V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/system/4000_debootstrap.sh

@@ -25,7 +25,7 @@ guard_sourcing
 #   0: on success
 #######################################
 func_debootstrap() {
-  # shellcheck disable=SC2154 # "${architecture}" "${distribution}"
+  # shellcheck disable=SC2312
   if debootstrap --arch="${architecture}" "${distribution}" "${TARGET}" https://deb.debian.org/debian | tee "${LOG_DBS}"; then
     do_log "info" "false" "Executing 'debootstrap --arch=${architecture} ${distribution} '${TARGET}' https://deb.debian.org/debian' successful."
     return 0

func/system/4130_setup_network.sh

@@ -70,19 +70,30 @@ setup_network() {
   [[ -v network_static_ipv6nameserver_fallback_1 ]] && ary_ipv6_ns+=("${network_static_ipv6nameserver_fallback_1}")
 
   ### Check current network connection and configure variables
+  # shellcheck disable=SC2312
   var_auto_nic=$(ip -o link show | awk -F': ' '/state UP/ && $2!="lo" {print $2; exit}')
+  # shellcheck disable=SC2312
   var_auto_ipv4_ccidr=$(ip -4 -o addr show "${var_auto_nic}" | awk '{print $4; exit}')
+  # shellcheck disable=SC2312
   var_auto_ipv4_subnet=$(generate_subnetmask "${var_auto_ipv4_ccidr}")
+  # shellcheck disable=SC2312
   var_auto_ipv4=$(echo "${var_auto_ipv4_ccidr}" | awk -F'/' '{print $1}')
+  # shellcheck disable=SC2312
   var_auto_ipv4_gw=$(ip route show default dev "${var_auto_nic}" | awk '/^default/ {print $3; exit}')
+  # shellcheck disable=SC2312
   var_auto_ipv6_ccidr=$(ip -6 -o addr show "${var_auto_nic}" | awk '/scope global/ {print $4; exit}')
   if [[ -n "${var_auto_ipv6_ccidr}" ]]; then
+    # shellcheck disable=SC2312
     var_auto_ipv6=$(echo "${var_auto_ipv6_ccidr}" | awk -F'/' '{print $1}')
+    # shellcheck disable=SC2312
     var_auto_ipv6_gw=$(ip -6 route show default dev "${var_auto_nic}" | awk '/^default/ {print $3; exit}')
   fi
+  # shellcheck disable=SC2312
   var_link_ipv4=$(ping -q -c 1 -W 1 -4 debian.org > /dev/null 2>&1 && echo "true" || echo "false")
+  # shellcheck disable=SC2312
   var_link_ipv6=$(ping -q -c 1 -W 1 -6 debian.org > /dev/null 2>&1 && echo "true" || echo "false")
   if [[ -f "/var/lib/dhcp/dhclient.${var_auto_nic}.leases" ]]; then
+    # shellcheck disable=SC2312
     var_auto_fqdn=$(grep -m1 'option host-name' "/var/lib/dhcp/dhclient.${var_auto_nic}.leases" | sed -E 's/.*"([^"]+)".*/\1/')
   else
     var_auto_fqdn=""

func/system/4150_setup_grub.sh

@@ -36,7 +36,9 @@ guard_sourcing
 #   0: on success
 #######################################
 setup_grub() {
-  declare var_update_grub_required="false"
+  declare -gx var_update_grub_required="false"
+  get_all_boot_devs
+
 
   if [[ "${grub_skip,,}" != "true" ]]; then
 
@@ -44,37 +46,51 @@ setup_grub() {
     if [[ "${grub_latest,,}" == "true" ]]; then
 
       ### Install the GRUB2 backported version from the Bookworm backports repository.
-      do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common
+      if [[ "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
+
+        case "${VAR_ARCHITECTURE,,}" in
+          amd64)  do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-efi-amd64 ;;
+          arm64)  do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-efi-arm64 ;;
+          i386)   do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-efi-ia32  ;;
+          *)      do_log "emergency" "true" "Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
+        esac
+
+      else
+
+        do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-pc
+
+      fi
 
     else
 
       ### Install the GRUB2 stable version.
-      do_in_target "${TARGET}" apt-get install -y grub2 grub2-common
+      if [[ "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
+
+        case "${VAR_ARCHITECTURE,,}" in
+          amd64)  do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-efi-amd64 ;;
+          arm64)  do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-efi-arm64 ;;
+          i386)   do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-efi-ia32  ;;
+          *)      do_log "emergency" "true" "Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
+        esac
+
+      else
+
+        do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-pc
+
+      fi
 
     fi
 
     ### Install grub on the specific device.
     if [[ "${grub_force_efi,,}" == "false" ]]; then
 
-      if [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
+      if [[ "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
 
-        do_in_target "${TARGET}" grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=Debian --modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 part_gpt"
-        var_update_grub_required="true"
+        install_grub_uefi_all
 
-      elif [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "bios"  ]]; then
+      elif [[ "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
 
-        do_in_target "${TARGET}" grub-install --target=i386-pc --boot-directory=/boot --modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 part_gpt" --recheck "${grub_bootdev}"
-        var_update_grub_required="true"
-
-      elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
-
-        do_in_target "${TARGET}" grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=Debian --modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 part_msdos"
-        var_update_grub_required="true"
-
-      elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
-
-        do_in_target "${TARGET}" grub-install --target=i386-pc --boot-directory=/boot --modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 part_msdos" --recheck "${grub_bootdev}"
-        var_update_grub_required="true"
+        install_grub_bios_all
 
       fi
 
@@ -173,4 +189,123 @@ EOF
 
   return 0
 }
+
+#######################################
+# Detects and collects all boot devices for GRUB installation.
+# Supports /dev/sdX, /dev/vdX, /dev/hdX, /dev/nvmeXn1, /dev/mmcblkX.
+# Globals:
+#   VAR_RECIPE_DEV_COUNTER
+#   ary_bootdev_all
+#   grub_bootdev
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+get_all_boot_devs() {
+  declare -ag ary_bootdev_all=()
+  declare dev="" dev_prefix="" dev_path="" letter=""
+  declare -i ascii ascii_end ascii_start
+
+  ### Determine prefix from grub_bootdev (e.g., "sd", "vd", "nvme", "mmcblk")
+  dev_prefix=$(basename "${grub_bootdev}" | sed -E 's/^([a-z]+)[a-z0-9]*$/\1/')
+
+  case "${dev_prefix}" in
+    sd|vd|hd)
+      ascii_start=$(printf '%d' "'a")
+      ascii_end=$(printf '%d' "'${VAR_RECIPE_DEV_COUNTER}")
+      for ((ascii = ascii_start; ascii <= ascii_end; ascii++)); do
+        letter=$(printf "%b" "\\$(printf '%03o' "${ascii}")")
+        dev_path="/dev/${dev_prefix}${letter}"
+        [[ -b "${dev_path}" ]] && ary_bootdev_all+=("${dev_path}")
+      done
+      ;;
+    nvme)
+      # shellcheck disable=SC2312
+      while read -r dev; do
+        ary_bootdev_all+=("/dev/${dev}")
+      done < <(lsblk -dn -o NAME | grep -E '^nvme[0-9]+n1$')
+      ;;
+    mmcblk)
+      # shellcheck disable=SC2312
+      while read -r dev; do
+        ary_bootdev_all+=("/dev/${dev}")
+      done < <(lsblk -dn -o NAME | grep -E '^mmcblk[0-9]+$')
+      ;;
+    *)
+      do_log "warning" "true" "Unrecognized boot device prefix: ${dev_prefix}"
+      ;;
+  esac
+
+  return 0
+}
+
+#######################################
+# Installs GRUB in BIOS mode on all block devices.
+# Globals:
+#   TARGET
+#   VAR_RECIPE_TABLE
+#   ary_bootdev_all
+#   var_update_grub_required
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#   ERR_PARTITIONTBL on failure
+#######################################
+install_grub_bios_all() {
+  declare dev="" partmod=""
+
+  case "${VAR_RECIPE_TABLE,,}" in
+    gpt)       partmod="part_gpt"   ;;
+    msdos|mbr) partmod="part_msdos" ;;
+    *)         do_log "emergency" "true" "Unknown partition table type: '${VAR_RECIPE_TABLE}'."; return "${ERR_PARTITIONTBL}" ;;
+  esac
+
+  declare var_modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 ${partmod}"
+  declare -a args=(--target=i386-pc --boot-directory=/boot "--modules=${var_modules}")
+  args+=(--recheck)
+
+  for dev in "${ary_bootdev_all[@]}"; do
+    do_in_target "${TARGET}" grub-install "${args[@]}" "${dev}"
+    do_log "info" "true" "Installed: GRUB on Device: '${dev}' (BIOS)."
+    var_update_grub_required="true"
+  done
+
+  return 0
+}
+
+#######################################
+# Installs GRUB to all ESPs in UEFI mode.
+# Globals:
+#   TARGET
+#   VAR_RECIPE_TABLE
+#   ary_bootdev_all
+#   var_update_grub_required
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#   ERR_PARTITIONTBL on failure
+#######################################
+install_grub_uefi_all() {
+  declare dev="" partmod=""
+
+  case "${VAR_RECIPE_TABLE,,}" in
+    gpt)       partmod="part_gpt"   ;;
+    msdos|mbr) partmod="part_msdos" ;;
+    *)         do_log "emergency" "true" "Unknown partition table type: '${VAR_RECIPE_TABLE}'."; return "${ERR_PARTITIONTBL}" ;;
+  esac
+
+  declare var_modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 ${partmod}"
+  declare -a args=(--target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=Debian "--modules=${var_modules}")
+
+  for dev in "${ary_bootdev_all[@]}"; do
+    do_in_target "${TARGET}" grub-install "${args[@]}"
+    do_log "info" "true" "Installed: GRUB on Device: '${dev}' (UEFI)."
+    var_update_grub_required="true"
+  done
+
+  return 0
+}
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/system/4155_setup_grub_password.sh

@@ -54,9 +54,9 @@ setup_grub_password() {
     {
       echo ""
       echo "### Added by CISS.debian.installer ###"
-      echo "$var_grub_entry"
+      echo "${var_grub_entry}"
       echo "### End by CISS.debian.installer ###"
-    } >> "$var_of"
+    } >> "${var_of}"
   fi
 
   do_in_target "${TARGET}" update-grub
@@ -80,12 +80,12 @@ generate_grub_password_pbkdf2() {
     log_user 0
     spawn grub-mkpasswd-pbkdf2 --iteration-count=131072 --salt=64 --buflen=64
     expect "Enter password:"
-    send "$var_pass\r"
+    send "${var_pass}\r"
     expect "Reenter password:"
-    send "$var_pass\r"
+    send "${var_pass}\r"
     expect {
       -re {PBKDF2 hash of your password is (\S+)} {
-        puts "set superusers=\"$var_user\"\npassword_pbkdf2 $var_user \$expect_out(1,string)"
+        puts "set superusers=\"${var_user}\"\npassword_pbkdf2 ${var_user} \$expect_out(1,string)"
       }
     }
 EOF

func/system/4170_installation_microcode.sh

@@ -24,10 +24,14 @@ guard_sourcing
 installation_microcode() {
   declare var_microcode_pkgs=""
 
-  declare var_whereiam; var_whereiam=$(virt-what | head -n1)
+  declare var_whereiam
+  # shellcheck disable=SC2312
+  var_whereiam=$(virt-what | head -n1)
   [[ -z "${var_whereiam}" ]] && var_whereiam="baremetal"
 
-  declare var_cpu_vendor; var_cpu_vendor=$(lscpu | awk -F: '/Vendor ID/ {print $2}' | xargs)
+  declare var_cpu_vendor
+  # shellcheck disable=SC2312
+  var_cpu_vendor=$(lscpu | awk -F: '/Vendor ID/ {print $2}' | xargs)
 
   case "${var_cpu_vendor}" in
     *AuthenticAMD*)   var_microcode_pkgs="amd64-microcode" ;;

func/system/4190_build_dropbear.sh

@@ -51,6 +51,7 @@ build_dropbear() {
     --disable-pam \
     --disable-zlib
 
+  # shellcheck disable=2312
   make -j"$(nproc)"
 
   do_log "info" "true" "Ultra Hardened dropbear-2025.88 build successfully from sources."

func/system/4195_setup_dropbear.sh

@@ -103,6 +103,7 @@ setup_dropbear() {
   install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/files/unlock_wrapper.sh" \
     "${TARGET}/usr/lib/cryptsetup/scripts/"
 
+  # TODO: Update preseed.yaml for pgp signing key AND / OR implementation of presigned unlock-wrapper.sh
   ### Install the script to be called inside Host environment for signing 'unlock_wrapper.sh'-script.
   install -D -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/files/unlock_wrapper_signer.sh" \
     "${TARGET}/includes/initramfs-tools/files/"
@@ -224,6 +225,7 @@ grep_nic_driver_modules() {
   ### Collect all ethernet driver names and sort them uniquely.
   declare -a _mods
   declare var_nic_module var_nic_modules
+  # shellcheck disable=SC2312
   readarray -t _mods < <(
     lspci -k \
       | grep -A2 -i ethernet \
@@ -239,7 +241,7 @@ grep_nic_driver_modules() {
     var_nic_modules="${_mods[*]}"
   fi
 
-  if [[ -n "$var_nic_module" ]]; then
+  if [[ -n "${var_nic_module}" ]]; then
     echo "${var_nic_module}"
   else
     echo "${var_nic_modules}"

func/system/4999_exiting_chroot_system.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Exiting chroot.
+# Globals:
+#   TARGET
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+exiting_chroot() {
+  umount -lf "${TARGET}/proc"
+  do_log "info" "true" "'umount -lf ${TARGET}/proc'."
+  umount -lf "${TARGET}/sys"
+  do_log "info" "true" "'umount -lf ${TARGET}/sys'."
+  umount -lf "${TARGET}/dev"
+  do_log "info" "true" "'umount -lf ${TARGET}/dev'."
+  umount -lf "${TARGET}/run"
+  do_log "info" "true" "'umount -lf ${TARGET}/run'."
+
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/system/5000_hardening_files.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+###########################################################################################
+# Hardening files and directories.
+# Globals:
+#   None
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+###########################################################################################
+hardening_files() {
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh