V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-06-28 09:23:59 +02:00
parent ab69573a3a
commit 5ebc9f9356
4 changed files with 629 additions and 20 deletions
--- a/.archive/func/0000_mount_partition.sh
+++ b/.archive/func/0000_mount_partition.sh
@@ -0,0 +1,183 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Function to generate btrfs-subvolumes.
+# Globals:
+#   ERR_BTRFS_SUBVOL
+#   TARGET
+# Arguments:
+#   $1: MOUNT_PATH
+#   $2: SUBVOLUME
+#######################################
+create_btrfs_subvolume() {
+  declare var_mount_path="$1"
+  declare var_subvolume="$2"
+
+  btrfs subvolume create "${TARGET}${var_mount_path}/${var_subvolume}" || {
+    do_log "error" "false" "Error occurred at creation of subvolume: '${var_subvolume}' in: '${TARGET}${var_mount_path}'."
+    exit "${ERR_BTRFS_SUBVOL}"
+  }
+  do_log "info" "false" "Created: '${var_subvolume}' at: '${TARGET}${var_mount_path}'."
+}
+
+#######################################
+# Function to create the mount path and mount the respective device on it.
+# Globals:
+#   ERR_MOUNTING_DEV
+#   TARGET
+# Arguments:
+#   $1: MOUNT_PATH
+#   $2: MOUNT_DEVICE
+#   $3: MOUNT_OPTIONS
+#######################################
+mount_with_dir() {
+  declare var_mount_path="$1"
+  declare var_mount_device="$2"
+  declare var_mount_options="$3"
+
+  if [[ "${var_mount_path}" == "/" ]]; then
+    var_mount_path=""
+  fi
+
+  mkdir -p "${TARGET}${var_mount_path}"
+
+  mount "${var_mount_options:+-o $var_mount_options}" "${var_mount_device}" "${TARGET}${var_mount_path}" || {
+    do_log "error" "false" "Error occurred at mounting '${var_mount_device}' on: '${TARGET}${var_mount_path}'."
+    exit "${ERR_MOUNTING_DEV}"
+  }
+  do_log "info" "false" "Mounted: '${var_mount_device}' on: '${TARGET}${var_mount_path}' incl. options: '${var_mount_options}'."
+}
+
+#######################################
+# Function for mounting all partitions for debootstrap, including the generation of btrfs subvolumes.
+# Globals:
+#   ERR_MOUNTING_ROOT
+#   HMP_MOUNTPATH_DEV
+#   TARGET
+#   VAR_RECIPE_STRING
+#   VAR_SETUP_PART
+#   var_fs_options
+# Arguments:
+#  None
+#######################################
+mount_partition() {
+  ### Mount "/"-filesystem
+  declare -r var_mount_path_root="/"
+
+  if [[ -n ${HMP_MOUNTPATH_DEV[$var_mount_path_root]} ]]; then
+
+    mount_with_dir "${var_mount_path_root}" "${HMP_MOUNTPATH_DEV[$var_mount_path_root]}"
+
+  else
+
+    do_log "error" "false" "Root-filesystem '${var_mount_path_root}' not found in Hashmap."
+    exit "${ERR_MOUNTING_ROOT}"
+
+  fi
+
+  ### Ensure order of "/boot" and "/boot/efi"
+  declare var_path
+
+  for var_path in "/boot" "/boot/efi"; do
+
+    if [[ -n ${HMP_MOUNTPATH_DEV[${var_path}]} ]]; then
+
+      mount_with_dir "${var_path}" "${HMP_MOUNTPATH_DEV[${var_path}]}"
+
+    else
+
+      do_log "info" "false" "Entry '${var_path}' not found in Hashmap."
+
+    fi
+
+  done
+
+  declare var_dev var_part var_fs_btrfs_compress var_fs_btrfs_level var_encryption_enable var_encryption_label \
+    var_fs_label var_fs_version var_mount_path var_mount_options var_mount_subvolume
+
+  ### Iterate over all devices in the recipe.
+  for var_dev in $(yq e ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}"); do
+
+    ### Iterate over all partitions for this device.
+    for var_part in $(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}"); do
+
+    ### Extract parameters from YAML.
+    var_fs_btrfs_compress=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
+    var_fs_btrfs_level=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level"       "${VAR_SETUP_PART}")
+    var_encryption_enable=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable"         "${VAR_SETUP_PART}")
+    var_encryption_label=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label"           "${VAR_SETUP_PART}")
+    var_fs_label=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label"                   "${VAR_SETUP_PART}")
+    var_fs_version=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"               "${VAR_SETUP_PART}")
+    var_mount_path=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"                       "${VAR_SETUP_PART}")
+    var_mount_options=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options"                 "${VAR_SETUP_PART}")
+    var_mount_subvolume=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.subvolume"             "${VAR_SETUP_PART}")
+
+    ### Skip already mounted paths ("/", "/boot", "/boot/efi") and skip ("/recovery")
+    if [[ "${var_mount_path}" == "/" || "${var_mount_path}" == "/boot" || "${var_mount_path}" == "/boot/efi" || "${var_mount_path}" == "/recovery" ]]; then
+      continue
+    fi
+
+    if [[ "${var_mount_path}" == "SWAP" ]]; then
+
+      cryptsetup open --type plain --key-file /dev/random \
+        --offset 2048 --cipher aes-xts-plain64 --key-size 512 \
+        --sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
+      mkswap "/dev/mapper/${var_encryption_label}"
+      swapon "/dev/mapper/${var_encryption_label}"
+      do_log "info" "false" "Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
+
+    elif [[ "${var_mount_path}" == "/tmp" ]]; then
+
+      cryptsetup open --type plain --key-file /dev/random \
+        --offset 2048 --cipher aes-xts-plain64 --key-size 512 \
+        --sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
+      mkdir -p "${TARGET}/tmp"
+      mkfs.ext4 "/dev/mapper/${var_encryption_label}" "${var_fs_options:+ $var_fs_options}"
+      mount "${var_mount_options:+-o $var_mount_options}" "/dev/mapper/${var_encryption_label}" "${TARGET}/tmp"
+      do_log "info" "false" "Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
+
+    fi
+
+    if [[ "${var_fs_version,,}" == "btrfs"  && "${var_encryption_enable}" == "true" ]]; then
+
+      declare var_btrfs_compression_options="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
+      mount_with_dir "${var_mount_path}" "/dev/mapper/${var_encryption_label}" "${var_btrfs_compression_options}"
+      [[ -n ${var_mount_subvolume} ]] && create_btrfs_subvolume "${var_mount_path}" "${var_mount_subvolume}"
+      do_log "info" "false" "Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
+
+    elif [[ "${var_fs_version,,}" == "btrfs"  && "${var_encryption_enable}" == "false" ]]; then
+
+      declare var_btrfs_compression_options="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
+      mount_with_dir "${var_mount_path}" "/dev/${var_dev}${var_part}" "${var_btrfs_compression_options}"
+      [[ -n ${var_mount_subvolume} ]] && create_btrfs_subvolume "${var_mount_path}" "${var_mount_subvolume}"
+      do_log "info" "false" "Mounted: '${var_mount_path}' on: '/dev/${var_dev}${var_part}'."
+
+    elif [[ "${var_fs_version,,}" == "ext4"  && "${var_encryption_enable}" == "true" ]]; then
+
+      mount_with_dir "${var_mount_path}" "/dev/mapper/${var_encryption_label}"
+      do_log "info" "false" "Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
+
+    elif [[ "${var_fs_version,,}" == "ext4"  && "${var_encryption_enable}" == "false" ]]; then
+
+      mount_with_dir "${var_mount_path}" "/dev/${var_dev}${var_part}"
+      do_log "info" "false" "Mounted: '${var_mount_path}' on: '/dev/${var_dev}${var_part}'."
+
+    fi
+
+    done
+
+  done
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
--- a/.preseed/partitioning.yaml
+++ b/.preseed/partitioning.yaml
@@ -68,6 +68,7 @@ recipe:
            # btrfs only
            btrfs:
              checksum: ""
+              # TODO Level 0 is valid for zstd not for lzo
              compress: ""
              level: ""
              dedup: true
--- a/func/3280_mount_partition.sh
+++ b/func/3280_mount_partition.sh
@@ -43,23 +43,55 @@ create_btrfs_subvolume() {
 #   $3: MOUNT_OPTIONS
 #######################################
 mount_with_dir() {
-  declare var_mount_path="$1"
-  declare var_mount_device="$2"
-  declare var_mount_options="$3"
+  declare var_mount_path="$1" var_mount_device="$2" var_mount_options="$3"

  if [[ "${var_mount_path}" == "/" ]]; then
-    var_mount_path=""
+    :
+  else
+    mkdir -p "${TARGET}${var_mount_path}"
  fi

-  mkdir -p "${TARGET}${var_mount_path}"
+  ### Build the command in an array to keep word boundaries intact
+  declare -a ary_cmd=(mount)
+  ary_cmd+=("${var_mount_device}" "${TARGET}${var_mount_path}")
+  [[ -n "${var_mount_options}" ]] && ary_cmd+=("-o" "${var_mount_options}")

-  mount "${var_mount_options:+-o $var_mount_options}" "${var_mount_device}" "${TARGET}${var_mount_path}" || {
-    do_log "error" "false" "Error occurred at mounting '${var_mount_device}' on: '${TARGET}${var_mount_path}'."
+  "${ary_cmd[@]}" || {
+    do_log "error" "false" "Mounting '${var_mount_device}' on '${TARGET}${var_mount_path}' failed."
    exit "${ERR_MOUNTING_DEV}"
    }
-  do_log "info" "false" "Mounted: '${var_mount_device}' on: '${TARGET}${var_mount_path}' incl. options: '${var_mount_options}'."
+
+  do_log "info" "false" "Mounted: '${var_mount_device}' on: '${TARGET}${var_mount_path}' (Options='${var_mount_options}')."
 }

+#######################################
+# Device Path Resolver
+# Arguments:
+#   $1: Device
+#   $2: Partition
+#   $3: Boolean Encryption
+#   $4: Encryption Label
+#######################################
+resolve_device() {
+  declare local_var_dev="$1" local_var_partition="$2" encryption_boolean="$3" local_var_enc_label="$4"
+  [[ "${encryption_boolean}" == true ]] && printf '/dev/mapper/%s' "${local_var_enc_label}" \
+                                        || printf '/dev/%s%s' "${local_var_dev}" "${local_var_partition}"
+}
+
+#######################################
+# YAML Parser Null String exception Handler.
+# Arguments:
+#   $1: Key String to evaluate
+#   $2: YAML File
+#######################################
+yq_val() {
+  # shellcheck disable=SC2155
+  declare var_helper=$(yq e "$1" "$2")
+  [[ "${var_helper}" == "null" ]] && var_helper=""
+  printf '%s' "${var_helper}"
+}
+
+
 #######################################
 # Function for mounting all partitions for debootstrap, including the generation of btrfs subvolumes.
 # Globals:
@@ -106,23 +138,26 @@ mount_partition() {

  declare var_dev var_part var_fs_btrfs_compress var_fs_btrfs_level var_encryption_enable var_encryption_label \
    var_fs_label var_fs_version var_mount_path var_mount_options var_mount_subvolume
+  declare -a ary_devs ary_parts

  ### Iterate over all devices in the recipe.
-  for var_dev in $(yq e ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}"); do
+  readarray -t ary_devs < <(yq e ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
+  for var_dev in "${ary_devs[@]}"; do

    ### Iterate over all partitions for this device.
-    for var_part in $(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}"); do
+    readarray -t ary_parts < <(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
+    for var_part in "${ary_parts[@]}"; do

    ### Extract parameters from YAML.
-    var_fs_btrfs_compress=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
-    var_fs_btrfs_level=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level"       "${VAR_SETUP_PART}")
-    var_encryption_enable=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable"         "${VAR_SETUP_PART}")
-    var_encryption_label=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label"           "${VAR_SETUP_PART}")
-    var_fs_label=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label"                   "${VAR_SETUP_PART}")
-    var_fs_version=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"               "${VAR_SETUP_PART}")
-    var_mount_path=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"                       "${VAR_SETUP_PART}")
-    var_mount_options=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options"                 "${VAR_SETUP_PART}")
-    var_mount_subvolume=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.subvolume"             "${VAR_SETUP_PART}")
+    var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
+    var_fs_btrfs_level=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level"       "${VAR_SETUP_PART}")
+    var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable"         "${VAR_SETUP_PART}")
+    var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label"           "${VAR_SETUP_PART}")
+    var_fs_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label"                   "${VAR_SETUP_PART}")
+    var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"               "${VAR_SETUP_PART}")
+    var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"                       "${VAR_SETUP_PART}")
+    var_mount_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options"                 "${VAR_SETUP_PART}")
+    var_mount_subvolume=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.subvolume"             "${VAR_SETUP_PART}")

    ### Skip already mounted paths ("/", "/boot", "/boot/efi") and skip ("/recovery")
    if [[ "${var_mount_path}" == "/" || "${var_mount_path}" == "/boot" || "${var_mount_path}" == "/boot/efi" || "${var_mount_path}" == "/recovery" ]]; then
@@ -150,6 +185,19 @@ mount_partition() {

    fi

+
+device=$(resolve_device "$var_dev" "$var_part" "$var_encryption_enable" "$var_encryption_label")
+mount_with_dir "$var_mount_path" "$device" "$var_btrfs_compression_options"
+
+    case "${var_fs_version,,}:${var_encryption_enable}" in
+      btrfs:true)  … ;;
+      btrfs:false) … ;;
+      ext4:true)   … ;;
+      ext4:false)  … ;;
+      *) do_log error false "Unsupported fs/encryption combination."
+         exit "$ERR_MOUNTING_DEV" ;;
+    esac
+
    if [[ "${var_fs_version,,}" == "btrfs"  && "${var_encryption_enable}" == "true" ]]; then

      declare var_btrfs_compression_options="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
--- a/func/9999_coresecret.sh
+++ b/func/9999_coresecret.sh
@@ -0,0 +1,377 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024–2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.hardened.installer framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+# coresecret.sh to be executed after dropbear SSH login
+
+set -C -e -u -o pipefail
+IFS=$(printf ' \n\t')
+
+# shellcheck disable=SC2155
+declare -gr CURRENTDATE=$(date +"%F %T")
+declare -gir MAX_RETRIES=2
+
+#######################################
+# Generates informative shell prompt.
+# Globals:
+#   PS1
+# Arguments:
+#   None
+#######################################
+prompt_string() {
+  declare -gx PS1="\
+\[\033[1;91m\]\d\[\033[0m\]|\[\033[1;91m\]\u\[\033[0m\]@\
+\[\033[1;95m\]\h\[\033[0m\]:\
+\[\033[1;96m\]\w\[\033[0m\]/>>\
+\$(if [[ \$? -eq 0 ]]; then \
+  # Show exit status in green if zero
+  echo -e \"\[\033[1;92m\]\$?\[\033[0m\]\"; \
+else \
+  # Show exit status in red otherwise
+  echo -e \"\[\033[1;91m\]\$?\[\033[0m\]\"; \
+fi)\
+|~\$ "
+}
+
+#######################################
+# Trap function to be called on 'ERR'.
+# Arguments:
+#   $1: ${?}
+#   $2: ${BASH_SOURCE[0]}
+#   $3: ${LINENO}
+#   $4: ${FUNCNAME[0]:-main}
+#   $5: ${BASH_COMMAND}
+#######################################
+trap_on_err() {
+  declare -r errcode="$1"
+  declare -r errscrt="$2"
+  declare -r errline="$3"
+  declare -r errfunc="$4"
+  declare -r errcmmd="$5"
+  trap - ERR
+  stty echo
+  if [[ ${errcode} -eq 0 ]]; then
+    print_scr_scc
+    prompt_string
+    exit 0
+  else
+    print_scr_err "${errcode}" "${errscrt}" "${errline}" "${errfunc}" "${errcmmd}"
+    sleep 15
+    sync
+    set +C
+    echo 1 > /proc/sys/kernel/sysrq
+    echo o > /proc/sysrq-trigger
+  fi
+}
+
+#######################################
+# Security Trap on 'INT' and 'TERM' to provide a deterministic way to not circumvent the Nuke Routine
+# Globals:
+#   DEVICES_LUKS
+#   DEVICES_NUKE
+# Arguments:
+#  None
+#######################################
+trap_on_term() {
+  trap - INT
+  stty echo
+  printf "\n"
+  printf "\e[0;91m✘ System caught a 'SIGINT'. System Power Off in 3 seconds. \e[0m\n" >&2
+  sync
+  sleep 3
+  set +C
+  echo 1 > /proc/sys/kernel/sysrq
+  echo o > /proc/sysrq-trigger
+}
+
+#######################################
+# Print Error Message for 'non-0' Trap on 'EXIT' on Terminal.
+# Arguments:
+#   $1: ${?}
+#   $2: ${BASH_SOURCE[0]}
+#   $3: ${LINENO}
+#   $4: ${FUNCNAME[0]:-main}
+#   $5: ${BASH_COMMAND}
+#######################################
+print_scr_err() {
+  declare -r scr_err_errcode="$1"
+  declare -r scr_err_errscrt="$2"
+  declare -r scr_err_errline="$3"
+  declare -r scr_err_errfunc="$4"
+  declare -r scr_err_errcmmd="$5"
+  printf "\n"
+  printf "\e[0;91m✘ System caught an 'ERROR'. System Power Off in 15 seconds. \e[0m\n" >&2
+  printf "\n"
+  printf "\e[0;91m✘ Error               : %s \e[0m\n" "${scr_err_errcode}" >&2
+  printf "\e[0;91m✘ Line                : %s \e[0m\n" "${scr_err_errline}" >&2
+  printf "\e[0;91m✘ Script              : %s \e[0m\n" "${scr_err_errscrt}" >&2
+  printf "\e[0;91m✘ Function            : %s \e[0m\n" "${scr_err_errfunc}" >&2
+  printf "\e[0;91m✘ Command             : %s \e[0m\n" "${scr_err_errcmmd}" >&2
+  printf "\n"
+}
+
+#######################################
+# Print Error Message for '0' Trap on 'ERR' on Terminal.
+# Arguments:
+#   none
+#######################################
+print_scr_scc() {
+  printf "\e[0;92m✅ Script exited successfully. Proceeding with booting. \e[0m\n"
+  printf "\n"
+}
+
+#######################################
+# Gather information of all LUKS Devices available on the system
+# Arguments:
+#  None
+#######################################
+gather_luks_devices() {
+  declare prev=() curr=() dev="" tries=0
+
+  while ((tries < 10)); do
+    mapfile -t curr < <(blkid -t TYPE=crypto_LUKS -o device)
+
+    if [[ ${curr[*]} == "${prev[*]}"   ]]; then
+      break
+    fi
+
+    prev=("${curr[@]}")
+    tries=$((tries + 1))
+    sleep 1
+  done
+
+  ### Print one device per line for mapfile compatibility
+  for dev in "${curr[@]}"; do
+    printf '%s\n' "${dev}"
+  done
+}
+
+#######################################
+# Gather information of all NUKE Devices available on the system
+# Globals:
+#   DEVICES_LUKS
+# Arguments:
+#  None
+#######################################
+gather_nuke_devices() {
+  ### 'DEVICES_LUKS' must already be a bash array of device paths
+  declare dev=""
+  declare result=()
+
+  for dev in "${DEVICES_LUKS[@]}"; do
+    ### Check slot 31 for 'luks2'
+    if cryptsetup luksDump "${dev}" 2> /dev/null | grep -qE '^[[:space:]]*31: luks2'; then
+      result+=("${dev}")
+    fi
+  done
+
+  ### Print one device per line for mapfile compatibility
+  for dev in "${result[@]}"; do
+    printf '%s\n' "${dev}"
+  done
+}
+
+#######################################
+# Read passphrase interactively.
+# Arguments:
+#  None
+#######################################
+passphrase_ask() {
+  declare -g PASSPHRASE=""
+  printf "\n"
+  stty -echo
+  printf "\e[0;95m🔐 Enter passphrase for decryption: \e[0m\n"
+  read -r PASSPHRASE
+  stty echo
+  printf "\n"
+}
+
+#######################################
+# Test the entered passphrase against the dedicated Nuke Keyslot #31.
+# Arguments:
+#   $1: DEVICE
+#   $2: PASSWD
+#######################################
+passphrase_test() {
+  declare -r DEVICE="$1"
+  declare -r PASPHR="$2"
+  printf '%s' "${PASPHR}" | cryptsetup open --batch-mode --test-passphrase --key-slot 31 "${DEVICE}" > /dev/null 2>&1
+}
+
+#######################################
+# Check the integrity and authenticity of this script itself.
+# Arguments:
+#   $0: Script Name
+#######################################
+verify_coresecret() {
+  ### Directory of this script
+  # shellcheck disable=SC2155
+  declare dir="$(dirname "$(readlink -f "${0}")")"
+  # shellcheck disable=SC2155
+  declare script="$(basename "${0}")"
+  declare algo
+
+  for algo in sha512 sha384; do
+    # shellcheck disable=SC2155
+    declare hashfile="${dir}/${script}.${algo}"
+    # shellcheck disable=SC2155
+    declare sigfile="${hashfile}.sig"
+    # shellcheck disable=SC2155
+    declare cmd="${algo}sum"
+
+    printf "\e[0;95m🔏 Verifying signature of: [%s] \e[0m\n" "${hashfile}"
+    gpgv --keyring /etc/keys/pubring.gpg "${sigfile}" "${hashfile}" || {
+      printf "\e[0;91m✘ Signature verification failed for: [%s] \e[0m\n" "${hashfile}" >&2
+      printf "\e[0;91m✘ System Power Off in 3 seconds. \e[0m\n" >&2
+      sync
+      sleep 3
+      set +C
+      echo 1 > /proc/sys/kernel/sysrq
+      echo o > /proc/sysrq-trigger
+    }
+    printf "\e[0;92m🔏 Verifying signature of: [%s] successful. \e[0m\n" "${hashfile}"
+
+    printf "\e[0;95m🔢 Recomputing Hash: [%s] \e[0m\n" "${algo}"
+    # shellcheck disable=SC2155
+    declare computed=$($cmd "${dir}/${script}" | awk '{print $1}')
+    # shellcheck disable=SC2155
+    declare expected=$(cat "${hashfile}")
+
+    if [[ ${computed} != "${expected}" ]]; then
+      printf "\e[0;91m✘ Hash mismatch for: [%s] \e[0m\n" "${algo}" >&2
+      printf "\e[0;91m✘ System Power Off in 3 seconds. \e[0m\n" >&2
+      sync
+      sleep 3
+      set +C
+      echo 1 > /proc/sys/kernel/sysrq
+      echo o > /proc/sysrq-trigger
+    fi
+    printf "\e[0;92m🔢 Recomputing Hash: [%s] successful. \e[0m\n" "${algo}"
+  done
+
+  printf "\e[0;92m🔏 All signatures and hashes verified successfully. Proceeding. \e[0m\n"
+}
+
+### Main Programm
+trap 'trap_on_err "$?" "${BASH_SOURCE[0]}" "${LINENO}" "${FUNCNAME[0]:-main}" "${BASH_COMMAND}"' ERR
+trap 'trap_on_term' INT TERM
+
+printf "\e[0;91mCoresecret Connection established.\e[0m\n"
+printf "\e[0;91mStarting Time: %s\e[0m\n" "${CURRENTDATE}"
+printf "\n"
+
+verify_coresecret
+
+### Read newline-separated output into an array
+mapfile -t DEVICES_LUKS < <(gather_luks_devices)
+mapfile -t DEVICES_NUKE < <(gather_nuke_devices)
+
+### Debug output: list each element with its index
+#for idx in "${!DEVICES_LUKS[@]}"; do
+#  printf 'Luks[%d]: %s\n' "${idx}" "${DEVICES_LUKS[${idx}]}"
+#done
+
+### Debug output: list each element with its index
+#for idx in "${!DEVICES_NUKE[@]}"; do
+#  printf 'Nuke[%d]: %s\n' "${idx}" "${DEVICES_NUKE[${idx}]}"
+#done
+
+### # If there are no LUKS devices at all, drop to bash
+[[ -n ${DEVICES_LUKS[*]} ]] || {
+  printf "\e[0;92m✘ No LUKS Devices found. Dropping to bash ... \e[0m\n"
+  prompt_string
+  exec /bin/bash -i
+}
+
+### If there are LUKS devices but no Nuke devices, try unlocking flow
+if [[ -n ${DEVICES_LUKS[*]} ]] && [[ -z ${DEVICES_NUKE[*]} ]]; then
+  ### Attempt interactive unlock with cryptroot-unlock
+  if cryptroot-unlock; then
+
+    exit 0
+
+  else
+
+    printf "\n"
+    printf "\e[0;91m✘ Unsuccessful command 'cryptroot-unlock'. \e[0m\n"
+    printf "\e[0;92m✘ No LUKS operations performed. Dropping to bash ... \e[0m\n"
+    printf "\e[0;92m✘ To unlock 'root' partition, and maybe others like 'swap', run 'cryptroot-unlock'. \e[0m\n"
+    prompt_string
+    exec /bin/bash -i
+
+  fi
+
+elif [[ -n ${DEVICES_LUKS[*]} ]] && [[ -n ${DEVICES_NUKE[*]} ]]; then
+
+  declare -i attempt=1
+  declare NUKED=false
+  declare TEST_DEV="${DEVICES_NUKE[0]}"
+
+  while ((attempt <= MAX_RETRIES)); do
+
+    printf "\e[0;95m🔐Attempt %s/%s: \e[0m\n" "${attempt}" "${MAX_RETRIES}"
+
+    passphrase_ask
+    declare -g PASSWD="${PASSPHRASE}"
+
+    if passphrase_test "${TEST_DEV}" "${PASSWD}"; then
+
+      for dev in "${DEVICES_NUKE[@]}"; do
+        cryptsetup erase --batch-mode "${dev}" > /dev/null 2>&1
+        printf "%s:\e[0;95m✘ LUKS Device Header malfunction. \e[0m\n" "${dev}"
+      done
+
+      declare -r NUKED=true
+      unset PASSWD
+      break
+
+    else
+
+      declare code="$?"
+
+      case "${code}" in
+        1) printf "\e[0;91m✘ No usable key slot is available. \e[0m\n" ;;
+        2) printf "\e[0;91m✘ No key available with this passphrase. \e[0m\n" ;;
+        3) printf "\e[0;93m✘ Out of memory. \e[0m\n" ;;
+        *) printf "\e[0;91m✘ Unexpected Return Code. \e[0m\n" ;;
+      esac
+
+    fi
+
+    attempt=$((attempt + 1))
+
+  done
+
+  if [[ ${NUKED} == true ]]; then
+    stty echo
+    sleep 3
+    sync
+    set +C
+    echo 1 > /proc/sys/kernel/sysrq
+    echo o > /proc/sysrq-trigger
+  fi
+
+  if cryptroot-unlock; then
+
+    exit 0
+
+  else
+
+    printf "\e[0;91m✘ Unsuccessful command 'cryptroot-unlock'. \e[0m\n"
+    printf "\e[0;92m✘ No LUKS operations performed. Dropping to bash ... \e[0m\n"
+    printf "\e[0;92m✘ To unlock 'root' partition, and maybe others like 'swap', run 'cryptroot-unlock'. \e[0m\n"
+    prompt_string
+    exec /bin/bash -i
+
+  fi
+
+fi
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh: