V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-08-28 17:40:06 +02:00
parent 44b3d1fb60
commit d43638d262
10 changed files with 159 additions and 189 deletions
--- a/func/cdi_4000_debootstrap/4000_debootstrap.sh
+++ b/func/cdi_4000_debootstrap/4000_debootstrap.sh
@@ -15,7 +15,6 @@ guard_sourcing
 #######################################
 # Install a minimal Debian environment using the 'debootstrap' command.
 # Globals:
-#   ERR_DEBOOTSTRAP
 #   LOG_DBS
 #   TARGET
 #   VAR_ARCHITECTURE
@@ -37,7 +36,7 @@ func_debootstrap() {
  declare -r var_includes="${debootstrap_includes}"
  declare -a ary_cmd=()

-  ary_cmd+=( "debootstrap" "--arch=${var_arch}" "--merged-usr" )
+  ary_cmd+=( "debootstrap" "--arch=${var_arch}" "--log-extra-deps" "--merged-usr" )

  if [[ -n "${var_includes}" ]]; then ary_cmd+=( "--include=${var_includes}" ); fi

--- a/func/cdi_4000_debootstrap/4005_check_usr_merge.sh
+++ b/func/cdi_4000_debootstrap/4005_check_usr_merge.sh
@@ -30,16 +30,16 @@ check_usr_merge() {

  # shellcheck disable=SC2312
  chroot_script "${TARGET}" "
-    test -L /bin  && test $(readlink -f /bin)  = '/usr/bin'  || echo 'UNMERGED:/bin'  | tee -a ${var_logfile}
-    test -L /sbin && test $(readlink -f /sbin) = '/usr/sbin' || echo 'UNMERGED:/sbin' | tee -a ${var_logfile}
-    test -L /lib  && test $(readlink -f /lib)  = '/usr/lib'  || echo 'UNMERGED:/lib'  | tee -a ${var_logfile}
+    test -L /bin  && test $(readlink -f /bin)  = '/usr/bin'  && echo 'MERGED:/bin'  || echo 'UNMERGED:/bin'  | tee -a ${var_logfile}
+    test -L /sbin && test $(readlink -f /sbin) = '/usr/sbin' && echo 'MERGED:/sbin' || echo 'UNMERGED:/sbin' | tee -a ${var_logfile}
+    test -L /lib  && test $(readlink -f /lib)  = '/usr/lib'  && echo 'MERGED:/lib'  || echo 'UNMERGED:/lib'  | tee -a ${var_logfile}
    echo ExitCode: \$? >> ${var_logfile}
  "

  if [[ "${architecture}" == "amd64" ]]; then
    # shellcheck disable=SC2312
    chroot_script "${TARGET}" "
-      test -L /lib64 && test $(readlink -f /lib64) = '/usr/lib64' || echo 'UNMERGED:/lib64' | tee -a ${var_logfile}
+      test -L /lib64 && test $(readlink -f /lib64) = '/usr/lib64' && echo 'MERGED:/lib64' || echo 'UNMERGED:/lib64' | tee -a ${var_logfile}
      echo ExitCode: \$? >> ${var_logfile}
    "
  fi
--- a/func/cdi_4100_base/4121_installation_initramfs.sh
+++ b/func/cdi_4100_base/4121_installation_initramfs.sh
@@ -30,6 +30,10 @@ installation_initramfs() {
  ### Declare Arrays, HashMaps, and Variables.
  declare     var_modules=""

+  ### Install the script to be called by 'update-initramfs' to enforce merged-/usr symlinks inside the initramfs image.
+  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/hooks/custom-usrmerge.sh" \
+    "${TARGET}/etc/initramfs-tools/hooks/"
+
  ### Install the script to be called by 'update-initramfs' for installing the necessary modules to load into initramfs environment.
  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/modules" \
    "${TARGET}/etc/initramfs-tools/"
@@ -50,9 +54,9 @@ EOF
  ## 'most' - Add most filesystem and all hard-drive drivers.
  ## 'dep'  - Try and guess the modules to load.

-  insert_header "${TARGET}/etc/initramfs-tools/conf.d/driver-policy"
+  insert_header   "${TARGET}/etc/initramfs-tools/conf.d/driver-policy"
  insert_comments "${TARGET}/etc/initramfs-tools/conf.d/driver-policy"
-  cat << EOF >> "${TARGET}/etc/initramfs-tools/conf.d/driver-policy"
+  cat << EOF >>   "${TARGET}/etc/initramfs-tools/conf.d/driver-policy"
 # Driver inclusion policy selected during installation.
 # Note: This setting overrides the value set in the file '/etc/initramfs-tools/initramfs.conf'.

@@ -61,9 +65,9 @@ MODULES=dep
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
 EOF

-  insert_header "${TARGET}/etc/initramfs-tools/conf.d/fsroot"
+  insert_header   "${TARGET}/etc/initramfs-tools/conf.d/fsroot"
  insert_comments "${TARGET}/etc/initramfs-tools/conf.d/fsroot"
-  cat << EOF >> "${TARGET}/etc/initramfs-tools/conf.d/fsroot"
+  cat << EOF >>   "${TARGET}/etc/initramfs-tools/conf.d/fsroot"
 FSTYPE=${VAR_ROOT_FS}

 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
--- a/func/cdi_4300_network/4300_installation_network.sh
+++ b/func/cdi_4300_network/4300_installation_network.sh
@@ -18,8 +18,6 @@ guard_sourcing
 #   ARY_IPV4_NS
 #   ARY_IPV6_NS
 #   TARGET
-#   VAR_ARCHITECTURE
-#   VAR_CODENAME
 #   VAR_FINAL_IPV4
 #   VAR_FINAL_IPV4_GW
 #   VAR_FINAL_IPV4_SUBNET
@@ -28,22 +26,42 @@ guard_sourcing
 #   VAR_FINAL_IPV6_SUBNET
 #   VAR_FINAL_NIC
 #   VAR_LINK_IPV6
-#   VAR_VERSION
 #   network_autoconfig_enable
 #   network_choose_interface_auto
 #   network_static_ipv4nameserver_0
 #   network_static_ipv6address
 #   network_static_ipv6nameserver_0
 # Arguments:
-#  None
+#   None
 # Returns:
 #   0: on success
 #######################################
 installation_network() {
  ### Declare Arrays, HashMaps, and Variables.
  declare     var_supersede="" var_supersede_ipv6=""
+  declare -r  var_logfile="/root/.ciss/cdi/log/4300_installation_network.log"

-  chroot_exec "${TARGET}" apt-get install -y dhcpcd-base
+  chroot_logger "${TARGET}${var_logfile}"
+
+  chroot_script "${TARGET}" "
+    export INITRD=No
+    apt-get purge -y dhcpcd isc-dhcp-client 2>&1 | tee -a ${var_logfile}
+    echo ExitCode: \$? >> ${var_logfile}
+  "
+
+  chroot_script "${TARGET}" "
+      export INITRD=No
+      apt-get install -y --no-install-suggests ifupdown dhcpcd-base 2>&1 | tee -a ${var_logfile}
+      echo ExitCode: \$? >> ${var_logfile}
+  "
+
+  chroot_script "${TARGET}" "
+    systemctl disable systemd-networkd NetworkManager 2>/dev/null | tee -a ${var_logfile} || true
+    systemctl disable dhcpcd.service 2>/dev/null | tee -a ${var_logfile} || true
+    echo ExitCode: \$? >> ${var_logfile}
+  "
+
+  chroot_exec "${TARGET}"
  mkdir -p "${TARGET}/etc/network/interfaces.d"

  ### Create a network configuration file header.
@@ -55,67 +73,41 @@ installation_network() {

  fi

-  cat << EOF >| "${TARGET}/etc/network/interfaces"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
+  ### Reminder ###
+  # auto:
+  # For servers or systems with static interfaces that should always be available (e.g., eth0 on a server).
+  # For configurations where the interface should be active regardless of the cable status.
+  # allow-hotplug:
+  # For systems with dynamic or removable network devices (e.g., laptops or USB adapters).
+  # To avoid boot delays when interfaces are unavailable.

+  insert_header   "${TARGET}/etc/network/interfaces"
+  insert_comments "${TARGET}/etc/network/interfaces"
+  cat << EOF >>   "${TARGET}/etc/network/interfaces"
 # This file describes the network interfaces available on your system
 # and how to activate them. For more information, see interfaces(5).

-source /etc/network/interfaces.d/*
+source-directory /etc/network/interfaces.d/*

 # The loopback network interface
 auto lo
 iface lo inet loopback

+auto ${VAR_FINAL_NIC}
+
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
 EOF
  chmod 0644 "${TARGET}/etc/network/interfaces"
  do_log "info" "file_only" "4300() Header '${TARGET}/etc/network/interfaces' created."

+
  ### Configure network interfaces based on 'preseed.yaml' and create network configuration files for IPv4.
  if [[ "${network_autoconfig_enable}" == "true" && "${network_choose_interface_auto}" == "true" ]]; then

-    ### Reminder ###
-    # auto:
-    # For servers or systems with static interfaces that should always be available (e.g., eth0 on a server).
-    # For configurations where the interface should be active regardless of the cable status.
-    # allow-hotplug:
-    # For systems with dynamic or removable network devices (e.g., laptops or USB adapters).
-    # To avoid boot delays when interfaces are unavailable.
-
-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces.d/10-ipv4-dhcp
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# The primary network interface IPv4
-auto ${VAR_FINAL_NIC}
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+# The primary network interface: IPv4 via DHCP
 iface ${VAR_FINAL_NIC} inet dhcp

 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
@@ -125,25 +117,10 @@ EOF

  elif [[ "${network_autoconfig_enable}" == "true" && "${network_choose_interface_auto}" == "false" ]]; then

-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces.d/10-ipv4-dhcp
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# The primary network interface IPv4
-auto ${VAR_FINAL_NIC}
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+# The primary network interface: IPv4 via DHCP
 iface ${VAR_FINAL_NIC} inet dhcp

 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
@@ -156,25 +133,10 @@ EOF
  if [[ "${network_autoconfig_enable}" == "false" ]]; then

    # shellcheck disable=SC2153
-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv4-static"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces.d/10-ipv4-static
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# The primary network interface IPv4
-auto ${VAR_FINAL_NIC}
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv4-static"
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv4-static"
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv4-static"
+# The primary network interface: IPv4 via static IP
 iface ${VAR_FINAL_NIC} inet static
    address ${VAR_FINAL_IPV4}
    netmask ${VAR_FINAL_IPV4_SUBNET}
@@ -188,59 +150,29 @@ EOF

  fi

+
  ### Configure network interfaces based on 'preseed.yaml' and create network configuration files for IPv6.
-  if [[ "${network_autoconfig_enable}" == "true" && "${VAR_LINK_IPV6}" == "true" ]]; then
+  if [[ "${network_autoconfig_enable}" == "true" && "${VAR_LINK_IPV6}" == "true" &&  -z "${network_static_ipv6address}" ]]; then

-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces.d/10-ipv6-dhcp
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# The primary network interface IPv6
-auto ${VAR_FINAL_NIC}
-iface ${VAR_FINAL_NIC} inet6 dhcp
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
+# The primary network interface: IPv6 via SLAAC (+ stateless DHCPv6 for DNS)
+iface ${VAR_FINAL_NIC} inet6 auto
+    accept_ra 2
+    dhcp 1

 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
 EOF
    chmod 0644 "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
    do_log "info" "file_only" "4300() IPv6 on the primary NIC: '${VAR_FINAL_NIC}' configured with DHCP."

-  fi
+  elif [[ "${VAR_LINK_IPV6}" == "true" && -n "${network_static_ipv6address}" ]]; then

-  if [[ "${network_autoconfig_enable}" == "false" && -n "${network_static_ipv6address}" ]]; then
-
-    # shellcheck disable=SC2153
-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv6-static"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces.d/10-ipv6-static
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# The primary network interface IPv6
-auto ${VAR_FINAL_NIC}
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv6-static"
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv6-static"
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv6-static"
+# The primary network interface: IPv6 via static IP
 iface ${VAR_FINAL_NIC} inet6 static
    address ${VAR_FINAL_IPV6}/${VAR_FINAL_IPV6_SUBNET}
    gateway ${VAR_FINAL_IPV6_GW}
@@ -255,60 +187,73 @@ EOF


  ### Ensure 'dhcpcd-base' DHCP Client is not overwriting the static nameserver settings.
-  if [[ "${network_autoconfig_enable}" == "true" && -n "${network_static_ipv4nameserver_0}" ]]; then
+  if [[ -f "${TARGET}/etc/dhcpcd.conf" ]]; then

-    if [[ -f "${TARGET}/etc/dhcpcd.conf" ]]; then
+    mkdir -p "${TARGET}/root/.ciss/cdi/backup/etc"
+    mv "${TARGET}/etc/dhcpcd.conf" "${TARGET}/root/.ciss/cdi/backup/etc/dhcpcd.conf.bak"
+    do_log "info" "file_only" "4300() Existing '${TARGET}/etc/dhcpcd.conf' moved."

-      mkdir -p "${TARGET}/root/.ciss/cdi/backup/etc"
-      mv "${TARGET}/etc/dhcpcd.conf" "${TARGET}/root/.ciss/cdi/backup/etc/dhcpcd.conf.bak"
-      do_log "info" "file_only" "4300() Existing '${TARGET}/etc/dhcpcd.con' copied."
+  fi

-    fi
+  insert_header   "${TARGET}/etc/dhcpcd.conf"
+  insert_comments "${TARGET}/etc/dhcpcd.conf"
+  cat << 'EOF' >> "${TARGET}/etc/dhcpcd.conf"
+### A ServerID is required by RFC2131.
+require dhcp_server_identifier

-    insert_header "${TARGET}/etc/dhcpcd.conf"
-    insert_comments "${TARGET}/etc/dhcpcd.conf"
-    cat << EOF >> "${TARGET}/etc/dhcpcd.conf"
-### Global defaults for all interfaces.
+### Respect the network MTU. This is applied to DHCP routes.
+option interface_mtu
+
+### A list of options to request from the DHCP server.
 option host_name
 option domain_name
 option domain_search
+option domain_name_servers
+
+### Most distributions have NTP support.
+option ntp_servers

 ### Ask server to update both A and PTR via FQDN (RFC 4702 semantics).
 fqdn both

-### Enforce static DNS and prevent dhcpcd from writing 'resolv.conf'.
+EOF
+
+
+  if [[ -n "${network_static_ipv4nameserver_0}" ]]; then
+
+    cat << EOF >>   "${TARGET}/etc/dhcpcd.conf"
+### Enforce static DNS
 nooption domain_name_servers
-nohook resolv.conf rdnssd
+nohook rdnssd

 ### Static resolvers (IPv4).
-### (This does NOT write '/etc/resolv.conf' because of nohook above.)
+interface ${VAR_FINAL_NIC}
 EOF

    var_supersede=$(printf "%s " "${ARY_IPV4_NS[@]}")
-    echo "static domain_name_servers=${var_supersede}" >> "${TARGET}/etc/dhcpcd.conf"
+    echo "  static domain_name_servers=${var_supersede}" >> "${TARGET}/etc/dhcpcd.conf"

    do_log "info" "file_only" "4300() DHCP client configuration for IPv4: '${TARGET}/etc/dhcpcd.conf' configured."

  fi


+  if [[ -n "${network_static_ipv6nameserver_0}" ]]; then

-  if [[ "${network_autoconfig_enable}" == "false" && -n "${network_static_ipv6nameserver_0}" ]]; then
+    cat << EOF >>   "${TARGET}/etc/dhcpcd.conf"

+### Static resolvers (IPv6).
+EOF
    var_supersede_ipv6=$(printf "%s " "${ARY_IPV6_NS[@]}")
-    echo "static domain_name_servers=${var_supersede_ipv6}" >> "${TARGET}/etc/dhcpcd.conf"
+    echo "  static domain_name_servers=${var_supersede_ipv6}" >> "${TARGET}/etc/dhcpcd.conf"

    do_log "info" "file_only" "4300() DHCP client configuration for IPv6: '${TARGET}/etc/dhcpcd.conf' configured."

  fi

-  if [[ "${network_autoconfig_enable}" == "true" && -n "${network_static_ipv4nameserver_0}" ]]; then
-
-    cat << EOF >> "${TARGET}/etc/dhcpcd.conf"
-
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
-EOF
-  fi
+  ### Footer (always)
+  echo '' >> "${TARGET}/etc/dhcpcd.conf"
+  echo '# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf' >> "${TARGET}/etc/dhcpcd.conf"

  guard_dir && return 0
 }
--- a/func/cdi_4400_hardening/4400_kernel_modules.sh
+++ b/func/cdi_4400_hardening/4400_kernel_modules.sh
@@ -24,23 +24,10 @@ guard_sourcing
 kernel_modules() {
  ### Entropy collection improvements
  mkdir -p "${TARGET}/usr/lib/modules-load.d"
-  cat << EOF >| "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /usr/lib/modules-load.d/30_security-misc.conf
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}

+  insert_header   "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
+  insert_comments "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
+  cat << EOF >>   "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
 # The jitterentropy_rng kernel module provides a reliable and hardware-independent source of cryptographic entropy by measuring
 # minute variations in CPU execution timing (jitter). These microsecond-level differences are unpredictable and rooted in
 # physical randomness, making them suitable for high-quality entropy generation. Unlike other RNG methods that rely on hardware
--- a/func/cdi_4500_user/4500_installation_accounts.sh
+++ b/func/cdi_4500_user/4500_installation_accounts.sh
@@ -76,11 +76,11 @@ installation_accounts() {
    fi
  fi

-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/etc/skel/.bashrc" "${TARGET}/root/"
-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/etc/skel/.zshrc" "${TARGET}/root/"
-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/root/.ciss/alias" "${TARGET}/root/.ciss/"
-  install -D -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/root/.ciss/clean_logout.sh" "${TARGET}/root/.ciss/"
-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/root/.ciss/shortcuts" "${TARGET}/root/.ciss/"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.bashrc" "${TARGET}/root/"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.zshrc" "${TARGET}/root/"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/alias" "${TARGET}/root/.ciss/"
+  install -D -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/clean_logout.sh" "${TARGET}/root/.ciss/"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/shortcuts" "${TARGET}/root/.ciss/"
  # To be able to copy/paste from vim, one needs to create a '.vimrc' with the following content:
  echo 'set clipboard=unnamed' >| "${TARGET}/root/.vimrc"
  chmod 0600 "${TARGET}/root/.vimrc"
--- a/func/cdi_4600_verification/4699_check_usr_merge.sh
+++ b/func/cdi_4600_verification/4699_check_usr_merge.sh
@@ -24,7 +24,7 @@ guard_sourcing
 #######################################
 check_final_usr_merge() {
  ### Declare Arrays, HashMaps, and Variables.
-  declare -r  var_logfile="/root/.ciss/cdi/log/4500_check_usr_merge.log"
+  declare -r  var_logfile="/root/.ciss/cdi/log/4699_check_usr_merge.log"

  chroot_logger "${TARGET}${var_logfile}"