V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/system/4000_debootstrap.sh

@@ -27,10 +27,10 @@ guard_sourcing
 func_debootstrap() {
   # shellcheck disable=SC2312
   if debootstrap --arch="${architecture}" "${distribution}" "${TARGET}" https://deb.debian.org/debian | tee "${LOG_DBS}"; then
-    do_log "info" "file_only" "Executing 'debootstrap --arch=${architecture} ${distribution} '${TARGET}' https://deb.debian.org/debian' successful."
+    do_log "info" "file_only" "4000() Command: [debootstrap --arch=${architecture} ${distribution} '${TARGET}' https://deb.debian.org/debian] successful."
     return 0
   else
-    do_log "emergency" "file_only" "Executing 'debootstrap --arch=${architecture} ${distribution} '${TARGET}' https://deb.debian.org/debian' NOT successful."
+    do_log "emergency" "file_only" "4000() Command: [debootstrap --arch=${architecture} ${distribution} '${TARGET}' https://deb.debian.org/debian] failed."
     return "${ERR_DEBOOTSTRAP}"
   fi
 }

func/system/4020_configure_system.sh

@@ -40,11 +40,11 @@ configure_system() {
     mkdir -p "${var_dst}"
 
     if ! mount --make-rslave --rbind "/${var_src}" "${var_dst}"; then
-      do_log "emergency" "file_only" "Failed: 'mount --make-rslave --rbind /${var_src} ${var_dst}'."
+      do_log "emergency" "file_only" "4020() Command: [mount --make-rslave --rbind /${var_src} ${var_dst}] failed."
       return "${ERR_CHRT_MOUNTS}"
     fi
 
-    do_log "info" "file_only" "Success: 'mount --make-rslave --rbind /${var_src} ${var_dst}'."
+    do_log "info" "file_only" "4020() Command: [mount --make-rslave --rbind /${var_src} ${var_dst}] successful."
 
   done
 
@@ -52,7 +52,10 @@ configure_system() {
     return "${ERR_CHRT_MOUNTS}"
   fi
 
-  do_log "info" "file_only" "Command: 'mkdir -p /etc/systemd/system/multi-user.target.wants' executed in: '${TARGET}'."
+  do_log "info" "file_only" "4020() Command: [mkdir -p /etc/systemd/system/multi-user.target.wants] successful in: '${TARGET}'."
+
+  declare -gx VAR_CHROOT_ACTIVATED="system"
+
   return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/system/4040_generate_fstab.sh

@@ -28,7 +28,7 @@ guard_sourcing
 write_fstab() {
   declare _uuid="$1" _path="$2" _fs="$3" _opts="$4" _pass="$5"
   printf "UUID=%s %s %s %s 0 %s\n" "${_uuid}" "${_path}" "${_fs}" "${_opts}" "${_pass}" >> "${TARGET}/etc/fstab"
-  do_log "info" "file_only" "fstab entry generated: 'UUID=${_uuid}    ${_path}    ${_fs}    ${_opts}    0 ${_pass}'."
+  do_log "info" "file_only" "4040() fstab entry generated: [UUID=${_uuid}    ${_path}    ${_fs}    ${_opts}    0 ${_pass}]."
   return 0
 }
 
@@ -52,18 +52,30 @@ generate_fstab() {
   chmod 0600 "${TARGET}/etc/fstab"
 
   cat << 'EOF' >> "${TARGET}/etc/fstab"
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
 # /etc/fstab: static file system information.
 #
-# Use 'blkid' to print the universally unique identifier for a
-# device; this may be used with UUID= as a more robust way to name devices
-# that works even if disks are added and removed. See fstab(5).
+# Use 'blkid' to print the universally unique identifier for a device; this may be used with [UUID=] as a more robust way to
+# name devices that work even if disks are added and removed. See fstab(5).
 #
-# systemd generates mount units based on this file, see systemd.mount(5).
-# Please run 'systemctl daemon-reload' after making changes here.
+# 'systemd' generates mount units based on this file. See systemd.mount(5). Please run 'systemctl daemon-reload' after making
+# changes here.
 #
 # <file system>                            <mount point>  <type>       <options>                                  <dump>  <pass>
 
-# Secure tmpfs mounts for a hardened system
+
+### Secure tmpfs mounts for a hardened system
+
 # Mount the proc filesystem to provide process and kernel information
 proc                                       /proc          proc         nodev,nosuid,noexec,hidepid=2                         0 0
 # Mount sysfs to expose kernel device information to user space

func/system/4060_generate_crypttab.sh

@@ -27,7 +27,7 @@ guard_sourcing
 write_crypttab() {
   declare _label="$1" _device="$2" _key_file="$3" _opts="$4"
   printf "%s %s %s %s\n" "${_label}" "${_device}" "${_key_file}" "${_opts}" >> "${TARGET}/etc/crypttab"
-  do_log "info" "file_only" "crypttab entry generated: '${_label} ${_device} ${_key_file} ${_opts}'."
+  do_log "info" "file_only" "4060() crypttab entry generated: [${_label} ${_device} ${_key_file} ${_opts}]."
   return 0
 }
 
@@ -55,17 +55,27 @@ generate_crypttab() {
   chmod 0600 "${TARGET}/etc/crypttab"
 
   cat << 'EOF' >> "${TARGET}/etc/crypttab"
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
 # /etc/crypttab: static file system information.
 #
-# Basic rule: 'discard' / 'nodiscard' are normally only set in '/etc/crypttab' when LUKS/dm-crypt is in use.
-# Options like 'discard=async' or similar are typically only set in '/etc/fstab' (at the file system level).
-# The crypttab determines whether the underlying encrypted device (LUKS/dm-crypt) passes TRIM commands to the
-# physical drive or not. The fstab determines whether and how the file system itself generates the discard
-# operations and sends them down through the LUKS layer.
+# Basic rule: 'discard' / 'nodiscard' are normally only set in '/etc/crypttab' when LUKS/dm-crypt is in use. Options like
+# 'discard=async' or similar are typically only set in '/etc/fstab' (at the file system level). The crypttab determines whether
+# the underlying encrypted device (LUKS/dm-crypt) passes TRIM commands to the physical drive or not. The '/etc/fstab' determines
+# whether and how the file system itself generates the discard operations and sends them down through the LUKS layer.
 #
-# RECOMMENDED: 'discard' enables the TRIM commands to be forwarded by the dm-crypt layer to the SSD/physical
-# device. If you do not specify discard in the crypttab, dm-crypt blocks TRIM by default. This would render a
-# discard in the fstab ineffective.
+# RECOMMENDED: 'discard' enables the TRIM commands to be forwarded by the dm-crypt layer to the SSD/physical device. If ones do
+# not specify discard in the '/etc/crypttab', dm-crypt blocks TRIM by default. This would render a discard in the '/etc/fstab'
+# ineffective.
 #
 # <name>                                   <device>       <password-file-or-none>        <options>
 

func/system/4999_exiting_chroot_system.sh

@@ -21,7 +21,7 @@ guard_sourcing
 # Returns:
 #   0: on success
 #######################################
-exiting_chroot() {
+exiting_chroot_system() {
   umount -lf "${TARGET}/proc"
   do_log "info" "file_only" "'umount -lf ${TARGET}/proc'."
   umount -lf "${TARGET}/sys"