V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

.preseed/preseed.yaml

@@ -401,10 +401,8 @@ grub:
   bootdev: "/dev/sda"          # Due notably to potential USB sticks, the location of the primary drive cannot be determined
                                # safely in general, so this needs to be specified.
   force_efi: false             # Force GRUB installation to the EFI removable media path?
-                               # It seems that this computer is configured to boot via EFI, but maybe that configuration will
+                               # Some EFI firmware implementations do not meet the EFI specification (i.e., they are buggy)
-                               # not work for booting from the hard drive. Some EFI firmware implementations do not meet the
+                               # and do not support proper configuration of boot options from system hard drives.
-                               # EFI specification (i.e., they are buggy) and do not support proper configuration of boot
-                               # options from system hard drives.
                                #
                                # A workaround for this problem is to install an extra copy of the EFI version of the GRUB
                                # bootloader to a fallback location, the "removable media path". Almost all EFI systems, no
@@ -422,11 +420,11 @@ grub:
   prober: false                # OS-prober did not detect any other operating systems on your computer at this time, but you
                                # may still wish to enable it in case you install more in the future.
   skip: false                  # Skip installing grub.
-  update_nvram: true           # Update NVRAM variables to automatically boot into Debian?
+  update_nvram: false          # Update NVRAM variables to automatically boot into Debian?
                                # GRUB can configure your platform's NVRAM variables so that it boots into Debian automatically
                                # when powered on. However, you may prefer to disable this behavior and avoid changes to your
                                # boot configuration. For example, if your NVRAM variables have been set up such that your
-                               # system contacts a PXE server on every boot, this would preserve that behavior:
+                               # system contacts a PXE server on every boot, this would preserve that behavior.
 
 ################################################################################################################################
 # Locale settings set language, country, locale, keyboard map and timezone

func/system/4040_generate_fstab.sh

@@ -27,7 +27,7 @@ guard_sourcing
 #######################################
 write_fstab() {
   declare _uuid="$1" _path="$2" _fs="$3" _opts="$4" _pass="$5"
-  printf "UUID=%s %s %s %s 0 %s\n" "${_uuid}" "${_path}" "${_fs}" "${_opts}" "${_pass}" >> "${TARGET}/etc/fstab"
+  printf "%-43s%-28s%-8s%-74s0 %s\n" "UUID=${_uuid}" "${_path}" "${_fs}" "${_opts}" "${_pass}" >> "${TARGET}/etc/fstab"
   do_log "info" "file_only" "4040() fstab entry generated: [UUID=${_uuid}    ${_path}    ${_fs}    ${_opts}    0 ${_pass}]."
   return 0
 }

func/system/4150_setup_grub.sh

@@ -12,6 +12,17 @@
 
 guard_sourcing
 
+# --- UEFI GRUB Installation Strategy ---
+#
+# We explicitly install GRUB using '--no-nvram' to avoid modifying NVRAM entries inside the chroot environment, which is
+# unreliable and can break host firmware boot order. Instead of relying on '--removable', we manually copy the GRUB EFI binary
+# to the fallback location 'EFI/BOOT/BOOTX64.EFI'. This mirrors the behavior of '--removable', but gives us more control over
+# the bootloader ID and file paths.
+# Result:
+# - GRUB is available under 'EFI/debian/grubx64.efi' (for manual boot entries).
+# - GRUB is also available as 'EFI/BOOT/BOOTX64.EFI' (UEFI fallback path, no NVRAM needed).
+# This setup ensures compatibility with systems that do not retain NVRAM entries (e.g., removable drives, VM firmware).
+
 #######################################
 # Installation and setup of the GRUB2 (backported) version.
 # The backported version MUST be installed for LUKS2 '/boot' encryption.
@@ -97,7 +108,7 @@ setup_grub() {
 
       if [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
 
-        do_in_target "${TARGET}" grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=Debian --modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 part_gpt" --force-extra-removable
+        do_in_target "${TARGET}" grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=Debian --no-nvram --modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 part_gpt" --force-extra-removable
         var_update_grub_required="true"
 
       else
@@ -293,7 +304,7 @@ install_grub_uefi_all() {
   case "${VAR_RECIPE_TABLE,,}" in
     gpt)       partmod="part_gpt"   ;;
     msdos|mbr) partmod="part_msdos" ;;
-    *)         do_log "emergency" "file_only" "Unknown partition table type: '${VAR_RECIPE_TABLE}'."; return "${ERR_PARTITIONTBL}" ;;
+    *)         do_log "emergency" "file_only" "4150() Unknown partition table type: '${VAR_RECIPE_TABLE}'."; return "${ERR_PARTITIONTBL}" ;;
   esac
 
   declare var_modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 ${partmod}"