRUB to ESP in UEFI mode.
 # Globals:
 #   TARGET
-#   VAR_RECIPE_TABLE
+#   grub_bootdev
-#   ary_bootdev_all
+#   grub_force_efi
+#   grub_update_nvram
 #   var_update_grub_required
 # Arguments:
 #   None
 # Returns:
 #   0: on success
-#   ERR_PARTITIONTBL on failure
+#   ERR_GRUB_INSTALL
 #######################################
-install_grub_uefi_all() {
+install_grub_uefi() {
   ### Declare Arrays, HashMaps, and Variables.
   declare -a ary_uefi_arg=()
-  declare    var_uefi_dev="" var_uefi_mod=""
+  declare    var_uefi_mod=""
 
   ### Cryptographic modules.
   var_uefi_mod+="cryptodisk gcry_rijndael gcry_sha256 gcry_sha512 gcry_whirlpool gcry_serpent gcry_twofish luks luks2"
   ### Filesystem modules.
   var_uefi_mod+="btrfs ext2"
   ### Partitioning / Device / GPT
-  var_uefi_mod+="biosdisk mdraid1x part_gpt part_msdos"
+  var_uefi_mod+="mdraid1x part_gpt"
   ### Device / Terminal modules.
   var_uefi_mod+="boot linux efi_gop efi_uga gfxterm gfxterm_background gfxterm_menu normal search search_fs_uuid search_label"
   ### Debug modules.
   var_uefi_mod+="cat echo hexdump ls test terminfo"
 
-  [[ "${grub_force_efi,,}" == "true" ]] && ary_uefi_arg+=( --force-extra-removable )
+  ary_uefi_arg+=( --target=x86_64-efi --boot-directory=/boot --efi-directory=/boot/efi --bootloader-id=debian "--modules=${var_uefi_mod}" )
+
   [[ "${grub_update_nvram,,}" == "false" ]] && ary_uefi_arg+=( --no-nvram )
 
-  ary_uefi_arg+=( --target=x86_64-efi --boot-directory=/boot --efi-directory=/boot/efi --bootloader-id=Debian "--modules=${var_uefi_mod}" )
+  do_in_target "${TARGET}" grub-install "${ary_uefi_arg[@]}" "${grub_bootdev}" || return "${ERR_GRUB_INSTALL}"
-
+  do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [UEFI]."
-  for var_uefi_dev in "${ary_bootdev_all[@]}"; do
-
-    ary_uefi_arg+=( "--recheck ${var_uefi_dev}" )
-    do_in_target "${TARGET}" grub-install "${ary_uefi_arg[@]}"
-    do_log "info" "file_only" "4140() Installed: GRUB on Device: '${var_uefi_dev}' (UEFI)."
   var_update_grub_required="true"
 
-  done
+  if [[ "${grub_force_efi,,}" == "true" ]]; then
+
+    mkdir -p "${TARGET}/boot/efi/EFI/BOOT"
+    cp "${TARGET}/boot/efi/EFI/debian/grubx64.efi" "${TARGET}/boot/efi/EFI/BOOT/BOOTX64.EFI"
+    do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [UEFI] on: Default EFI Boot-Path."
+
+ fi
 
   return 0
 }

func/cdi_4200_boot/4240_update_grub_password.sh

@@ -13,7 +13,7 @@
 guard_sourcing
 
 #######################################
-# Append GRUB superuser block to '/etc/grub.d/40_custom'.
+# Append the GRUB superuser block to '/etc/grub.d/40_custom'.
 # Globals:
 #   DIR_CNF
 #   ERR_READ_GRUB_FILE
@@ -26,11 +26,8 @@ guard_sourcing
 #   ERR_READ_GRUB_FILE
 #######################################
 update_grub_password() {
-  declare var_username="superadmin"
+  declare var_username="superadmin" var_password="" var_password_file="${DIR_CNF}/password_grub.txt" \
-  declare var_password=""
+    var_of="${TARGET}/etc/grub.d/40_custom" var_grub_entry=""
-  declare var_password_file="${DIR_CNF}/password_grub.txt"
-  declare var_of="${TARGET}/etc/grub.d/40_custom"
-  declare var_grub_entry
 
   ### No tracing for security reasons
   [[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set +x

func/cdi_4300_network/4320_update_initramfs.sh

@@ -16,14 +16,21 @@ guard_sourcing
 # Calling 'update-initramfs -u -v -k all' inside Target.
 # Globals:
 #   TARGET
-#   VAR_ARCHITECTURE
 # Arguments:
 #   None
 # Returns:
 #   0: on success
 #######################################
 update_initramfs() {
-  do_in_target "${TARGET}" update-initramfs -u -v -k all
+  ### Declare Arrays, HashMaps, and Variables.
+  declare -r  var_logfile="/root/.ciss/cdi/log/4320_update_initramfs.log"
+
+  touch "${TARGET}${var_logfile}" && chmod 0600 "${TARGET}${var_logfile}"
+
+  do_in_target_script "${TARGET}" "
+    update-initramfs -u -v -k all 2>&1 | tee -a ${var_logfile}
+    echo ExitCode: \$? >> ${var_logfile}
+  "
 
   return 0
 }

lib/cdi_0110_interactive/0110_check_kernel.sh

@@ -60,11 +60,13 @@ check_kernel() {
       ((counter++))
     done < "${VAR_KERNEL_SRT}"
 
+  export NCURSES_NO_ALTSCREEN=1
   # shellcheck disable=SC2034
   if VAR_KERNEL=$(dialog \
                           --no-collapse \
                           --ascii-lines \
                           --clear \
+                          --help-button \
                           --backtitle "CISS.debian.installer" \
                           --title "Select the Kernel for the CISS.debian.installer" \
                           --radiolist "Kernel available \n *+bpo*       : Debian Backported Kernel \n *cloud*      : Special lightweight images for KVM \n *unsigned*   : Unsigned Kernel \n *preempt_rt* : Special Kernel for real-time-computing \n Not unsigned marked are MS signed Kernel for Secure Boot \n" 0 0 "${options[@]}" 3>&1 1>&2 2>&3 3>&-); then

meta_loader_func.sh

@@ -48,28 +48,30 @@ source_guard "./func/cdi_4000_debootstrap/4040_setup_timezone.sh"
 source_guard "./func/cdi_4000_debootstrap/4050_setup_locales.sh"
 
 ### cdi_4100_base_installation
-source_guard "./func/cdi_4100_base_installation/4100_generate_sources.sh"
+source_guard "./func/cdi_4100_base/4100_generate_sources.sh"
-source_guard "./func/cdi_4100_base_installation/4110_update_sources.sh"
+source_guard "./func/cdi_4100_base/4110_update_sources.sh"
-source_guard "./func/cdi_4100_base_installation/4120_installation_kernel.sh"
+source_guard "./func/cdi_4100_base/4120_installation_kernel.sh"
-source_guard "./func/cdi_4100_base_installation/4130_installation_toolset.sh"
+source_guard "./func/cdi_4100_base/4130_installation_toolset.sh"
-source_guard "./func/cdi_4100_base_installation/4131_installation_systemd.sh"
+source_guard "./func/cdi_4100_base/4131_installation_systemd.sh"
-source_guard "./func/cdi_4100_base_installation/4132_installation_machineid.sh"
+source_guard "./func/cdi_4100_base/4132_installation_machineid.sh"
-source_guard "./func/cdi_4100_base_installation/4140_installation_microcode.sh"
+source_guard "./func/cdi_4100_base/4133_installation_masking.sh"
-source_guard "./func/cdi_4100_base_installation/4150_installation_chrony.sh"
+source_guard "./func/cdi_4100_base/4140_installation_microcode.sh"
+source_guard "./func/cdi_4100_base/4150_installation_chrony.sh"
 
 ### cdi_4200_boot_installation
-source_guard "./func/cdi_4200_boot_installation/4200_generate_fstab.sh"
+source_guard "./func/cdi_4200_boot/4200_generate_fstab.sh"
-source_guard "./func/cdi_4200_boot_installation/4210_generate_crypttab.sh"
+source_guard "./func/cdi_4200_boot/4210_generate_crypttab.sh"
-source_guard "./func/cdi_4200_boot_installation/4220_update_initramfs.sh"
+source_guard "./func/cdi_4200_boot/4220_installation_cryptsetup.sh"
-source_guard "./func/cdi_4200_boot_installation/4230_update_grub.sh"
+source_guard "./func/cdi_4200_boot/4230_update_grub.sh"
-source_guard "./func/cdi_4200_boot_installation/4240_update_grub_password.sh"
+source_guard "./func/cdi_4200_boot/4240_update_grub_password.sh"
-source_guard "./func/cdi_4200_boot_installation/4250_update_grub_bootparameter.sh"
+source_guard "./func/cdi_4200_boot/4250_update_grub_bootparameter.sh"
 
 ### cdi_4300_network
 source_guard "./func/cdi_4300_network/4300_installation_network.sh"
 source_guard "./func/cdi_4300_network/4310_dropbear_build.sh"
 source_guard "./func/cdi_4300_network/4311_dropbear_initramfs.sh"
 source_guard "./func/cdi_4300_network/4312_dropbear_setup.sh"
+source_guard "./func/cdi_4300_network/4320_update_initramfs.sh"
 
 ### cdi_4400_hardening
 source_guard "./func/cdi_4400_hardening/4400_kernel_modules.sh"

var/errors.var.sh

@@ -40,16 +40,16 @@ declare -girx ERR_MOUNTING_DEV=233      # The Device could not be mounted.
 declare -girx ERR_MOUNTING_ROOT=232     # The '/' Volume could not be mounted.
 declare -girx ERR_MOUNTING_LUKS=231     # The LUKS Volume could not be mounted.
 declare -girx ERR_UNKNOWN_DEV=230       # Unknown Device Path.
-declare -girx ERR_DEBOOTSTRAP=229       # Failure occurred on debootstrap.
+declare -girx ERR_DEBOOTSTRAP=229       # Failure occurred on the debootstrap.
 declare -girx ERR_CHRT_MOUNTS=228       # Failure occurred while mounting system devices.
 declare -girx ERR_CHRT_COMMAND=227      # Failure occurred while executing chroot environment command.
-declare -girx ERR_GRUB_EFI_FORCE=226    # Invalid combination of Partition Table and grub_force_efi.
+declare -girx ERR_GRUB_INSTALL=226      # Error while installing Grub on the specified device.
 declare -girx ERR_GRUB_BACKGROUND=225   # Failure occurred on setting up the GRUB-background.
 declare -girx ERR_GRUB_ARCHITECTURE=224 # Architecture is not supported by Grub.
-declare -girx ERR_PATH_NOT_VALID=223    # Specific path is not existing.
+declare -girx ERR_PATH_NOT_VALID=223    # A specific path is not existing.
-declare -girx ERR_READ_NUKE_FILE=222    # Error reading Luks Nuke password file.
+declare -girx ERR_READ_NUKE_FILE=222    # Error reading the Luks Nuke password file.
-declare -girx ERR_READ_GRUB_FILE=221    # Error reading Grub password file.
+declare -girx ERR_READ_GRUB_FILE=221    # Error reading the Grub password file.
-declare -girx ERR_READ_PASS_FILE=220    # Error reading password file.
+declare -girx ERR_READ_PASS_FILE=220    # Error reading the password file.
 declare -girx ERR_GENERATE_SALT=219     # Error generating salt.
 
 ### Definition of error trap vars.