V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_1250_yaml/1252_yaml_validator.sh

@@ -0,0 +1,190 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Extended dynamic network variable checks and declarations depending on preseed.yaml.
+# Globals:
+#   ARY_IPV4_NS
+#   ARY_IPV6_NS
+#   VAR_FINAL_FQDN
+#   VAR_FINAL_IPV4
+#   VAR_FINAL_IPV4_GW
+#   VAR_FINAL_IPV4_SUBNET
+#   VAR_FINAL_IPV6
+#   VAR_FINAL_NIC
+#   VAR_LINK_IPV6
+#   network_autoconfig_enable
+#   network_choose_interface_static
+#   network_hostname
+#   network_static_ipv4address
+#   network_static_ipv4gateway
+#   network_static_ipv4nameserver_0
+#   network_static_ipv4nameserver_1
+#   network_static_ipv4nameserver_2
+#   network_static_ipv4nameserver_3
+#   network_static_ipv4nameserver_fallback_0
+#   network_static_ipv4nameserver_fallback_1
+#   network_static_ipv4netmask
+#   network_static_ipv6address
+#   network_static_ipv6nameserver_0
+#   network_static_ipv6nameserver_1
+#   network_static_ipv6nameserver_2
+#   network_static_ipv6nameserver_3
+#   network_static_ipv6nameserver_fallback_0
+#   network_static_ipv6nameserver_fallback_1
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+yaml_validator() {
+  ### Declare Arrays, HashMaps, and Variables.
+  # shellcheck disable=SC2034
+  declare -ag ARY_IPV4_NS=() ARY_IPV6_NS=()
+  declare     var_auto_nic="" var_auto_ipv4="" var_auto_ipv4_ccidr="" var_auto_ipv4_subnet="" var_auto_ipv4_gw="" \
+              var_auto_ipv6="" var_auto_ipv6_ccidr="" var_auto_ipv6_gw="" var_link_ipv4="" var_link_ipv6="" var_auto_fqdn=""
+  declare -gx VAR_FINAL_NIC="" VAR_FINAL_FQDN="" VAR_FINAL_IPV4="" VAR_FINAL_IPV4_GW="" VAR_FINAL_IPV4_SUBNET="" \
+              VAR_FINAL_IPV6="" VAR_LINK_IPV6=""
+
+  ARY_IPV4_NS+=("${network_static_ipv4nameserver_0}")
+  [[ -v network_static_ipv4nameserver_1 ]] && ARY_IPV4_NS+=( "${network_static_ipv4nameserver_1}" )
+  [[ -v network_static_ipv4nameserver_2 ]] && ARY_IPV4_NS+=( "${network_static_ipv4nameserver_2}" )
+  [[ -v network_static_ipv4nameserver_3 ]] && ARY_IPV4_NS+=( "${network_static_ipv4nameserver_3}" )
+  [[ -v network_static_ipv4nameserver_fallback_0 ]] && ARY_IPV4_NS+=( "${network_static_ipv4nameserver_fallback_0}" )
+  [[ -v network_static_ipv4nameserver_fallback_1 ]] && ARY_IPV4_NS+=( "${network_static_ipv4nameserver_fallback_1}" )
+
+  ARY_IPV6_NS+=("${network_static_ipv6nameserver_0}")
+  [[ -v network_static_ipv6nameserver_1 ]] && ARY_IPV6_NS+=( "${network_static_ipv6nameserver_1}" )
+  [[ -v network_static_ipv6nameserver_2 ]] && ARY_IPV6_NS+=( "${network_static_ipv6nameserver_2}" )
+  [[ -v network_static_ipv6nameserver_3 ]] && ARY_IPV6_NS+=( "${network_static_ipv6nameserver_3}" )
+  [[ -v network_static_ipv6nameserver_fallback_0 ]] && ARY_IPV6_NS+=( "${network_static_ipv6nameserver_fallback_0}" )
+  [[ -v network_static_ipv6nameserver_fallback_1 ]] && ARY_IPV6_NS+=( "${network_static_ipv6nameserver_fallback_1}" )
+
+  ### Check current network connection and configure variables
+  # shellcheck disable=SC2312
+  var_auto_nic=$(ip -o link show | awk -F': ' '/state UP/ && $2!="lo" {print $2; exit}')
+
+  # shellcheck disable=SC2312
+  var_auto_ipv4_ccidr=$(ip -4 -o addr show "${var_auto_nic}" | awk '{print $4; exit}')
+
+  # shellcheck disable=SC2312
+  var_auto_ipv4_subnet=$(generate_subnetmask "${var_auto_ipv4_ccidr}")
+
+  # shellcheck disable=SC2312
+  var_auto_ipv4=$(echo "${var_auto_ipv4_ccidr}" | awk -F'/' '{print $1}')
+
+  # shellcheck disable=SC2312
+  var_auto_ipv4_gw=$(ip route show default dev "${var_auto_nic}" | awk '/^default/ {print $3; exit}')
+
+  # shellcheck disable=SC2312
+  var_auto_ipv6_ccidr=$(ip -6 -o addr show "${var_auto_nic}" | awk '/scope global/ {print $4; exit}')
+
+  if [[ -n "${var_auto_ipv6_ccidr}" ]]; then
+
+    # shellcheck disable=SC2312
+    var_auto_ipv6=$(echo "${var_auto_ipv6_ccidr}" | awk -F'/' '{print $1}')
+    # shellcheck disable=SC2312
+    var_auto_ipv6_gw=$(ip -6 route show default dev "${var_auto_nic}" | awk '/^default/ {print $3; exit}')
+
+  fi
+
+  # shellcheck disable=SC2312
+  var_link_ipv4=$(ping -q -c 1 -W 1 -4 debian.org > /dev/null 2>&1 && echo "true" || echo "false")
+
+  # shellcheck disable=SC2312
+  var_link_ipv6=$(ping -q -c 1 -W 1 -6 debian.org > /dev/null 2>&1 && echo "true" || echo "false")
+
+  if [[ -f "/var/lib/dhcp/dhclient.${var_auto_nic}.leases" ]]; then
+
+    # shellcheck disable=SC2312
+    var_auto_fqdn=$(grep -m1 'option host-name' "/var/lib/dhcp/dhclient.${var_auto_nic}.leases" | sed -E 's/.*"([^"]+)".*/\1/')
+
+  else
+
+    var_auto_fqdn=""
+
+  fi
+
+  do_log "info" "file_only" "1252() Live environment network check: Auto NIC          ='${var_auto_nic}'."
+  do_log "info" "file_only" "1252() Live environment network check: Auto IPv4         ='${var_auto_ipv4}'."
+  do_log "info" "file_only" "1252() Live environment network check: Auto IPv4 CCIDR   ='${var_auto_ipv4_ccidr}'."
+  do_log "info" "file_only" "1252() Live environment network check: Auto IPv4 Subnet  ='${var_auto_ipv4_subnet}'."
+  do_log "info" "file_only" "1252() Live environment network check: Auto IPv4 Gateway ='${var_auto_ipv4_gw}'."
+  do_log "info" "file_only" "1252() Live environment network check: Auto IPv6         ='${var_auto_ipv6}'."
+  do_log "info" "file_only" "1252() Live environment network check: Auto IPv6 CCIDR   ='${var_auto_ipv6_ccidr}'."
+  do_log "info" "file_only" "1252() Live environment network check: Auto IPv6 Gateway ='${var_auto_ipv6_gw}'."
+  do_log "info" "file_only" "1252() Live environment network check: Auto IPv4 Link    ='${var_link_ipv4}'."
+  do_log "info" "file_only" "1252() Live environment network check: Auto IPv6 Link    ='${var_link_ipv6}'."
+  do_log "info" "file_only" "1252() Live environment network check: Auto FQDN         ='${var_auto_fqdn}'."
+
+  ### Export hostname and IPv4 and IPv6 addresses for further processing according to dynamic results and preseed.yaml settings.
+  if [[ "${network_autoconfig_enable,,}" == "true" ]]; then
+
+    # shellcheck disable=SC2034
+    VAR_FINAL_NIC="${var_auto_nic}"
+    # shellcheck disable=SC2034
+    VAR_FINAL_FQDN="${var_auto_fqdn}"
+    # shellcheck disable=SC2034
+    VAR_FINAL_IPV4="${var_auto_ipv4}"
+    # shellcheck disable=SC2034
+    VAR_FINAL_IPV4_GW="${var_auto_ipv4_gw}"
+    # shellcheck disable=SC2034
+    VAR_FINAL_IPV4_SUBNET="${var_auto_ipv4_subnet}"
+
+    do_log "info" "file_only" "1252() Network IPv4 autoconfiguration: [${network_autoconfig_enable,,}]."
+
+  else
+
+    # shellcheck disable=SC2034
+    VAR_FINAL_NIC="${network_choose_interface_static}"
+    # shellcheck disable=SC2034
+    VAR_FINAL_FQDN="${network_hostname}"
+    # shellcheck disable=SC2034
+    VAR_FINAL_IPV4="${network_static_ipv4address}"
+    # shellcheck disable=SC2034
+    VAR_FINAL_IPV4_GW="${network_static_ipv4gateway}"
+    # shellcheck disable=SC2034
+    VAR_FINAL_IPV4_SUBNET="${network_static_ipv4netmask}"
+
+    do_log "info" "file_only" "1252() Network IPv4 autoconfiguration: [${network_autoconfig_enable,,}]."
+
+  fi
+
+  if [[ "${network_autoconfig_enable,,}" == "true" && "${var_link_ipv6,,}" == "true" ]]; then
+
+    # shellcheck disable=SC2034
+    VAR_FINAL_IPV6="${var_auto_ipv6}"
+    # shellcheck disable=SC2034
+    VAR_LINK_IPV6="${var_link_ipv6}"
+
+    do_log "info" "file_only" "1252() Network IPv6 autoconfiguration: [${network_autoconfig_enable,,}] and IPv6 Link: [${var_link_ipv6,,}]."
+
+  elif [[ "${network_autoconfig_enable,,}" == "false" && -n "${network_static_ipv6address}" ]]; then
+
+    # shellcheck disable=SC2034
+    VAR_FINAL_IPV6="${network_static_ipv6address}"
+
+    do_log "info" "file_only" "1252() Network IPv6 autoconfiguration: [${network_autoconfig_enable,,}] and IPv6 static: [${network_static_ipv6address}]."
+
+  else
+
+    # shellcheck disable=SC2034
+    VAR_FINAL_IPV6=""
+    do_log "info" "file_only" "1252() Network IPv6 autoconfiguration: no IPv6 configuration applied."
+
+  fi
+
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4000_debootstrap/4000_debootstrap.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Install a minimal Debian environment using the 'debootstrap' command.
+# Globals:
+#   LOG_DBS
+#   TARGET
+#   architecture
+#   debootstrap_includes
+#   debootstrap_mirror
+#   distribution
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#   ERR_DEBOOTSTRAP
+#######################################
+func_debootstrap() {
+  ### Declare Arrays, HashMaps, and Variables.
+  declare -r var_arch="${architecture}"
+  declare -r var_dist="${distribution}"
+  declare -r var_target="${TARGET}"
+  declare -r var_mirror="${debootstrap_mirror}"
+  declare -r var_includes="${debootstrap_includes}"
+
+  declare -a ary_cmd=( "debootstrap" "--arch=${var_arch}" "${var_dist}" )
+
+  if [[ -n "${var_includes}" ]]; then ary_cmd+=( "--include=${var_includes}" ); fi
+
+  ary_cmd+=( "${var_target}" "${var_mirror}" )
+
+  do_log "debug" "file_only" "4000() Executing: [${ary_cmd[*]}]"
+
+  # shellcheck disable=SC2312
+  if "${ary_cmd[@]}" | tee "${LOG_DBS}"; then
+
+    do_log "info" "file_only" "4000() [${ary_cmd[*]}] successful."
+    install -d -m 0700 -o root -g root "${var_target}/root/.ciss/cdi/hooks"
+    return 0
+
+  else
+
+    do_log "emergency" "file_only" "4000() [${ary_cmd[*]}] failed."
+    return "${ERR_DEBOOTSTRAP}"
+
+  fi
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4000_debootstrap/4010_prepare_mounts.sh

@@ -13,7 +13,7 @@
 guard_sourcing
 
 #######################################
-# Configure target system for chroot.
+# Configure the target system for chroot.
 # Globals:
 #   ERR_CHRT_MOUNTS
 #   TARGET
@@ -65,19 +65,19 @@ configure_system() {
 
     if mountpoint -q "${TARGET}${var_path}"; then
 
-      do_log "info" "file_only" "4020() Skipped: '${TARGET}${var_path}' is already a mountpoint."
+      do_log "info" "file_only" "4010() Skipped: '${TARGET}${var_path}' is already a mountpoint."
       continue
 
     fi
 
     if ! mount -t "${var_fs}" "${var_src}" "${TARGET}${var_path}" -o "${var_opts}"; then
 
-      do_log "emergency" "file_only" "4020() Command: [mount -t ${var_fs} ${var_src} ${TARGET}${var_path} -o ${var_opts}] failed."
+      do_log "emergency" "file_only" "4010() Command: [mount -t ${var_fs} ${var_src} ${TARGET}${var_path} -o ${var_opts}] failed."
       return "${ERR_CHRT_MOUNTS}"
 
     fi
 
-    do_log "info" "file_only" "4020() Command: [mount -t ${var_fs} ${var_src} ${TARGET}${var_path} -o ${var_opts}] successful."
+    do_log "info" "file_only" "4010() Command: [mount -t ${var_fs} ${var_src} ${TARGET}${var_path} -o ${var_opts}] successful."
 
   done
 
@@ -87,27 +87,27 @@ configure_system() {
 
     if ! mount --make-rslave --rbind /run "${TARGET}/run"; then
 
-      do_log "emergency" "file_only" "4020() Command: [mount --make-rslave --rbind /run ${TARGET}/run] failed."
+      do_log "emergency" "file_only" "4010() Command: [mount --make-rslave --rbind /run ${TARGET}/run] failed."
       return "${ERR_CHRT_MOUNTS}"
 
     fi
 
-    do_log "info" "file_only" "4020() Command: [mount --make-rslave --rbind /run ${TARGET}/run] successful."
+    do_log "info" "file_only" "4010() Command: [mount --make-rslave --rbind /run ${TARGET}/run] successful."
 
   fi
 
   if ! do_in_target "${TARGET}" mkdir -p /etc/systemd/system/multi-user.target.wants; then
 
-    do_log "emergency" "file_only" "4020() Command: [do_in_target ${TARGET} mkdir -p /etc/systemd/system/multi-user.target.wants] failed."
+    do_log "emergency" "file_only" "4010() Command: [do_in_target ${TARGET} mkdir -p /etc/systemd/system/multi-user.target.wants] failed."
     return "${ERR_CHRT_MOUNTS}"
 
   fi
 
-  do_log "info" "file_only" "4020() Command: [do_in_target ${TARGET} mkdir -p /etc/systemd/system/multi-user.target.wants] successful."
+  do_log "info" "file_only" "4010() Command: [do_in_target ${TARGET} mkdir -p /etc/systemd/system/multi-user.target.wants] successful."
 
   # shellcheck disable=SC2034
   declare -gx VAR_CHROOT_ACTIVATED="system"
-  do_log "info" "file_only" "4020() Command: [declare -gx VAR_CHROOT_ACTIVATED=system]"
+  do_log "info" "file_only" "4010() Command: [declare -gx VAR_CHROOT_ACTIVATED=system]"
 
   return 0
 }

func/cdi_4000_debootstrap/4020_remove_expired_certificates.sh

@@ -13,25 +13,31 @@
 guard_sourcing
 
 #######################################
-# Install minimal Debian environment via 'debootstrap' command.
+# Chroot hook for deleting all expired X.509 certificates in the target system.
 # Globals:
 #   TARGET
-#   architecture
-#   distribution
+#   VAR_SETUP_PATH
 # Arguments:
 #   None
 # Returns:
-#   ERR_DEBOOTSTRAP
 #   0: on success
 #######################################
-func_debootstrap() {
-  # shellcheck disable=SC2312
-  if debootstrap --arch="${architecture}" "${distribution}" "${TARGET}" https://deb.debian.org/debian | tee "${LOG_DBS}"; then
-    do_log "info" "file_only" "4000() [debootstrap --arch=${architecture} ${distribution} '${TARGET}' https://deb.debian.org/debian] successful."
-    return 0
+expired_certs() {
+
+  install -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/chroot/hooks/1000_deleting_invalid_x509.sh" \
+    "${TARGET}/root/.ciss/cdi/hooks/1000_deleting_invalid_x509.sh"
+
+
+  if ! do_in_target_script "${TARGET}" "/root/.ciss/cdi/hooks/1000_deleting_invalid_x509.sh" "emergency"; then
+
+    do_log "warn" "file_only" "4020() Command: [do_in_target_script ${TARGET} /root/.ciss/cdi/hooks/1000_deleting_invalid_x509.sh emergency] failed."
+
   else
-    do_log "emergency" "file_only" "4000() [debootstrap --arch=${architecture} ${distribution} '${TARGET}' https://deb.debian.org/debian] failed."
-    return "${ERR_DEBOOTSTRAP}"
+
+    do_log "debug" "file_only" "4020() Command: [do_in_target_script ${TARGET} /root/.ciss/cdi/hooks/1000_deleting_invalid_x509.sh emergency] successful."
+
   fi
+
+  return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4000_debootstrap/4030_setup_hostname.sh

@@ -13,7 +13,7 @@
 guard_sourcing
 
 #######################################
-# Generate files: '/etc/hostname' | '/etc/hosts' | '/etc/mailname'
+# Configure the '/etc/hostname' | '/etc/hosts' | '/etc/mailname' files.
 # Globals:
 #   TARGET
 #   VAR_FINAL_FQDN
@@ -32,14 +32,16 @@ setup_hostname() {
 ${VAR_FINAL_FQDN}
 EOF
   chmod 0644 "${TARGET}/etc/hostname"
-  do_log "info" "file_only" "File generated: '${TARGET}/etc/hostname' | hostname '${VAR_FINAL_FQDN}'."
+  do_log "info" "file_only" "4030() File generated: '${TARGET}/etc/hostname' | hostname '${VAR_FINAL_FQDN}'."
+
 
   ### Create '${TARGET}/etc/mailname' file.
   cat << EOF >| "${TARGET}/etc/mailname"
 ${VAR_FINAL_FQDN}
 EOF
   chmod 0644 "${TARGET}/etc/mailname"
-  do_log "info" "file_only" "File generated: '${TARGET}/etc/mailname' | mailname '${VAR_FINAL_FQDN}'."
+  do_log "info" "file_only" "4030() File generated: '${TARGET}/etc/mailname' | mailname '${VAR_FINAL_FQDN}'."
+
 
   ### Generate '${TARGET}/etc/hosts' basic IPv4 entries
   cat << EOF >| "${TARGET}/etc/hosts"
@@ -48,7 +50,8 @@ ${VAR_FINAL_IPV4} ${VAR_FINAL_FQDN}
 
 EOF
   chmod 0644 "${TARGET}/etc/hosts"
-  do_log "info" "file_only" "File generated: '${TARGET}/etc/hosts' with basic IPv4 entries."
+  do_log "info" "file_only" "4030() File generated: '${TARGET}/etc/hosts' with basic IPv4 entries."
+
 
   ### Generate '${TARGET}/etc/hosts' basic IPv6 entries
   if [[ "${VAR_LINK_IPV6,,}" == "true" || "${network_ipv6,,}" == "true" ]]; then
@@ -65,7 +68,7 @@ ${VAR_FINAL_IPV6} ${VAR_FINAL_FQDN}
 
 EOF
 
-    do_log "info" "file_only" "File updated: '${TARGET}/etc/hosts' with basic IPv6 entries."
+    do_log "info" "file_only" "4030() File updated: '${TARGET}/etc/hosts' with basic IPv6 entries."
 
   fi
 

func/cdi_4000_debootstrap/4035_setup_resolv.sh

@@ -0,0 +1,105 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Configure the '/etc/resolv.conf' file.
+# Globals:
+#   ARY_IPV4_NS
+#   ARY_IPV6_NS
+#   DIR_BAK
+#   TARGET
+#   VAR_ARCHITECTURE
+#   VAR_CODENAME
+#   VAR_FINAL_IPV6
+#   VAR_LINK_IPV6
+#   VAR_VERSION
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+setup_resolv() {
+  ### Declare Arrays, HashMaps, and Variables.
+  declare     ns=""
+
+  if [[ -f "${TARGET}/etc/resolv.conf" ]]; then
+
+    mkdir -p "${DIR_BAK}/etc"
+    mv "${TARGET}/etc/resolv.conf" "${DIR_BAK}/etc/resolv.conf.bak"
+    do_log "info" "file_only" "4035() Existing '${TARGET}/etc/resolv.conf' moved."
+
+  fi
+
+  touch "${TARGET}/etc/resolv.conf"
+  chmod 0644 "${TARGET}/etc/resolv.conf"
+
+  ### Create '/etc/resolv.conf' IPv4 entries for static configuration.
+    cat << EOF >> "${TARGET}/etc/resolv.conf"
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+# /etc/resolv.conf      : Generated by CISS.debian.installer ${VAR_VERSION}
+# Architecture          : ${VAR_ARCHITECTURE}
+# Distribution          : ${VAR_CODENAME}
+
+# Static file system information '/etc/resolv.conf '.
+
+### Custom DNS IPv4 configuration
+EOF
+
+  for ns in "${ARY_IPV4_NS[@]}"; do
+
+    echo "nameserver ${ns}" >> "${TARGET}/etc/resolv.conf"
+    do_log "info" "file_only" "4035() IPv4 nameserver added: [${ns}]."
+
+  done
+
+  echo "" >> "${TARGET}/etc/resolv.conf"
+  do_log "info" "file_only" "4035() IPv4 nameserver at: '${TARGET}/etc/resolv.conf' configured."
+
+
+  ### Create '/etc/resolv.conf' IPv6 entries for static configuration.
+  if [[ "${VAR_LINK_IPV6,,}" == "true" || -n "${VAR_FINAL_IPV6}" ]]; then
+
+    cat << EOF >> "${TARGET}/etc/resolv.conf"
+### Custom DNS IPv6 configuration
+EOF
+
+    for ns in "${ARY_IPV6_NS[@]}"; do
+
+      echo "nameserver ${ns}" >> "${TARGET}/etc/resolv.conf"
+      do_log "info" "file_only" "4035() IPv6 nameserver added: [${ns}]."
+
+    done
+
+    echo "" >> "${TARGET}/etc/resolv.conf"
+    do_log "info" "file_only" "4035() IPv6 nameserver at: '${TARGET}/etc/resolv.conf' configured."
+
+  fi
+
+  cat << EOF >> "${TARGET}/etc/resolv.conf"
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
+EOF
+
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4000_debootstrap/4040_setup_timezone.sh

@@ -13,7 +13,7 @@
 guard_sourcing
 
 #######################################
-# Configure timezone.
+# Configure the '/etc/timezone' | '/etc/localtime' files.
 # Globals:
 #   TARGET
 #   ntp_timezone
@@ -23,9 +23,19 @@ guard_sourcing
 #   0: on success
 #######################################
 setup_timezone() {
+  ### Create '${TARGET}/etc/timezone' file.
+  cat << EOF >| "${TARGET}/etc/timezone"
+${ntp_timezone:-UTC}
+EOF
+  chmod 0644 "${TARGET}/etc/timezone"
+  do_log "info" "file_only" "4040() File generated: '${TARGET}/etc/timezone' | timezone '${ntp_timezone:-UTC}'."
+
   do_in_target "${TARGET}" ln -sf "/usr/share/zoneinfo/${ntp_timezone}" /etc/localtime
-  do_in_target_script "${TARGET}" "echo ${ntp_timezone} | tee /etc/timezone"
+
   do_in_target "${TARGET}" dpkg-reconfigure -f noninteractive tzdata
+
+  do_log "info" "file_only" "4040() Timezone updated successfully."
+
   return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4000_debootstrap/4050_setup_locales.sh

@@ -27,16 +27,14 @@ guard_sourcing
 #   0: on success
 #######################################
 setup_locales() {
-  do_in_target "${TARGET}" apt-get install -y locales
-  mkdir -p "${TARGET}/etc/default"
 
-  ### Give priority to '${locale_locale}' over separately configured variables '{$locale_country}' and '{$locale_language}'.
+  ### Give priority to '${locale_locale}' over separately configured variables '${locale_country}' and '${locale_language}'.
   ### If 'locale_locale' is not set, build it from 'locale_language' and 'locale_country'.
   if [[ -n "${locale_language:-}" && -n "${locale_country:-}" && -z "${locale_locale:-}" ]]; then
     declare locale_locale="${locale_language}_${locale_country}.UTF-8"
   fi
 
-  [[ -n "${locale_locale:-}" ]] || do_log "error" "file_only" "4110() Variable '${locale_locale}' is not set."
+  [[ -n "${locale_locale:-}" ]] || do_log "error" "file_only" "4050() Variable '${locale_locale}' is not set."
 
   ### Generate the specified locale
   do_in_target "${TARGET}" locale-gen "${locale_locale}"

func/system/4095_setup_skel.sh

@@ -25,11 +25,11 @@ guard_sourcing
 setup_skel() {
   mkdir -p "${TARGET}/etc/skel/.ciss"
 
-  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/skel/.bashrc" "${TARGET}/etc/skel/.bashrc"
-  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/skel/.zshrc" "${TARGET}/etc/skel/.zshrc"
-  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/root/.ciss/alias" "${TARGET}/etc/skel/.ciss/alias"
-  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/root/.ciss/clean_logout.sh" "${TARGET}/etc/skel/.ciss/clean_logout.sh"
-  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/root/.ciss/shortcuts" "${TARGET}/etc/skel/.ciss/shortcuts"
+  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.bashrc" "${TARGET}/etc/skel/.bashrc"
+  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.zshrc" "${TARGET}/etc/skel/.zshrc"
+  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/alias" "${TARGET}/etc/skel/.ciss/alias"
+  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/clean_logout.sh" "${TARGET}/etc/skel/.ciss/clean_logout.sh"
+  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/shortcuts" "${TARGET}/etc/skel/.ciss/shortcuts"
 
   ### In order to be able to copy/paste from vim, one needs to create a '.vimrc' in every home directory with the following content:
   echo 'set clipboard=unnamed' >| "${TARGET}/etc/skel/.vimrc"

func/system/4130_setup_network.sh

@@ -57,59 +57,6 @@ setup_network() {
     var_auto_ipv6_ccidr="" var_auto_ipv6="" var_auto_ipv6_gw="" var_link_ipv4="" var_link_ipv6="" var_auto_fqdn="" ns=""
   declare -a ary_ipv4_ns=() ary_ipv6_ns=()
 
-  ary_ipv4_ns+=("${network_static_ipv4nameserver_0}")
-  [[ -v network_static_ipv4nameserver_1 ]] && ary_ipv4_ns+=("${network_static_ipv4nameserver_1}")
-  [[ -v network_static_ipv4nameserver_2 ]] && ary_ipv4_ns+=("${network_static_ipv4nameserver_2}")
-  [[ -v network_static_ipv4nameserver_fallback_0 ]] && ary_ipv4_ns+=("${network_static_ipv4nameserver_fallback_0}")
-  [[ -v network_static_ipv4nameserver_fallback_1 ]] && ary_ipv4_ns+=("${network_static_ipv4nameserver_fallback_1}")
-
-  ary_ipv6_ns+=("${network_static_ipv6nameserver_0}")
-  [[ -v network_static_ipv6nameserver_1 ]] && ary_ipv6_ns+=("${network_static_ipv6nameserver_1}")
-  [[ -v network_static_ipv6nameserver_2 ]] && ary_ipv6_ns+=("${network_static_ipv6nameserver_2}")
-  [[ -v network_static_ipv6nameserver_fallback_0 ]] && ary_ipv6_ns+=("${network_static_ipv6nameserver_fallback_0}")
-  [[ -v network_static_ipv6nameserver_fallback_1 ]] && ary_ipv6_ns+=("${network_static_ipv6nameserver_fallback_1}")
-
-  ### Check current network connection and configure variables
-  # shellcheck disable=SC2312
-  var_auto_nic=$(ip -o link show | awk -F': ' '/state UP/ && $2!="lo" {print $2; exit}')
-  # shellcheck disable=SC2312
-  var_auto_ipv4_ccidr=$(ip -4 -o addr show "${var_auto_nic}" | awk '{print $4; exit}')
-  # shellcheck disable=SC2312
-  var_auto_ipv4_subnet=$(generate_subnetmask "${var_auto_ipv4_ccidr}")
-  # shellcheck disable=SC2312
-  var_auto_ipv4=$(echo "${var_auto_ipv4_ccidr}" | awk -F'/' '{print $1}')
-  # shellcheck disable=SC2312
-  var_auto_ipv4_gw=$(ip route show default dev "${var_auto_nic}" | awk '/^default/ {print $3; exit}')
-  # shellcheck disable=SC2312
-  var_auto_ipv6_ccidr=$(ip -6 -o addr show "${var_auto_nic}" | awk '/scope global/ {print $4; exit}')
-  if [[ -n "${var_auto_ipv6_ccidr}" ]]; then
-    # shellcheck disable=SC2312
-    var_auto_ipv6=$(echo "${var_auto_ipv6_ccidr}" | awk -F'/' '{print $1}')
-    # shellcheck disable=SC2312
-    var_auto_ipv6_gw=$(ip -6 route show default dev "${var_auto_nic}" | awk '/^default/ {print $3; exit}')
-  fi
-  # shellcheck disable=SC2312
-  var_link_ipv4=$(ping -q -c 1 -W 1 -4 debian.org > /dev/null 2>&1 && echo "true" || echo "false")
-  # shellcheck disable=SC2312
-  var_link_ipv6=$(ping -q -c 1 -W 1 -6 debian.org > /dev/null 2>&1 && echo "true" || echo "false")
-  if [[ -f "/var/lib/dhcp/dhclient.${var_auto_nic}.leases" ]]; then
-    # shellcheck disable=SC2312
-    var_auto_fqdn=$(grep -m1 'option host-name' "/var/lib/dhcp/dhclient.${var_auto_nic}.leases" | sed -E 's/.*"([^"]+)".*/\1/')
-  else
-    var_auto_fqdn=""
-  fi
-
-  do_log "info" "file_only" "4130() Live environment network check: Auto NIC          ='${var_auto_nic}'."
-  do_log "info" "file_only" "4130() Live environment network check: Auto IPv4         ='${var_auto_ipv4}'."
-  do_log "info" "file_only" "4130() Live environment network check: Auto IPv4 CCIDR   ='${var_auto_ipv4_ccidr}'."
-  do_log "info" "file_only" "4130() Live environment network check: Auto IPv4 Subnet  ='${var_auto_ipv4_subnet}'."
-  do_log "info" "file_only" "4130() Live environment network check: Auto IPv4 Gateway ='${var_auto_ipv4_gw}'."
-  do_log "info" "file_only" "4130() Live environment network check: Auto IPv6         ='${var_auto_ipv6}'."
-  do_log "info" "file_only" "4130() Live environment network check: Auto IPv6 CCIDR   ='${var_auto_ipv6_ccidr}'."
-  do_log "info" "file_only" "4130() Live environment network check: Auto IPv6 Gateway ='${var_auto_ipv6_gw}'."
-  do_log "info" "file_only" "4130() Live environment network check: Auto IPv4 Link    ='${var_link_ipv4}'."
-  do_log "info" "file_only" "4130() Live environment network check: Auto IPv6 Link    ='${var_link_ipv6}'."
-  do_log "info" "file_only" "4130() Live environment network check: Auto FQDN         ='${var_auto_fqdn}'."
 
   ### Create network configuration file header.
   if [[ -f "${TARGET}/etc/network/interfaces" ]]; then
@@ -284,61 +231,6 @@ EOF
 
   fi
 
-  if [[ -f "${TARGET}/etc/resolv.conf" ]]; then
-    mkdir -p "${DIR_BAK}/etc"
-    mv "${TARGET}/etc/resolv.conf" "${DIR_BAK}/etc/resolv.conf.bak"
-    do_log "info" "file_only" "4130() Existing '${TARGET}/etc/resolv.conf' moved."
-  fi
-
-  touch "${TARGET}/etc/resolv.conf"
-  chmod 0644 "${TARGET}/etc/resolv.conf"
-
-  ### Create '/etc/resolv.conf' IPv4 entries for static configuration.
-  if [[ "${network_autoconfig_enable,,}" == "false" ]]; then
-    cat << EOF >> "${TARGET}/etc/resolv.conf"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Custom DNS IPv4 configuration
-EOF
-
-    for ns in "${ary_ipv4_ns[@]}"; do
-      echo "nameserver ${ns}" >> "${TARGET}/etc/resolv.conf"
-    done
-
-    echo "" >> "${TARGET}/etc/resolv.conf"
-    do_log "info" "file_only" "4130() IPv4 nameserver at: '${TARGET}/etc/resolv.conf' configured manually."
-
-  fi
-
-  ### Create '/etc/resolv.conf' IPv6 entries for static configuration.
-  if [[ "${network_autoconfig_enable,,}" == "false" && -n "${network_static_ipv6address}" ]]; then
-
-    cat << EOF >> "${TARGET}/etc/resolv.conf"
-# Custom DNS IPv6 configuration
-EOF
-
-    for ns in "${ary_ipv6_ns[@]}"; do
-      echo "nameserver ${ns}" >> "${TARGET}/etc/resolv.conf"
-    done
-
-    echo "" >> "${TARGET}/etc/resolv.conf"
-    do_log "info" "file_only" "4130() IPv6 nameserver at: '${TARGET}/etc/resolv.conf' configured manually."
-
-  fi
-
-  cat << EOF >> "${TARGET}/etc/resolv.conf"
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
-EOF
-
   ### Ensure Internet Systems Consortium DHCP Client is not overwriting the static nameserver settings.
   if [[ -f "${TARGET}/etc/dhcp/dhclient.conf" ]]; then
     mkdir -p "${DIR_BAK}/etc/dhcp"
@@ -378,39 +270,6 @@ EOF
 EOF
   fi
 
-  ### Export hostname and IPv4 and IPv6 addresses for further processing according to dynamic results and preseed.yaml settings.
-  if [[ "${network_autoconfig_enable,,}" == "true" ]]; then
-
-    declare -grx VAR_FINAL_NIC="${var_auto_nic}"
-    declare -grx VAR_FINAL_FQDN="${var_auto_fqdn}"
-    declare -grx VAR_FINAL_IPV4="${var_auto_ipv4}"
-    declare -grx VAR_FINAL_IPV4_GW="${var_auto_ipv4_gw}"
-    declare -grx VAR_FINAL_IPV4_SUBNET="${var_auto_ipv4_subnet}"
-
-  else
-
-    declare -grx VAR_FINAL_NIC="${network_choose_interface_static}"
-    declare -grx VAR_FINAL_FQDN="${network_hostname}"
-    declare -grx VAR_FINAL_IPV4="${network_static_ipv4address}"
-    declare -grx VAR_FINAL_IPV4_GW="${network_static_ipv4gateway}"
-    declare -grx VAR_FINAL_IPV4_SUBNET="${network_static_ipv4netmask}"
-
-  fi
-
-  if [[ "${network_autoconfig_enable,,}" == "true" && "${var_link_ipv6,,}" == "true" ]]; then
-
-    declare -grx VAR_FINAL_IPV6="${var_auto_ipv6}"
-    declare -grx VAR_LINK_IPV6="${var_link_ipv6}"
-
-  elif [[ "${network_autoconfig_enable,,}" == "false" && -n "${network_static_ipv6address}" ]]; then
-
-    declare -grx VAR_FINAL_IPV6="${network_static_ipv6address}"
-
-  else
-
-    declare -grx VAR_FINAL_IPV6=""
-
-  fi
 
   return 0
 }