V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-07-24 18:28:35 +02:00
parent e9681e87c5
commit 0a2d983c7d
64 changed files with 525 additions and 1423 deletions
--- a/func/3.8.7.functions_installation_setup_files.sh
+++ b/func/3.8.7.functions_installation_setup_files.sh
@@ -1,64 +0,0 @@
-#!/bin/bash
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: 2025-02-13; WEIDNER, Marc S.; <cendev@coresecret.eu>
-# SPDX-ExternalRef: GIT https://cendev.eu/marc.weidner/CISS.2025.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <cendev@coresecret.eu>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.2025.hardened.installer framework.
-# SPDX-PackageName: CISS.2025.hardened.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-###########################################################################################
-# 3.8.7. Functions - installation - updating files                                        #
-###########################################################################################
-
-###########################################################################################
-# Updating alias and banner files.
-# Globals:
-#   MODULE_ERR
-#   MODULE_TXT
-#   PATH_ABS
-#   TARGET
-#   accounts_user_login
-#   accounts_user_name
-# Arguments:
-#   None
-###########################################################################################
-3_8_7_functions_installation_setup_files() {
-  declare -g -x MODULE_ERR="3_8_7_functions_installation_setup_files"
-  declare -g -x MODULE_TXT="Updating banner files"
-  do_show_header "${MODULE_TXT}"
-
-  cp "${PATH_ABS}"/.assets/.alias "${TARGET}"/root/.alias
-  chown root:root "${TARGET}"/root/.alias
-  chmod 0600 "${TARGET}"/root/.alias
-  do_log "info" "false" "'${TARGET}/root/.alias' installed."
-
-  cp "${PATH_ABS}"/.assets/banner "${TARGET}"/etc/banner
-  chown root:root "${TARGET}"/etc/banner
-  chmod 0644 "${TARGET}"/etc/banner
-  do_log "info" "false" "'${TARGET}/etc/banner' installed."
-
-  cp "${PATH_ABS}"/.assets/.clean_logout "${TARGET}"/root/.clean_logout
-  chown root:root "${TARGET}"/root/.clean_logout
-  chmod 0600 "${TARGET}"/root/.clean_logout
-  do_log "info" "false" "'${TARGET}/root/.clean_logout' installed."
-
-  cp "${PATH_ABS}"/.assets/motd "${TARGET}"/etc/motd
-  chown root:root "${TARGET}"/etc/motd
-  chmod 0644 "${TARGET}"/etc/motd
-  do_log "info" "false" "'${TARGET}/etc/motd' installed."
-
-  cat "${PATH_ABS}"/.assets/.bashrc_cat >> "${TARGET}"/root/.bashrc
-  do_log "info" "false" "'${TARGET}/root/.bashrc' updated."
-
-  if [[ ${accounts_user_login,,} == "true" ]]; then
-    cat "${PATH_ABS}"/.assets/.bashrc_cat >> "${TARGET}"/home/"${accounts_user_name}"/.bashrc
-    do_log "info" "false" "'${TARGET}/home/${accounts_user_name}/.bashrc' updated."
-  fi
-
-  do_show_footer "${MODULE_TXT}"
-}
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
--- a/func/3.8.8.functions_installation_exiting_chroot.sh
+++ b/func/3.8.8.functions_installation_exiting_chroot.sh
@@ -1,42 +0,0 @@
-#!/bin/bash
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: 2025-02-13; WEIDNER, Marc S.; <cendev@coresecret.eu>
-# SPDX-ExternalRef: GIT https://cendev.eu/marc.weidner/CISS.2025.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <cendev@coresecret.eu>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.2025.hardened.installer framework.
-# SPDX-PackageName: CISS.2025.hardened.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-###########################################################################################
-# 3.8.8. Functions - installation - exiting chroot                                        #
-###########################################################################################
-
-###########################################################################################
-# Exiting chroot.
-# Globals:
-#   MODULE_ERR
-#   MODULE_TXT
-#   TARGET
-# Arguments:
-#   None
-###########################################################################################
-3_8_8_functions_installation_exiting_chroot() {
-  declare -g -x MODULE_ERR="3_8_8_functions_installation_exiting_chroot"
-  declare -g -x MODULE_TXT="exiting chroot"
-  do_show_header "${MODULE_TXT}"
-
-  umount -lf "${TARGET}/proc"
-  do_log "info" "true" "'umount -lf ${TARGET}/proc'."
-  umount -lf "${TARGET}/sys"
-  do_log "info" "true" "'umount -lf ${TARGET}/sys'."
-  umount -lf "${TARGET}/dev"
-  do_log "info" "true" "'umount -lf ${TARGET}/dev'."
-  umount -lf "${TARGET}/run"
-  do_log "info" "true" "'umount -lf ${TARGET}/run'."
-
-  do_show_footer "${MODULE_TXT}"
-}
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
--- a/func/helper/1080_helper_chroot.sh
+++ b/func/helper/1080_helper_chroot.sh
@@ -45,6 +45,8 @@ do_in_target() {
    HOME=/root \
    PATH=/usr/sbin:/usr/bin:/sbin:/bin \
    TERM="${TERM}" \
+    LANG=C.UTF-8 \
+    LC_ALL=C.UTF-8 \
    "${ary_chroot_command[@]}"
  then
    do_log "info" "true" "Success: chroot '${var_chroot_target}': '${ary_chroot_command[*]}'."
@@ -85,6 +87,8 @@ do_in_target_script() {
    HOME=/root \
    PATH=/usr/sbin:/usr/bin:/sbin:/bin \
    TERM="${TERM}" \
+    LANG=C.UTF-8 \
+    LC_ALL=C.UTF-8 \
    /bin/bash -c "${var_chroot_script}"

  then
--- a/func/helper/1081_helper_grub.sh
+++ b/func/helper/1081_helper_grub.sh
@@ -15,6 +15,9 @@

 guard_sourcing

+### Variable to finish GRUB CMDLINE strings.
+declare -grx VAR_H='"'
+
 #######################################
 # Helper module to extract the current GRUB CMDLINE strings.
 # Globals:
--- a/func/helper/1120_logging_modules.sh
+++ b/func/helper/1120_logging_modules.sh
@@ -33,7 +33,7 @@ log_level_value() {
 #######################################
 # Filter and compare log levels.
 # Globals:
-#   DEFAULT_LOG_LEVEL
+#   VAR_DEFAULT_LOG_LEVEL
 # Arguments:
 #   1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
 #######################################
@@ -41,9 +41,9 @@ do_should_log() {
  # shellcheck disable=SC2155
  declare -i var_desired_log_value=$(log_level_value "$1")                   # Desired log level
  # shellcheck disable=SC2155
-  declare -i var_default_log_value=$(log_level_value "${DEFAULT_LOG_LEVEL}") # Current threshold
+  declare -i var_default_log_value=$(log_level_value "${VAR_DEFAULT_LOG_LEVEL}") # Current threshold
  ###  Return true if a message should be logged.
-  [[ $var_desired_log_value -le $var_default_log_value ]]
+  [[ ${var_desired_log_value} -le ${var_default_log_value} ]]
 }

 #######################################
--- a/func/helper/1251_yaml_reader.sh
+++ b/func/helper/1251_yaml_reader.sh
@@ -58,6 +58,7 @@ yaml_reader() {
  declare var_highest_dev

  ### Search "${var_if}" for matching recipe_${VAR_RECIPE_STRING}_dev_* entries and find the highest dev letter
+  # shellcheck disable=SC2312
  var_highest_dev=$(grep -E "^recipe_${VAR_RECIPE_STRING}_dev_" "${var_if}" | awk -F'_' '
 {
  if (NF >= 4) {
@@ -78,7 +79,7 @@ END { print max }
  ### Save the result in VAR_RECIPE_DEV_COUNTER
  declare -gx VAR_RECIPE_DEV_COUNTER="${var_highest_dev}"

-  if [[ -n ${VAR_RECIPE_DEV_COUNTER} ]]; then
+  if [[ -n "${VAR_RECIPE_DEV_COUNTER}" ]]; then
    do_log "info" "true" "Found highest recipe device: '${VAR_RECIPE_DEV_COUNTER}'."
  else
    do_log "fatal" "true" "Found NO highest recipe device: '${VAR_RECIPE_DEV_COUNTER}'." >&2
@@ -86,9 +87,10 @@ END { print max }
  fi

  declare var_device="" var_fields="" var_line="" var_partition=""
-  declare -Agx HMP_RECIPE_DEV_PARTITIONS=()
+  declare -Ag HMP_RECIPE_DEV_PARTITIONS=()

  ### Read var_if and iterate through all matching entries without executing in a subshell
+  # shellcheck disable=SC2312
  while read -r var_line; do
    ### Extract fields of line
    IFS='_' read -ra var_fields <<< "${var_line}"
@@ -115,6 +117,13 @@ END { print max }
    do_log "info" "false" "Highest number of partitions for ${var_device}: ${HMP_RECIPE_DEV_PARTITIONS[${var_device}]}"
  done

+  ### Extract architecture
+  declare -gx VAR_ARCHITECTURE="${architecture}"
+
+  ### Extract chosen firmware
+  declare recipe_firmware_var="recipe_${VAR_RECIPE_STRING}_control_firmware"
+  declare -gx VAR_RECIPE_FIRMWARE="${!recipe_firmware_var}"
+
  ### Extract the chosen Nuke mechanism
  declare recipe_nuke_var="recipe_${VAR_RECIPE_STRING}_control_nuke"
  declare -gx VAR_NUKE="${!recipe_nuke_var}"
@@ -123,25 +132,21 @@ END { print max }
  declare recipe_table_var="recipe_${VAR_RECIPE_STRING}_control_table"
  declare -gx VAR_RECIPE_TABLE="${!recipe_table_var}"

-  ### Extract chosen firmware
-  declare recipe_firmware_var="recipe_${VAR_RECIPE_STRING}_control_firmware"
-  declare -gx VAR_RECIPE_FIRMWARE="${!recipe_firmware_var}"
-
  if [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then

-    do_log "info" "false" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP 'EF00' necessary."
+    do_log "info" "true" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP 'EF00' necessary."

  elif [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then

-    do_log "info" "false" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > BIOS Boot Partition 'EF02' necessary."
+    do_log "info" "true" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > BIOS Boot Partition 'EF02' necessary."

  elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then

-    do_log "info" "false" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP on MBR needs partition type '0xEF'."
+    do_log "info" "true" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP on MBR needs partition type '0xEF'."

  elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then

-    do_log "info" "false" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > No special firmware partition necessary."
+    do_log "info" "true" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > No special firmware partition necessary."

  fi

--- a/func/partitioning/3200_partitioning.sh
+++ b/func/partitioning/3200_partitioning.sh
@@ -36,6 +36,7 @@ partitioning() {
  declare -a ary_devs ary_parts

  ### Iterate over all devices in the recipe.
+  # shellcheck disable=SC2312
  readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
  for var_dev in "${ary_devs[@]}"; do

@@ -64,6 +65,7 @@ partitioning() {
    esac

    ### Iterate over all partitions for this device.
+    # shellcheck disable=SC2312
    readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
    for var_part in "${ary_parts[@]}"; do

--- a/func/partitioning/3220_partition_encryption.sh
+++ b/func/partitioning/3220_partition_encryption.sh
@@ -32,7 +32,7 @@ guard_sourcing
 #######################################
 partition_encryption() {
  ### Declare Arrays and Variables.
-  declare -Agx HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_EPHEMERAL_FS_LABEL HMP_PATH_LUKSUUID HMP_PATH_ENCLABEL
+  declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_EPHEMERAL_FS_LABEL HMP_PATH_LUKSUUID HMP_PATH_ENCLABEL
  declare var_dev var_part \
    var_encryption_enable var_encryption_ephemeral var_encryption_integrity var_encryption_cipher \
    var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta \
@@ -40,10 +40,12 @@ partition_encryption() {
  declare -a ary_devs=() ary_parts=() ary_luks_opts=()

  ### Iterate over all devices in the recipe.
+  # shellcheck disable=SC2312
  readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
  for var_dev in "${ary_devs[@]}"; do

    ### Iterate over all partitions for this device.
+    # shellcheck disable=SC2312
    readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
    for var_part in "${ary_parts[@]}"; do

--- a/func/partitioning/3240_partition_formatting.sh
+++ b/func/partitioning/3240_partition_formatting.sh
@@ -33,10 +33,12 @@ partition_formatting() {
  declare -a ary_devs ary_parts ary_opts ary_fmt_opts

  ### Iterate over all devices in the recipe.
+  # shellcheck disable=SC2312
  readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
  for var_dev in "${ary_devs[@]}"; do

    ### Iterate over all partitions for this device.
+    # shellcheck disable=SC2312
    readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
    for var_part in "${ary_parts[@]}"; do

--- a/func/partitioning/3260_setup_filesystem.sh
+++ b/func/partitioning/3260_setup_filesystem.sh
@@ -30,10 +30,12 @@ setup_filesystem() {
  declare -a ary_devs ary_parts

  ### Iterate over all devices in the recipe.
+  # shellcheck disable=SC2312
  readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
  for var_dev in "${ary_devs[@]}"; do

    ### Iterate over all partitions for this device.
+    # shellcheck disable=SC2312
    readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
    for var_part in "${ary_parts[@]}"; do

--- a/func/partitioning/3280_mount_partition.sh
+++ b/func/partitioning/3280_mount_partition.sh
@@ -23,7 +23,7 @@ guard_sourcing
 skip_path() {
  declare -a ary_skip=( "/" "/boot" "/boot/efi" "/recovery" )
  declare p
-  for p in "${ary_skip[@]}"; do [[ "$1" == "$p" ]] && return 0; done
+  for p in "${ary_skip[@]}"; do [[ "$1" == "${p}" ]] && return 0; done
  return 1
 }

@@ -107,9 +107,9 @@ mount_partition() {
  ### Mount "/"-filesystem
  declare -r var_mount_path_root="/"

-  if [[ -n ${HMP_MOUNTPATH_DEV[$var_mount_path_root]} ]]; then
+  if [[ -n ${HMP_MOUNTPATH_DEV[${var_mount_path_root}]} ]]; then

-    mount_with_dir "${var_mount_path_root}" "${HMP_MOUNTPATH_DEV[$var_mount_path_root]}" || return "${ERR_MOUNTING_DEV}"
+    mount_with_dir "${var_mount_path_root}" "${HMP_MOUNTPATH_DEV[${var_mount_path_root}]}" || return "${ERR_MOUNTING_DEV}"

  else

@@ -142,10 +142,12 @@ mount_partition() {
  declare -a ary_devs ary_parts

  ### Iterate over all devices in the recipe.
+  # shellcheck disable=SC2312
  readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
  for var_dev in "${ary_devs[@]}"; do

    ### Iterate over all partitions for this device.
+    # shellcheck disable=SC2312
    readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
    for var_part in "${ary_parts[@]}"; do

--- a/func/partitioning/3290_uuid_logger.sh
+++ b/func/partitioning/3290_uuid_logger.sh
@@ -28,10 +28,10 @@ uuid_logger() {
  declare var_key var_mountpoint var_uuid
  printf 'UUID Partition:\n' >> "${LOG_UID}"
  for var_key in "${!HMP_PATH_PARTUUID[@]}"; do
-    # Remove Prefix "UUID_"
+    ### Remove Prefix "UUID_"
    var_mountpoint="${var_key#UUID_}"
    var_uuid="${HMP_PATH_PARTUUID[${var_key}]}"
-    # Left-aligned field width 63; "UUID=" starts directly after column 64.
+    ### Left-aligned field width 63; "UUID=" starts directly after column 64.
    printf '%-63sUUID=%s\n' "${var_mountpoint}:" "${var_uuid}" >> "${LOG_UID}"
  done

@@ -40,17 +40,17 @@ uuid_logger() {
  for var_key in "${!HMP_PATH_ENCLABEL[@]}"; do
    var_mountpoint="${HMP_PATH_ENCLABEL[${var_key}]}"
    var_uuid="${HMP_PATH_PARTUUID[${var_key}]}"
-    # Left-aligned field width 63; "UUID=" starts directly after column 64.
+    ### Left-aligned field width 63; "UUID=" starts directly after column 64.
    printf '%-63sUUID=%s\n' "${var_mountpoint}:" "${var_uuid}" >> "${LOG_UID}"
  done

  printf '\n' >> "${LOG_UID}"
  printf 'UUID Filesystem:\n' >> "${LOG_UID}"
  for var_key in "${!HMP_PATH_FSUUID[@]}"; do
-    # Remove Prefix "UUID_"
+    ### Remove Prefix "UUID_"
    var_mountpoint="${var_key#UUID_}"
    var_uuid="${HMP_PATH_FSUUID[${var_key}]}"
-    # Left-aligned field width 63; "UUID=" starts directly after column 64.
+    ### Left-aligned field width 63; "UUID=" starts directly after column 64.
    printf '%-63sUUID=%s\n' "${var_mountpoint}:" "${var_uuid}" >> "${LOG_UID}"
  done

--- a/func/system/4000_debootstrap.sh
+++ b/func/system/4000_debootstrap.sh
@@ -25,7 +25,7 @@ guard_sourcing
 #   0: on success
 #######################################
 func_debootstrap() {
-  # shellcheck disable=SC2154 # "${architecture}" "${distribution}"
+  # shellcheck disable=SC2312
  if debootstrap --arch="${architecture}" "${distribution}" "${TARGET}" https://deb.debian.org/debian | tee "${LOG_DBS}"; then
    do_log "info" "false" "Executing 'debootstrap --arch=${architecture} ${distribution} '${TARGET}' https://deb.debian.org/debian' successful."
    return 0
--- a/func/system/4130_setup_network.sh
+++ b/func/system/4130_setup_network.sh
@@ -70,19 +70,30 @@ setup_network() {
  [[ -v network_static_ipv6nameserver_fallback_1 ]] && ary_ipv6_ns+=("${network_static_ipv6nameserver_fallback_1}")

  ### Check current network connection and configure variables
+  # shellcheck disable=SC2312
  var_auto_nic=$(ip -o link show | awk -F': ' '/state UP/ && $2!="lo" {print $2; exit}')
+  # shellcheck disable=SC2312
  var_auto_ipv4_ccidr=$(ip -4 -o addr show "${var_auto_nic}" | awk '{print $4; exit}')
+  # shellcheck disable=SC2312
  var_auto_ipv4_subnet=$(generate_subnetmask "${var_auto_ipv4_ccidr}")
+  # shellcheck disable=SC2312
  var_auto_ipv4=$(echo "${var_auto_ipv4_ccidr}" | awk -F'/' '{print $1}')
+  # shellcheck disable=SC2312
  var_auto_ipv4_gw=$(ip route show default dev "${var_auto_nic}" | awk '/^default/ {print $3; exit}')
+  # shellcheck disable=SC2312
  var_auto_ipv6_ccidr=$(ip -6 -o addr show "${var_auto_nic}" | awk '/scope global/ {print $4; exit}')
  if [[ -n "${var_auto_ipv6_ccidr}" ]]; then
+    # shellcheck disable=SC2312
    var_auto_ipv6=$(echo "${var_auto_ipv6_ccidr}" | awk -F'/' '{print $1}')
+    # shellcheck disable=SC2312
    var_auto_ipv6_gw=$(ip -6 route show default dev "${var_auto_nic}" | awk '/^default/ {print $3; exit}')
  fi
+  # shellcheck disable=SC2312
  var_link_ipv4=$(ping -q -c 1 -W 1 -4 debian.org > /dev/null 2>&1 && echo "true" || echo "false")
+  # shellcheck disable=SC2312
  var_link_ipv6=$(ping -q -c 1 -W 1 -6 debian.org > /dev/null 2>&1 && echo "true" || echo "false")
  if [[ -f "/var/lib/dhcp/dhclient.${var_auto_nic}.leases" ]]; then
+    # shellcheck disable=SC2312
    var_auto_fqdn=$(grep -m1 'option host-name' "/var/lib/dhcp/dhclient.${var_auto_nic}.leases" | sed -E 's/.*"([^"]+)".*/\1/')
  else
    var_auto_fqdn=""
--- a/func/system/4150_setup_grub.sh
+++ b/func/system/4150_setup_grub.sh
@@ -36,7 +36,9 @@ guard_sourcing
 #   0: on success
 #######################################
 setup_grub() {
-  declare var_update_grub_required="false"
+  declare -gx var_update_grub_required="false"
+  get_all_boot_devs
+

  if [[ "${grub_skip,,}" != "true" ]]; then

@@ -44,37 +46,51 @@ setup_grub() {
    if [[ "${grub_latest,,}" == "true" ]]; then

      ### Install the GRUB2 backported version from the Bookworm backports repository.
-      do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common
+      if [[ "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
+
+        case "${VAR_ARCHITECTURE,,}" in
+          amd64)  do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-efi-amd64 ;;
+          arm64)  do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-efi-arm64 ;;
+          i386)   do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-efi-ia32  ;;
+          *)      do_log "emergency" "true" "Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
+        esac
+
+      else
+
+        do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-pc
+
+      fi

    else

      ### Install the GRUB2 stable version.
-      do_in_target "${TARGET}" apt-get install -y grub2 grub2-common
+      if [[ "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
+
+        case "${VAR_ARCHITECTURE,,}" in
+          amd64)  do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-efi-amd64 ;;
+          arm64)  do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-efi-arm64 ;;
+          i386)   do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-efi-ia32  ;;
+          *)      do_log "emergency" "true" "Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
+        esac
+
+      else
+
+        do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-pc
+
+      fi

    fi

    ### Install grub on the specific device.
    if [[ "${grub_force_efi,,}" == "false" ]]; then

-      if [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
+      if [[ "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then

-        do_in_target "${TARGET}" grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=Debian --modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 part_gpt"
-        var_update_grub_required="true"
+        install_grub_uefi_all

-      elif [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "bios"  ]]; then
+      elif [[ "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then

-        do_in_target "${TARGET}" grub-install --target=i386-pc --boot-directory=/boot --modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 part_gpt" --recheck "${grub_bootdev}"
-        var_update_grub_required="true"
-
-      elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
-
-        do_in_target "${TARGET}" grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=Debian --modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 part_msdos"
-        var_update_grub_required="true"
-
-      elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
-
-        do_in_target "${TARGET}" grub-install --target=i386-pc --boot-directory=/boot --modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 part_msdos" --recheck "${grub_bootdev}"
-        var_update_grub_required="true"
+        install_grub_bios_all

      fi

@@ -173,4 +189,123 @@ EOF

  return 0
 }
+
+#######################################
+# Detects and collects all boot devices for GRUB installation.
+# Supports /dev/sdX, /dev/vdX, /dev/hdX, /dev/nvmeXn1, /dev/mmcblkX.
+# Globals:
+#   VAR_RECIPE_DEV_COUNTER
+#   ary_bootdev_all
+#   grub_bootdev
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+get_all_boot_devs() {
+  declare -ag ary_bootdev_all=()
+  declare dev="" dev_prefix="" dev_path="" letter=""
+  declare -i ascii ascii_end ascii_start
+
+  ### Determine prefix from grub_bootdev (e.g., "sd", "vd", "nvme", "mmcblk")
+  dev_prefix=$(basename "${grub_bootdev}" | sed -E 's/^([a-z]+)[a-z0-9]*$/\1/')
+
+  case "${dev_prefix}" in
+    sd|vd|hd)
+      ascii_start=$(printf '%d' "'a")
+      ascii_end=$(printf '%d' "'${VAR_RECIPE_DEV_COUNTER}")
+      for ((ascii = ascii_start; ascii <= ascii_end; ascii++)); do
+        letter=$(printf "%b" "\\$(printf '%03o' "${ascii}")")
+        dev_path="/dev/${dev_prefix}${letter}"
+        [[ -b "${dev_path}" ]] && ary_bootdev_all+=("${dev_path}")
+      done
+      ;;
+    nvme)
+      # shellcheck disable=SC2312
+      while read -r dev; do
+        ary_bootdev_all+=("/dev/${dev}")
+      done < <(lsblk -dn -o NAME | grep -E '^nvme[0-9]+n1$')
+      ;;
+    mmcblk)
+      # shellcheck disable=SC2312
+      while read -r dev; do
+        ary_bootdev_all+=("/dev/${dev}")
+      done < <(lsblk -dn -o NAME | grep -E '^mmcblk[0-9]+$')
+      ;;
+    *)
+      do_log "warning" "true" "Unrecognized boot device prefix: ${dev_prefix}"
+      ;;
+  esac
+
+  return 0
+}
+
+#######################################
+# Installs GRUB in BIOS mode on all block devices.
+# Globals:
+#   TARGET
+#   VAR_RECIPE_TABLE
+#   ary_bootdev_all
+#   var_update_grub_required
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#   ERR_PARTITIONTBL on failure
+#######################################
+install_grub_bios_all() {
+  declare dev="" partmod=""
+
+  case "${VAR_RECIPE_TABLE,,}" in
+    gpt)       partmod="part_gpt"   ;;
+    msdos|mbr) partmod="part_msdos" ;;
+    *)         do_log "emergency" "true" "Unknown partition table type: '${VAR_RECIPE_TABLE}'."; return "${ERR_PARTITIONTBL}" ;;
+  esac
+
+  declare var_modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 ${partmod}"
+  declare -a args=(--target=i386-pc --boot-directory=/boot "--modules=${var_modules}")
+  args+=(--recheck)
+
+  for dev in "${ary_bootdev_all[@]}"; do
+    do_in_target "${TARGET}" grub-install "${args[@]}" "${dev}"
+    do_log "info" "true" "Installed: GRUB on Device: '${dev}' (BIOS)."
+    var_update_grub_required="true"
+  done
+
+  return 0
+}
+
+#######################################
+# Installs GRUB to all ESPs in UEFI mode.
+# Globals:
+#   TARGET
+#   VAR_RECIPE_TABLE
+#   ary_bootdev_all
+#   var_update_grub_required
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#   ERR_PARTITIONTBL on failure
+#######################################
+install_grub_uefi_all() {
+  declare dev="" partmod=""
+
+  case "${VAR_RECIPE_TABLE,,}" in
+    gpt)       partmod="part_gpt"   ;;
+    msdos|mbr) partmod="part_msdos" ;;
+    *)         do_log "emergency" "true" "Unknown partition table type: '${VAR_RECIPE_TABLE}'."; return "${ERR_PARTITIONTBL}" ;;
+  esac
+
+  declare var_modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 ${partmod}"
+  declare -a args=(--target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=Debian "--modules=${var_modules}")
+
+  for dev in "${ary_bootdev_all[@]}"; do
+    do_in_target "${TARGET}" grub-install "${args[@]}"
+    do_log "info" "true" "Installed: GRUB on Device: '${dev}' (UEFI)."
+    var_update_grub_required="true"
+  done
+
+  return 0
+}
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
--- a/func/system/4155_setup_grub_password.sh
+++ b/func/system/4155_setup_grub_password.sh
@@ -54,9 +54,9 @@ setup_grub_password() {
    {
      echo ""
      echo "### Added by CISS.debian.installer ###"
-      echo "$var_grub_entry"
+      echo "${var_grub_entry}"
      echo "### End by CISS.debian.installer ###"
-    } >> "$var_of"
+    } >> "${var_of}"
  fi

  do_in_target "${TARGET}" update-grub
@@ -80,12 +80,12 @@ generate_grub_password_pbkdf2() {
    log_user 0
    spawn grub-mkpasswd-pbkdf2 --iteration-count=131072 --salt=64 --buflen=64
    expect "Enter password:"
-    send "$var_pass\r"
+    send "${var_pass}\r"
    expect "Reenter password:"
-    send "$var_pass\r"
+    send "${var_pass}\r"
    expect {
      -re {PBKDF2 hash of your password is (\S+)} {
-        puts "set superusers=\"$var_user\"\npassword_pbkdf2 $var_user \$expect_out(1,string)"
+        puts "set superusers=\"${var_user}\"\npassword_pbkdf2 ${var_user} \$expect_out(1,string)"
      }
    }
 EOF
--- a/func/system/4170_installation_microcode.sh
+++ b/func/system/4170_installation_microcode.sh
@@ -24,10 +24,14 @@ guard_sourcing
 installation_microcode() {
  declare var_microcode_pkgs=""

-  declare var_whereiam; var_whereiam=$(virt-what | head -n1)
+  declare var_whereiam
+  # shellcheck disable=SC2312
+  var_whereiam=$(virt-what | head -n1)
  [[ -z "${var_whereiam}" ]] && var_whereiam="baremetal"

-  declare var_cpu_vendor; var_cpu_vendor=$(lscpu | awk -F: '/Vendor ID/ {print $2}' | xargs)
+  declare var_cpu_vendor
+  # shellcheck disable=SC2312
+  var_cpu_vendor=$(lscpu | awk -F: '/Vendor ID/ {print $2}' | xargs)

  case "${var_cpu_vendor}" in
    *AuthenticAMD*)   var_microcode_pkgs="amd64-microcode" ;;
--- a/func/system/4190_build_dropbear.sh
+++ b/func/system/4190_build_dropbear.sh
@@ -51,6 +51,7 @@ build_dropbear() {
    --disable-pam \
    --disable-zlib

+  # shellcheck disable=2312
  make -j"$(nproc)"

  do_log "info" "true" "Ultra Hardened dropbear-2025.88 build successfully from sources."
--- a/func/system/4195_setup_dropbear.sh
+++ b/func/system/4195_setup_dropbear.sh
@@ -103,6 +103,7 @@ setup_dropbear() {
  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/files/unlock_wrapper.sh" \
    "${TARGET}/usr/lib/cryptsetup/scripts/"

+  # TODO: Update preseed.yaml for pgp signing key AND / OR implementation of presigned unlock-wrapper.sh
  ### Install the script to be called inside Host environment for signing 'unlock_wrapper.sh'-script.
  install -D -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/files/unlock_wrapper_signer.sh" \
    "${TARGET}/includes/initramfs-tools/files/"
@@ -224,6 +225,7 @@ grep_nic_driver_modules() {
  ### Collect all ethernet driver names and sort them uniquely.
  declare -a _mods
  declare var_nic_module var_nic_modules
+  # shellcheck disable=SC2312
  readarray -t _mods < <(
    lspci -k \
      | grep -A2 -i ethernet \
@@ -239,7 +241,7 @@ grep_nic_driver_modules() {
    var_nic_modules="${_mods[*]}"
  fi

-  if [[ -n "$var_nic_module" ]]; then
+  if [[ -n "${var_nic_module}" ]]; then
    echo "${var_nic_module}"
  else
    echo "${var_nic_modules}"
--- a/func/system/4999_exiting_chroot_system.sh
+++ b/func/system/4999_exiting_chroot_system.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Exiting chroot.
+# Globals:
+#   TARGET
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+exiting_chroot() {
+  umount -lf "${TARGET}/proc"
+  do_log "info" "true" "'umount -lf ${TARGET}/proc'."
+  umount -lf "${TARGET}/sys"
+  do_log "info" "true" "'umount -lf ${TARGET}/sys'."
+  umount -lf "${TARGET}/dev"
+  do_log "info" "true" "'umount -lf ${TARGET}/dev'."
+  umount -lf "${TARGET}/run"
+  do_log "info" "true" "'umount -lf ${TARGET}/run'."
+
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
--- a/func/system/5000_hardening_files.sh
+++ b/func/system/5000_hardening_files.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+###########################################################################################
+# Hardening files and directories.
+# Globals:
+#   None
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+###########################################################################################
+hardening_files() {
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh