V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

.archive/func/1251_yaml_reader_highest_device.sh

@@ -0,0 +1,164 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Reading and extracting variables from "${PRESEED}".
+# Globals:
+#   HMP_RECIPE_DEV_PARTITIONS
+#   VAR_ARCHITECTURE
+#   VAR_NUKE
+#   VAR_PRESEED
+#   VAR_RECIPE_FIRMWARE
+#   VAR_RECIPE_HIGHEST_DEVICE
+#   VAR_RECIPE_STRING
+#   VAR_RECIPE_TABLE
+#   architecture
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#   ERR_NO_VALID_RECIPE
+#######################################
+yaml_reader() {
+  ### Declare Arrays, HashMaps, and Variables.
+  declare -Ag HMP_RECIPE_DEV_PARTITIONS=()
+  declare -gx VAR_RECIPE_STRING="" VAR_RECIPE_HIGHEST_DEVICE="" VAR_ARCHITECTURE="" VAR_RECIPE_FIRMWARE="" VAR_NUKE="" \
+              VAR_RECIPE_TABLE=""
+
+  ### Declare and substitute input files
+  declare -r  var_if="${VAR_PRESEED}"
+  ### Search pattern for variables (recipe_<string>_active='true')
+  declare -r  var_search_pattern="^recipe_.*_active='true'"
+  declare     var_line="" var_middle_part="" var_highest_dev="" var_device="" var_fields="" var_partition="" \
+              recipe_firmware_var="" recipe_nuke_var="" recipe_table_var=""
+
+  ### Read "${var_if}" line by line
+  while IFS= read -r var_line; do
+    ### Check, if line matches the search pattern
+    if [[ "${var_line}" =~ ^recipe_([^_]+)_active=\'true\' ]]; then
+      var_middle_part="${BASH_REMATCH[1]}"
+      VAR_RECIPE_STRING="${var_middle_part}"
+      break
+    fi
+    #if [[ "${var_line}" =~ ${var_search_pattern} ]]; then
+    #  ### Extract the middle part or second position
+    #  var_middle_part=$(echo "${var_line}" | sed -E "s/^recipe_([^_]+)_active='true'/\1/")
+    #  VAR_RECIPE_STRING="${var_middle_part}"
+    #  ### Exit after first occurrence
+    #  break
+    #fi
+  done < "${var_if}"
+
+  if [[ -n "${VAR_RECIPE_STRING}" ]]; then
+    do_log "info" "file_only" "1251() Found active recipe string: '${VAR_RECIPE_STRING}'."
+  else
+    do_log "fatal" "file_only" "1251() Found NO active recipe string: '${VAR_RECIPE_STRING}'."
+    exit "${ERR_NO_VALID_RECIPE}"
+  fi
+
+  ### Search "${var_if}" for matching recipe_${VAR_RECIPE_STRING}_dev_* entries and find the highest dev letter.
+  # shellcheck disable=SC2312
+  var_highest_dev=$(grep -E "^recipe_${VAR_RECIPE_STRING}_dev_" "${var_if}" | awk -F'_' '
+{
+  if (NF >= 4) {
+    ### Extract 4th position (e.g., "recipe_${VAR_RECIPE_STRING}_dev_sda" or "recipe_${VAR_RECIPE_STRING}_dev_vda")
+    device_field = $4
+    ### Check, if field is at least 3 char wide and last char contains a letter
+    if (length(device_field) >= 3) {
+      last_char = substr(device_field, length(device_field), 1)  ### Extract last letter of respective field
+      if (last_char ~ /^[a-z]$/ && last_char > max) {
+        max = last_char
+      }
+    }
+  }
+}
+END { print max }
+')
+
+  ### Save the result in VAR_RECIPE_HIGHEST_DEVICE.
+  VAR_RECIPE_HIGHEST_DEVICE="${var_highest_dev}"
+
+  if [[ -n "${VAR_RECIPE_HIGHEST_DEVICE}" ]]; then
+    do_log "info" "file_only" "1251() Found highest recipe device: '${VAR_RECIPE_HIGHEST_DEVICE}'."
+  else
+    do_log "fatal" "file_only" "1251() Found NO highest recipe device: '${VAR_RECIPE_HIGHEST_DEVICE}'."
+    exit "${ERR_NO_VALID_RECIPE}"
+  fi
+
+  ### Read var_if and iterate through all matching entries without executing in a subshell
+  # shellcheck disable=SC2312
+  while read -r var_line; do
+    ### Extract fields of line
+    IFS='_' read -ra var_fields <<< "${var_line}"
+
+    ### Check that enough fields are available
+    if [[ "${#var_fields[@]}" -ge 5 ]]; then
+      var_device="${var_fields[3]}"    ### The fourth position includes the device (e.g., sda, vda, xvda)
+      var_partition="${var_fields[4]}" ### The fifth position includes the partition (e.g., 13)
+
+      ### Check, if the partition is a number and higher than the current value
+      if [[ "${var_partition}" =~ ^[0-9]+$ ]]; then
+        declare -i cur="${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-0}"
+        if (( var_partition > cur )); then
+
+        #if [[ -z "${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-}" || "${var_partition}" -gt ${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-0} ]]; then
+          # shellcheck disable=SC2004
+          HMP_RECIPE_DEV_PARTITIONS[${var_device}]="${var_partition}"
+        fi
+
+      fi
+
+    fi
+  done < <(grep -E "^recipe_${VAR_RECIPE_STRING}_dev_" "${var_if}")
+
+  for var_device in "${!HMP_RECIPE_DEV_PARTITIONS[@]}"; do
+    do_log "info" "file_only" "1251() Highest number of partitions: [${var_device}:${HMP_RECIPE_DEV_PARTITIONS[${var_device}]}]."
+  done
+
+  ### Extract architecture.
+  VAR_ARCHITECTURE="${architecture}"
+
+  ### Extract chosen firmware.
+  recipe_firmware_var="recipe_${VAR_RECIPE_STRING}_control_firmware"
+  VAR_RECIPE_FIRMWARE="${!recipe_firmware_var}"
+
+  ### Extract the chosen Nuke mechanism.
+  recipe_nuke_var="recipe_${VAR_RECIPE_STRING}_control_nuke"
+  VAR_NUKE="${!recipe_nuke_var}"
+
+  ### Extract chosen partition table.
+  recipe_table_var="recipe_${VAR_RECIPE_STRING}_control_table"
+  VAR_RECIPE_TABLE="${!recipe_table_var}"
+
+  if [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
+
+    do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP 'EF00' necessary."
+
+  elif [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
+
+    do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > BIOS Boot Partition 'EF02' necessary."
+
+  elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
+
+    do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP on MBR needs partition type '0xEF'."
+
+  elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
+
+    do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > No special firmware partition necessary."
+
+  fi
+
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

.archive/func/3220_partition_encryption_double_loop.sh

@@ -0,0 +1,200 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Function to encrypt the respective partition on each device according to the chosen recipe string.
+# Globals:
+#   DIR_BAK
+#   DIR_CNF
+#   DIR_LOG
+#   HMP_EPHEMERAL_ENCLABEL
+#   HMP_EPHEMERAL_FS_LABEL
+#   HMP_PATH_ENCLABEL
+#   HMP_PATH_LUKSUUID
+#   VAR_CRYPT_RECOVERY
+#   VAR_CRYPT_ROOT
+#   VAR_ITER_TIME
+#   VAR_KDF_ITERATIONS
+#   VAR_KDF_MEMORY
+#   VAR_KDF_THREADS
+#   VAR_RECIPE_STRING
+#   VAR_SETUP_PART
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+partition_encryption() {
+  ### Declare Arrays, HashMaps, and Variables.
+  declare -Ag HMP_PATH_LUKSUUID      # Used in: 3290() - [Mount Path:LUKS UUID].
+                                     # Used in: 4060() - [Mount Path:LUKS UUID].
+  declare -Ag HMP_EPHEMERAL_ENCLABEL
+  declare -Ag HMP_EPHEMERAL_FS_LABEL
+
+  declare -Ag HMP_PATH_ENCLABEL
+
+  declare -gx VAR_CRYPT_ROOT=""      # LUKS UUID of '/'.
+  declare -gx VAR_CRYPT_RECOVERY=""  # LUKS UUID of '/recovery'.
+
+  declare var_dev="" var_part="" \
+    var_encryption_enable="" var_encryption_ephemeral="" var_encryption_integrity="" var_encryption_cipher="" \
+    var_encryption_hash="" var_encryption_key="" var_encryption_label="" var_encryption_meta="" var_encryption_slot="" \
+    var_encryption_pbkdf="" var_encryption_rng="" var_filesystem_label="" var_mount_path="" var_uuid="" var_fs=""
+
+  declare -a ary_devs=() ary_parts=() ary_luks_opts=()
+
+  ### Iterate over all devices in the recipe.
+  # shellcheck disable=SC2312
+  readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
+  for var_dev in "${ary_devs[@]}"; do
+
+    touch "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
+    chmod 0600 "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
+
+    ### Iterate over all partitions for this device.
+    # shellcheck disable=SC2312
+    readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
+    for var_part in "${ary_parts[@]}"; do
+
+      ### Extract parameters from YAML.
+      var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable"       "${VAR_SETUP_PART}")
+      var_encryption_ephemeral=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.ephemeral" "${VAR_SETUP_PART}")
+      var_encryption_integrity=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.integrity" "${VAR_SETUP_PART}")
+      var_encryption_cipher=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.cipher"       "${VAR_SETUP_PART}")
+      var_encryption_hash=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.hash"           "${VAR_SETUP_PART}")
+      var_encryption_key=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.key"             "${VAR_SETUP_PART}")
+      var_encryption_slot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.keyslotssize"   "${VAR_SETUP_PART}")
+      var_encryption_meta=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.metadatasize"   "${VAR_SETUP_PART}")
+      var_encryption_pbkdf=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.pbkdf"         "${VAR_SETUP_PART}")
+      var_encryption_rng=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.rng"             "${VAR_SETUP_PART}")
+      var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"                     "${VAR_SETUP_PART}")
+      var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"                     "${VAR_SETUP_PART}")
+
+      if [[ "${var_encryption_enable,,}" != "true" ]]; then
+        continue
+      fi
+
+      var_encryption_label=$(get_label "${var_mount_path}" "${var_fs}" "luks")
+
+      if [[ "${var_mount_path,,}" == "/boot" ]]; then
+        ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_boot.txt" )
+        ary_luks_opts+=(
+          --iter-time "${VAR_ITER_TIME:-3000}"
+        )
+      else
+        ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_common.txt" )
+        ary_luks_opts+=(
+          --pbkdf-parallel "${VAR_KDF_THREADS:-1}"
+          --pbkdf-memory "${VAR_KDF_MEMORY:-4}"
+          --pbkdf-force-iterations "${VAR_KDF_ITERATIONS:-4}"
+        )
+      fi
+
+      ary_luks_opts+=(
+        --type luks2
+        --cipher "${var_encryption_cipher:-aes-xts-plain64}"
+        --hash "${var_encryption_hash:-sha512}"
+        --key-size "${var_encryption_key:-512}"
+        --label "${var_encryption_label}"
+        --luks2-keyslots-size "${var_encryption_slot:-16777216}"
+        --luks2-metadata-size "${var_encryption_meta:-4194304}"
+        --pbkdf "${var_encryption_pbkdf:-argon2id}"
+        "--${var_encryption_rng}"
+        --batch-mode
+        --verbose
+      )
+
+      [[ "${var_encryption_integrity,,}" == "true" ]] && ary_luks_opts+=( --integrity hmac-sha512 )
+
+      if [[ "${var_encryption_ephemeral,,}" == "true" ]]; then
+
+        case "${var_mount_path,,}" in
+
+          swap|/tmp)
+
+            var_filesystem_label=$(get_label "${var_mount_path}" "${var_fs}" "file")
+
+            mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev}${var_part}" 1M
+            do_log "info" "file_only" "3220() Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'."
+
+
+            HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]="${var_encryption_label}"
+            HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]="${var_filesystem_label}"
+
+            do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
+            do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]}'"
+            continue
+            ;;
+
+          *)
+            do_log "error" "file_only" "3220() Invalid mount path: '${var_mount_path}' for partition: '/dev/${var_dev}${var_part}'."
+            continue
+            ;;
+
+        esac
+
+      fi
+
+      cryptsetup luksFormat "${ary_luks_opts[@]}" "/dev/${var_dev}${var_part}"
+
+      if [[ "${var_encryption_integrity,,}" == "true" ]]; then
+
+        do_log "debug" "file_only" "3220() [cryptsetup luksFormat ${ary_luks_opts[*]} /dev/${var_dev}${var_part}]."
+        do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' dm-integrity encrypted."
+
+      else
+
+        do_log "debug" "file_only" "3220() [cryptsetup luksFormat ${ary_luks_opts[*]} /dev/${var_dev}${var_part}]."
+        do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' encrypted."
+
+      fi
+
+      cryptsetup luksHeaderBackup --header-backup-file="${DIR_BAK}/luks_header_${var_dev}${var_part}.bak" "/dev/${var_dev}${var_part}"
+      do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev}${var_part}.bak'."
+
+      ### Opening encrypted container.
+      if [[ "${var_mount_path,,}" == "/boot" ]]; then
+        cryptsetup luksOpen "/dev/${var_dev}${var_part}" \
+          --key-file="${DIR_CNF}/password_luks_boot.txt" \
+          "${var_encryption_label}"
+      else
+        cryptsetup luksOpen "/dev/${var_dev}${var_part}" \
+          --key-file="${DIR_CNF}/password_luks_common.txt" \
+          "${var_encryption_label}"
+      fi
+      do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' opened as '/dev/mapper/${var_encryption_label}'."
+
+      ### Create luksDump log entry.
+      printf "#------------------------------------------------------------------#\n" >> "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
+      cryptsetup luksDump "/dev/${var_dev}${var_part}" >> "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
+
+      ### Store UUID of the LUKS container.
+      var_uuid=$(blkid -s UUID -o value "/dev/${var_dev}${var_part}")
+
+      [[ "${var_mount_path}" == "/" ]] && declare -grx VAR_CRYPT_ROOT="${var_uuid}"
+      [[ "${var_mount_path}" == "/recovery" ]] && declare -grx VAR_CRYPT_RECOVERY="${var_uuid}"
+
+      HMP_PATH_LUKSUUID["${var_mount_path}"]="${var_uuid}"
+      HMP_PATH_ENCLABEL["LABEL_${var_mount_path}"]="${var_encryption_label}"
+
+      do_log "debug" "file_only" "3220() Stored in HashMap [HMP_PATH_LUKSUUID]     : '${var_mount_path}' -> '${HMP_PATH_LUKSUUID["${var_mount_path}"]}'"
+      do_log "debug" "file_only" "3220() Stored in HashMap [HMP_PATH_ENCLABEL]     : '${var_mount_path}' -> '${HMP_PATH_ENCLABEL["LABEL_${var_mount_path}"]}'"
+
+    done
+
+  done
+
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

.archive/func/3240_partition_formatting_double_loop.sh

@@ -0,0 +1,138 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Function to format the respective partition on each device according to the recipe string chosen.
+# Globals:
+#   DIR_LOG
+#   HMP_PATH_FSUUID
+#   VAR_RECIPE_STRING
+#   VAR_SETUP_PART
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+partition_formatting() {
+  ### Declare Arrays, HashMaps, and Variables.
+  declare -Ag HMP_PATH_FSUUID        # Used in: 3290() - [Mount Path:Filesystem UUID].
+                                     # Used in: 4060() - [Mount Path:Filesystem UUID].
+  declare var_dev="" var_part="" \
+    var_encryption_enable="" var_encryption_label="" var_fs_btrfs_checksum="" var_fs_btrfs_compress="" var_fs_btrfs_mdup="" \
+    var_fs_format="" var_fs_label="" var_fs_options="" var_fs_version="" var_mount_path="" var_node="" var_fs_uuid=""
+
+  declare -a ary_devs=() ary_parts=() ary_opts=() ary_fmt_opts=()
+
+  ### Iterate over all devices in the recipe.
+  # shellcheck disable=SC2312
+  readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
+  for var_dev in "${ary_devs[@]}"; do
+
+    ### Iterate over all partitions for this device.
+    # shellcheck disable=SC2312
+    readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
+    for var_part in "${ary_parts[@]}"; do
+
+      ### Extract parameters from YAML.
+      var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable"         "${VAR_SETUP_PART}")
+      var_fs_btrfs_checksum=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.checksum" "${VAR_SETUP_PART}")
+      var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
+      var_fs_btrfs_mdup=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.mdup"         "${VAR_SETUP_PART}")
+      var_fs_format=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.format"                 "${VAR_SETUP_PART}")
+      var_fs_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.options"               "${VAR_SETUP_PART}")
+      var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"               "${VAR_SETUP_PART}")
+      var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"                       "${VAR_SETUP_PART}")
+
+      [[ "${var_fs_format,,}" != "true" ]] && continue
+
+      ### Preparation of Ephemeral 'SWAP' and '/tmp' as per https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption#UUID_and_LABEL
+      case "${var_mount_path,,}" in
+        swap|/tmp)
+          do_log "info" "file_only" "3240() Partition: '/dev/${var_dev}${var_part}' ephemeral encryption already prepared in 3220(): '${var_mount_path}'."
+          continue
+          ;;
+      esac
+
+      if [[ "${var_encryption_enable,,}" == "true" ]]; then
+        var_encryption_label=$(get_label "${var_mount_path}" "${var_fs_version}" "luks")
+        var_node="/dev/mapper/${var_encryption_label}"
+      else
+        var_node="/dev/${var_dev}${var_part}"
+      fi
+
+      var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
+
+      case "${var_fs_version,,}" in
+
+        btrfs)
+          ary_opts=( -L "${var_fs_label}" -f --csum "${var_fs_btrfs_checksum}" )
+          [[ "${var_fs_btrfs_mdup,,}" == "true" ]] && ary_opts+=( -m dup )
+
+          mkfs.btrfs "${ary_opts[@]}" "${var_node}"
+
+          do_log "debug" "file_only" "3240() [mkfs.btrfs ${ary_opts[*]} ${var_node}]."
+          do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'btrfs' options: '${ary_opts[*]}'."
+
+          echo "Partition: '${var_node}':" >> "${DIR_LOG}/btrfs.log"
+          btrfs filesystem show "${var_node}" >> "${DIR_LOG}/btrfs.log"
+
+          var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
+          ### Gathering information for '/etc/fstab'-generation in 4040().
+          HMP_PATH_FSUUID["${var_mount_path}"]="${var_fs_uuid}"
+          ;;
+
+        ext4)
+          read -r -a ary_fmt_opts <<< "${var_fs_options}"
+
+          mkfs.ext4 -L "${var_fs_label}" "${ary_fmt_opts[@]}" "${var_node}"
+
+          do_log "debug" "file_only" "3240() [mkfs.ext4 -L ${var_fs_label} ${ary_fmt_opts[*]} ${var_node}]."
+          do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'ext4' options: '${ary_fmt_opts[*]}'."
+
+          echo "Partition: '${var_node}':" >> "${DIR_LOG}/ext4.log"
+          tune2fs -l "${var_node}" >> "${DIR_LOG}/ext4.log"
+
+          var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
+          ### Gathering information for '/etc/fstab'-generation in 4040().
+          HMP_PATH_FSUUID["${var_mount_path}"]="${var_fs_uuid}"
+          ;;
+
+        fat32)
+          mkfs.fat -F 32 -n "${var_fs_label}" "${var_node}"
+
+          do_log "debug" "file_only" "3240() [mkfs.fat -F 32 -n ${var_fs_label} ${var_node}]."
+          do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'FAT32'."
+
+          var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
+          ### Gathering information for '/etc/fstab'-generation in 4040().
+          HMP_PATH_FSUUID["${var_mount_path}"]="${var_fs_uuid}"
+          ;;
+
+        *)
+          do_log "error" "file_only" "3240() Unsupported filesystem format: '${var_fs_version}'."
+          ;;
+
+      esac
+
+    done
+
+    lsblk -o NAME,MAJ:MIN,FSTYPE,FSVER,SIZE,UUID,MOUNTPOINT,PATH "/dev/${var_dev}" >| "${DIR_LOG}/${var_dev}_overview.log"
+    printf "%b" "${NL}" >> "${DIR_LOG}/${var_dev}_overview.log"
+    lsblk "/dev/${var_dev}" >> "${DIR_LOG}/${var_dev}_overview.log"
+
+  done
+
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/helper/1250_yaml_parser.sh

@@ -18,28 +18,32 @@ guard_sourcing
 #   ARY_BOOTPARAM
 #   ARY_NTPSRVR
 #   ARY_PACKAGES
+#   BASH_REMATCH
 #   DIR_CNF
 #   DIR_TMP
 #   VAR_PRESEED
+#   VAR_USER_MAX
 # Arguments:
 #   None
 # Returns:
 #   0: on success
 #######################################
 yaml_parser() {
-  cat "${DIR_CNF}/preseed.yaml" "${DIR_CNF}/partitioning.yaml" >| "${DIR_TMP}/combined.yaml"
+  ### Declare Arrays, HashMaps, and Variables.
-
-  yq -o=shell "${DIR_TMP}/combined.yaml" >| "${VAR_PRESEED}"
-
   # shellcheck disable=SC2034
   declare -ag  ARY_BOOTPARAM=() ARY_NTPSRVR=() ARY_PACKAGES=()
   declare -gix VAR_USER_MAX=0
-  declare var_index var_key var_value
+  declare      var_index="" var_key="" var_value=""
+
+  cat "${DIR_CNF}/preseed.yaml" "${DIR_CNF}/partitioning.yaml" >| "${DIR_TMP}/combined.yaml"
+
+  yq -o=shell "${DIR_TMP}/combined.yaml" >| "${VAR_PRESEED}"
 
   ### Generate Arrays for Grub Parameter, NTPSec Server FQDN, Software Packages
   while IFS='=' read -r var_key var_value; do
     var_value=${var_value#\'}
     var_value=${var_value%\'}
+    # shellcheck disable=SC2034
     case "${var_key}" in
       grub_parameter_[0-9]*) ARY_BOOTPARAM+=("${var_value}") ;;
       ntp_server_[0-9]*)     ARY_NTPSRVR+=("${var_value}") ;;
@@ -57,14 +61,24 @@ yaml_parser() {
   done < <(compgen -v)
 
   ### Delete the respective 'key:value'-variables in the global variable set.
-  sed -i '/^grub_parameter_[0-9]\+=/d' "${VAR_PRESEED}"
+  ### Substitute all key= by key=""
-  sed -i '/^ntp_server_[0-9]\+=/d' "${VAR_PRESEED}"
+  ### Wrap each key=value by '' e.g., key='value'
-  sed -i '/^software_[0-9]\+=/d' "${VAR_PRESEED}"
+  awk '
+    /^grub_parameter_[0-9]+=|^ntp_server_[0-9]+=|^software_[0-9]+=/ { next }
+    /=\s*$/ { sub(/=\s*$/, "=\"\"") }
+    !/'"'"'/ && /=/ { sub(/=([^'\''\"]+)$/, "='\''\\1'\''") }
+    { print }
+  ' "${VAR_PRESEED}" >| "${VAR_PRESEED}.tmp" && mv -- "${VAR_PRESEED}.tmp" "${VAR_PRESEED}"
+
+  ### Delete the respective 'key:value'-variables in the global variable set.
+  #sed -i '/^grub_parameter_[0-9]\+=/d' "${VAR_PRESEED}"
+  #sed -i '/^ntp_server_[0-9]\+=/d' "${VAR_PRESEED}"
+  #sed -i '/^software_[0-9]\+=/d' "${VAR_PRESEED}"
 
   ### Substitute all key= by key=""
-  sed -i -E 's/^(.*)=\s*$/\1=""/' "${VAR_PRESEED}"
+  #sed -i -E 's/^(.*)=\s*$/\1=""/' "${VAR_PRESEED}"
   ### Wrap each key=value by '' e.g., key='value'
-  sed -i -E "s/^(.*)=([^'\"]+)$/\1='\2'/" "${VAR_PRESEED}"
+  #sed -i -E "s/^(.*)=([^'\"]+)$/\1='\2'/" "${VAR_PRESEED}"
 
   # shellcheck disable=SC1090
   . "${VAR_PRESEED}"

func/helper/1251_yaml_reader.sh

@@ -15,49 +15,59 @@ guard_sourcing
 #######################################
 # Reading and extracting variables from "${PRESEED}".
 # Globals:
-#   ERR_NO_VALID_RECIPE
 #   HMP_RECIPE_DEV_PARTITIONS
+#   VAR_ARCHITECTURE
+#   VAR_NUKE
 #   VAR_PRESEED
-#   VAR_RECIPE_DEV_COUNTER
 #   VAR_RECIPE_FIRMWARE
+#   VAR_RECIPE_HIGHEST_DEVICE
 #   VAR_RECIPE_STRING
 #   VAR_RECIPE_TABLE
+#   architecture
 # Arguments:
 #   None
 # Returns:
 #   0: on success
+#   ERR_NO_VALID_RECIPE
 #######################################
 yaml_reader() {
+  ### Declare Arrays, HashMaps, and Variables.
+  declare -Ag HMP_RECIPE_DEV_PARTITIONS=()
+  declare -gx VAR_RECIPE_STRING="" VAR_RECIPE_HIGHEST_DEVICE="" VAR_ARCHITECTURE="" VAR_RECIPE_FIRMWARE="" VAR_NUKE="" \
+              VAR_RECIPE_TABLE=""
+
   ### Declare and substitute input files
   declare -r  var_if="${VAR_PRESEED}"
   ### Search pattern for variables (recipe_<string>_active='true')
   declare -r  var_search_pattern="^recipe_.*_active='true'"
+  declare     var_line="" var_middle_part="" var_highest_dev="" var_device="" var_fields="" var_partition="" \
+              recipe_firmware_var="" recipe_nuke_var="" recipe_table_var=""
 
-  declare var_line=""
-  declare var_middle_part=""
   ### Read "${var_if}" line by line
   while IFS= read -r var_line; do
     ### Check, if line matches the search pattern
-    if [[ "${var_line}" =~ ${var_search_pattern} ]]; then
+    if [[ "${var_line}" =~ ^recipe_([^_]+)_active=\'true\' ]]; then
-      ### Extract the middle part or second position
+      var_middle_part="${BASH_REMATCH[1]}"
-      var_middle_part=$(echo "${var_line}" | sed -E "s/^recipe_([^_]+)_active='true'/\1/")
+      VAR_RECIPE_STRING="${var_middle_part}"
-      declare -gx VAR_RECIPE_STRING="${var_middle_part}"
-      ### Exit after first occurrence
       break
     fi
+    #if [[ "${var_line}" =~ ${var_search_pattern} ]]; then
+    #  ### Extract the middle part or second position
+    #  var_middle_part=$(echo "${var_line}" | sed -E "s/^recipe_([^_]+)_active='true'/\1/")
+    #  VAR_RECIPE_STRING="${var_middle_part}"
+    #  ### Exit after first occurrence
+    #  break
+    #fi
   done < "${var_if}"
 
   if [[ -n "${VAR_RECIPE_STRING}" ]]; then
-    do_log "info" "file_only" "Found active recipe string: '${VAR_RECIPE_STRING}'."
+    do_log "info" "file_only" "1251() Found active recipe string: '${VAR_RECIPE_STRING}'."
   else
-    do_log "fatal" "file_only" "Found NO active recipe string: '${VAR_RECIPE_STRING}'."
+    do_log "fatal" "file_only" "1251() Found NO active recipe string: '${VAR_RECIPE_STRING}'."
     exit "${ERR_NO_VALID_RECIPE}"
   fi
 
-  ### Variable for highest device count e.g., /dev/sdf = "f"
+  ### Search "${var_if}" for matching recipe_${VAR_RECIPE_STRING}_dev_* entries and find the highest dev letter.
-  declare var_highest_dev
-
-  ### Search "${var_if}" for matching recipe_${VAR_RECIPE_STRING}_dev_* entries and find the highest dev letter
   # shellcheck disable=SC2312
   var_highest_dev=$(grep -E "^recipe_${VAR_RECIPE_STRING}_dev_" "${var_if}" | awk -F'_' '
 {
@@ -76,19 +86,16 @@ yaml_reader() {
 END { print max }
 ')
 
-  ### Save the result in VAR_RECIPE_DEV_COUNTER
+  ### Save the result in VAR_RECIPE_HIGHEST_DEVICE.
-  declare -gx VAR_RECIPE_DEV_COUNTER="${var_highest_dev}"
+  VAR_RECIPE_HIGHEST_DEVICE="${var_highest_dev}"
 
-  if [[ -n "${VAR_RECIPE_DEV_COUNTER}" ]]; then
+  if [[ -n "${VAR_RECIPE_HIGHEST_DEVICE}" ]]; then
-    do_log "info" "file_only" "Found highest recipe device: '${VAR_RECIPE_DEV_COUNTER}'."
+    do_log "info" "file_only" "1251() Found highest recipe device: '${VAR_RECIPE_HIGHEST_DEVICE}'."
   else
-    do_log "fatal" "file_only" "Found NO highest recipe device: '${VAR_RECIPE_DEV_COUNTER}'."
+    do_log "fatal" "file_only" "1251() Found NO highest recipe device: '${VAR_RECIPE_HIGHEST_DEVICE}'."
     exit "${ERR_NO_VALID_RECIPE}"
   fi
 
-  declare var_device="" var_fields="" var_line="" var_partition=""
-  declare -Ag HMP_RECIPE_DEV_PARTITIONS=()
-
   ### Read var_if and iterate through all matching entries without executing in a subshell
   # shellcheck disable=SC2312
   while read -r var_line; do
@@ -102,8 +109,10 @@ END { print max }
 
       ### Check, if the partition is a number and higher than the current value
       if [[ "${var_partition}" =~ ^[0-9]+$ ]]; then
+        declare -i cur="${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-0}"
+        if (( var_partition > cur )); then
 
-        if [[ -z "${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-}" || "${var_partition}" -gt ${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-0} ]]; then
+        #if [[ -z "${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-}" || "${var_partition}" -gt ${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-0} ]]; then
           # shellcheck disable=SC2004
           HMP_RECIPE_DEV_PARTITIONS[${var_device}]="${var_partition}"
         fi
@@ -114,39 +123,39 @@ END { print max }
   done < <(grep -E "^recipe_${VAR_RECIPE_STRING}_dev_" "${var_if}")
 
   for var_device in "${!HMP_RECIPE_DEV_PARTITIONS[@]}"; do
-    do_log "info" "file_only" "Highest number of partitions: [${var_device}:${HMP_RECIPE_DEV_PARTITIONS[${var_device}]}]."
+    do_log "info" "file_only" "1251() Highest number of partitions: [${var_device}:${HMP_RECIPE_DEV_PARTITIONS[${var_device}]}]."
   done
 
-  ### Extract architecture
+  ### Extract architecture.
-  declare -gx VAR_ARCHITECTURE="${architecture}"
+  VAR_ARCHITECTURE="${architecture}"
 
-  ### Extract chosen firmware
+  ### Extract chosen firmware.
-  declare recipe_firmware_var="recipe_${VAR_RECIPE_STRING}_control_firmware"
+  recipe_firmware_var="recipe_${VAR_RECIPE_STRING}_control_firmware"
-  declare -gx VAR_RECIPE_FIRMWARE="${!recipe_firmware_var}"
+  VAR_RECIPE_FIRMWARE="${!recipe_firmware_var}"
 
-  ### Extract the chosen Nuke mechanism
+  ### Extract the chosen Nuke mechanism.
-  declare recipe_nuke_var="recipe_${VAR_RECIPE_STRING}_control_nuke"
+  recipe_nuke_var="recipe_${VAR_RECIPE_STRING}_control_nuke"
-  declare -gx VAR_NUKE="${!recipe_nuke_var}"
+  VAR_NUKE="${!recipe_nuke_var}"
 
-  ### Extract chosen partition table
+  ### Extract chosen partition table.
-  declare recipe_table_var="recipe_${VAR_RECIPE_STRING}_control_table"
+  recipe_table_var="recipe_${VAR_RECIPE_STRING}_control_table"
-  declare -gx VAR_RECIPE_TABLE="${!recipe_table_var}"
+  VAR_RECIPE_TABLE="${!recipe_table_var}"
 
   if [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
 
-    do_log "info" "file_only" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP 'EF00' necessary."
+    do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP 'EF00' necessary."
 
   elif [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
 
-    do_log "info" "file_only" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > BIOS Boot Partition 'EF02' necessary."
+    do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > BIOS Boot Partition 'EF02' necessary."
 
   elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
 
-    do_log "info" "file_only" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP on MBR needs partition type '0xEF'."
+    do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP on MBR needs partition type '0xEF'."
 
   elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
 
-    do_log "info" "file_only" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > No special firmware partition necessary."
+    do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > No special firmware partition necessary."
 
   fi
 

func/partitioning/3200_partitioning.sh

@@ -20,9 +20,14 @@ guard_sourcing
 #######################################
 
 #######################################
-# Function that generates each partition on each device according to the chosen recipe string.
+# Function that generates each partition on each device according to the chosen recipe string and collects information about:
+# - the mount path and whether to mount or not and in which order mounting must be done.
+# - LUKS encryption enabled.
+# - Specific device partition data for each mount path.
 # Globals:
+#   ARY_FSTAB_MOUNT_PATHS
 #   DIR_LOG
+#   HMP_FSTAB_MOUNT_FTYPE
 #   HMP_PATH_PARTUUID
 #   VAR_RECIPE_FIRMWARE
 #   VAR_RECIPE_STRING
@@ -39,10 +44,22 @@ guard_sourcing
 #   0: on success
 #######################################
 partitioning() {
-  ### Declare Arrays and Variables.
+  ### Declare Arrays, HashMaps, and Variables.
-  declare -Ag HMP_PATH_PARTUUID
+  declare -Ag HMP_PATH_PARTUUID        # Used in: 3290() - [Mount Path:Partition UUID].
-  declare var_dev var_part var_end_arg var_begin var_end var_fs var_boot var_pri var_uuid var_mount_path var_label var_end_mib
+  declare -Ag HMP_FSTAB_MOUNT_FTYPE    # Used in: 4040() - [Mount Path:Filesystem type].
-  declare -a ary_devs ary_parts
+  declare -Ag HMP_PATH_DEV_PART        # Used in: 3220() - [Mount Path:DEV.PARTITION].
+                                       # Used in: 3240() - [Mount Path:DEV.PARTITION].
+  declare -ag ARY_CRYPT_MOUNT_PATHS=() # Used in: 3220() - Only entries [/paths] for encryption.
+  declare -ag ARY_FORMT_MOUNT_PATHS=() # Used in: 3240() - Only entries [/paths] for filesystem generation.
+  declare -ag ARY_FSTAB_MOUNT_PATHS=() # Used in: 4040() - Only entries [/paths] for '/etc/fstab' generation.
+  declare -ag ARY_PATHS_SORTED=()      # Used in:        - All entries [/paths] in a mount ordering scheme.
+
+  declare var_dev="" var_part="" \
+    var_begin="" var_boot="" var_encryption="" var_end="" var_end_arg="" var_end_mib="" var_format="" var_fs="" var_label="" \
+    var_mount_path="" var_mount_true=""  var_pri="" var_uuid=""
+
+  declare -a ary_devs=() ary_parts=() ary_paths_unsorted=()
+
   declare -i i=0 var_dev_size=0 var_dev_end=0
 
   ### Iterate over all devices in the recipe.
@@ -57,10 +74,12 @@ partitioning() {
 
       if command -v sgdisk >/dev/null && sgdisk --zap-all "/dev/${var_dev}"; then
 
+        do_log "debug" "file_only" "3200() [command -v sgdisk >/dev/null && sgdisk --zap-all]."
         do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' wiped with 'sgdisk --zap-all'."
 
       elif dd if=/dev/zero of="/dev/${var_dev}" bs=1M count=8 status=none; then
 
+        do_log "debug" "file_only" "3200() [dd if=/dev/zero of=/dev/${var_dev} bs=1M count=8 status=none]."
         do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' overwritten with zeros."
 
       else
@@ -72,7 +91,7 @@ partitioning() {
 
     else
 
-      do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' discarded (blkdiscard)."
+      do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' discarded [blkdiscard -f /dev/${var_dev}]."
 
     fi
 
@@ -106,9 +125,12 @@ partitioning() {
       var_begin=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.begin"                  "${VAR_SETUP_PART}")
       var_end=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.end"                      "${VAR_SETUP_PART}")
       var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"        "${VAR_SETUP_PART}")
+      var_format=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.format"     "${VAR_SETUP_PART}")
       var_boot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.bootable"                "${VAR_SETUP_PART}")
       var_pri=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.primary"                  "${VAR_SETUP_PART}")
       var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"        "${VAR_SETUP_PART}")
+      var_mount_true=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.enable"      "${VAR_SETUP_PART}")
+      var_encryption=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
 
       ### Assign the start zone of the first partition and skip the first 2 MiB as best practice.
       if [[ "${var_begin,,}" == "min" ]]; then
@@ -215,9 +237,33 @@ partitioning() {
         do_log "fatal" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' could not read PARTUUID."
         return "${ERR_PART_READ}"
       else
-        HMP_PATH_PARTUUID["PARTUUID_${var_mount_path}"]="${var_uuid}"
+        HMP_PATH_PARTUUID["${var_mount_path}"]="${var_uuid}"
+        do_log "debug" "file_only" "3200() Stored in HashMap [HMP_PATH_PARTUUID]     : '${var_mount_path}' -> '${HMP_PATH_PARTUUID["${var_mount_path}"]}'."
       fi
 
+      ### Gathering information for encryption module 3220().
+      if [[ "${var_encryption}" == "true" ]]; then
+        ARY_CRYPT_MOUNT_PATHS+=("${var_mount_path}")
+      fi
+
+      ### Gathering information for filesystem module 3240().
+      if [[ "${var_format}" == "true" ]]; then
+        ARY_FORMT_MOUNT_PATHS+=("${var_mount_path}")
+      fi
+
+      ### Gathering information for mounting module 3280().
+      HMP_PATH_DEV_PART["${var_mount_path}"]="${var_dev}.${var_part}"
+      ary_paths_unsorted+=("${var_mount_path}")
+
+      ### Gathering information for '/etc/fstab'-generation in 4040().
+      if [[ "${var_mount_true}" == "true" ]]; then
+        ARY_FSTAB_MOUNT_PATHS+=("${var_mount_path}")
+        do_log "debug" "file_only" "3200() Stored in Array [ARY_FSTAB_MOUNT_PATHS]   : '${var_mount_path}'."
+        HMP_FSTAB_MOUNT_FTYPE["${var_mount_path}"]="${var_fs}"
+        do_log "debug" "file_only" "3200() Stored in HashMap [HMP_FSTAB_MOUNT_FTYPE] : '${var_mount_path}' -> '${HMP_FSTAB_MOUNT_FTYPE["${var_mount_path}"]}'."
+      fi
+
+
     done
 
   lsblk -o NAME,START,SIZE,PHY-SEC,LOG-SEC,ALIGNMENT "/dev/${var_dev}" >| "${DIR_LOG}/${var_dev}_alignment.log"
@@ -225,6 +271,13 @@ partitioning() {
 
   done
 
+  ### Prepare mount ordering scheme.
+  # shellcheck disable=SC2312
+  IFS=$'\n' read -r -d '' -a ARY_PATHS_SORTED < <(printf "%s\n" "${ary_paths_unsorted[@]}" | sort -u | awk 'BEGIN{FS="/"}{print NF, $0}' | sort -n | cut -d' ' -f2- && printf '\0')
+
+  printf "%s\n" "${ary_paths_unsorted[@]}" >| "${DIR_LOG}/mount_paths_unsorted.log"
+  printf "%s\n" "${ARY_PATHS_SORTED[@]}" >| "${DIR_LOG}/mount_paths_sorted.log"
+
   return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/partitioning/3220_partition_encryption.sh

@@ -13,14 +13,15 @@
 guard_sourcing
 
 #######################################
-# Function to encrypt the respective partition on each device according to the chosen recipe string.
+# Function to encrypt the respective partition on each entry of 'ARY_CRYPT_MOUNT_PATHS'.
 # Globals:
+#   ARY_CRYPT_MOUNT_PATHS
 #   DIR_BAK
 #   DIR_CNF
 #   DIR_LOG
-#   HMP_EPHEMERAL_DEV
 #   HMP_EPHEMERAL_ENCLABEL
 #   HMP_EPHEMERAL_FS_LABEL
+#   HMP_PATH_DEV_PART
 #   HMP_PATH_ENCLABEL
 #   HMP_PATH_LUKSUUID
 #   VAR_CRYPT_RECOVERY
@@ -37,48 +38,45 @@ guard_sourcing
 #   0: on success
 #######################################
 partition_encryption() {
-  ### Declare Arrays and Variables.
+  ### Declare Arrays, HashMaps, and Variables.
-  declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_EPHEMERAL_FS_LABEL HMP_PATH_LUKSUUID HMP_PATH_ENCLABEL
+  declare -Ag HMP_PATH_LUKSUUID      # Used in: 3290() - [Mount Path:LUKS UUID].
-  declare var_dev var_part \
+                                     # Used in: 4060() - [Mount Path:LUKS UUID].
-    var_encryption_enable var_encryption_ephemeral var_encryption_integrity var_encryption_cipher \
+  declare -Ag HMP_EPHEMERAL_ENCLABEL
-    var_encryption_hash var_encryption_key var_encryption_label var_encryption_meta \
+  declare -Ag HMP_EPHEMERAL_FS_LABEL
-    var_encryption_slot var_encryption_pbkdf var_encryption_rng var_filesystem_label var_mount_path var_uuid var_fs
-  declare -a ary_devs=() ary_parts=() ary_luks_opts=()
 
-  ### Iterate over all devices in the recipe.
+  declare -Ag HMP_PATH_ENCLABEL
-  # shellcheck disable=SC2312
-  readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
-  for var_dev in "${ary_devs[@]}"; do
 
-    touch "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
+  declare -gx VAR_CRYPT_ROOT=""      # LUKS UUID of '/'.
-    chmod 0600 "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
+  declare -gx VAR_CRYPT_RECOVERY=""  # LUKS UUID of '/recovery'.
 
-    ### Iterate over all partitions for this device.
+  declare var_encryption_path="" var_dev_part="" \
-    # shellcheck disable=SC2312
+    var_encryption_ephemeral="" var_encryption_integrity="" var_encryption_cipher="" \
-    readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
+    var_encryption_hash="" var_encryption_key="" var_encryption_label="" var_encryption_meta="" var_encryption_slot="" \
-    for var_part in "${ary_parts[@]}"; do
+    var_encryption_pbkdf="" var_encryption_rng="" var_filesystem_label="" var_mount_path="" var_uuid="" var_fs=""
+
+  declare -a ary_luks_opts=()
+
+  for var_encryption_path in "${ARY_CRYPT_MOUNT_PATHS[@]}"; do
+
+    ### Generates physical device location.
+    var_dev_part="${HMP_PATH_DEV_PART[${var_encryption_path}]}"
 
     ### Extract parameters from YAML.
-      var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable"       "${VAR_SETUP_PART}")
+    var_encryption_ephemeral=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.ephemeral" "${VAR_SETUP_PART}")
-      var_encryption_ephemeral=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.ephemeral" "${VAR_SETUP_PART}")
+    var_encryption_integrity=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.integrity" "${VAR_SETUP_PART}")
-      var_encryption_integrity=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.integrity" "${VAR_SETUP_PART}")
+    var_encryption_cipher=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.cipher"       "${VAR_SETUP_PART}")
-      var_encryption_cipher=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.cipher"       "${VAR_SETUP_PART}")
+    var_encryption_hash=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.hash"           "${VAR_SETUP_PART}")
-      var_encryption_hash=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.hash"           "${VAR_SETUP_PART}")
+    var_encryption_key=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.key"             "${VAR_SETUP_PART}")
-      var_encryption_key=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.key"             "${VAR_SETUP_PART}")
+    var_encryption_slot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.keyslotssize"   "${VAR_SETUP_PART}")
-      var_encryption_slot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.keyslotssize"   "${VAR_SETUP_PART}")
+    var_encryption_meta=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.metadatasize"   "${VAR_SETUP_PART}")
-      var_encryption_meta=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.metadatasize"   "${VAR_SETUP_PART}")
+    var_encryption_pbkdf=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.pbkdf"         "${VAR_SETUP_PART}")
-      var_encryption_pbkdf=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.pbkdf"         "${VAR_SETUP_PART}")
+    var_encryption_rng=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.rng"             "${VAR_SETUP_PART}")
-      var_encryption_rng=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.rng"             "${VAR_SETUP_PART}")
+    var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.filesystem.version"                     "${VAR_SETUP_PART}")
-      var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"                     "${VAR_SETUP_PART}")
+    var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.mount.path"                     "${VAR_SETUP_PART}")
-      var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"                     "${VAR_SETUP_PART}")
 
-      if [[ "${var_encryption_enable,,}" != "true" ]]; then
+    var_encryption_label=$(get_label "${var_encryption_path}" "${var_fs}" "luks")
-        continue
-      fi
 
-      var_encryption_label=$(get_label "${var_mount_path}" "${var_fs}" "luks")
+    if [[ "${var_encryption_path,,}" == "/boot" ]]; then
-
-      if [[ "${var_mount_path,,}" == "/boot" ]]; then
       ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_boot.txt" )
       ary_luks_opts+=(
         --iter-time "${VAR_ITER_TIME:-3000}"
@@ -110,27 +108,30 @@ partition_encryption() {
 
     if [[ "${var_encryption_ephemeral,,}" == "true" ]]; then
 
-        case "${var_mount_path}" in
+      case "${var_encryption_path,,}" in
 
-          SWAP|/tmp)
+        swap|/tmp)
 
-            var_filesystem_label=$(get_label "${var_mount_path}" "${var_fs}" "file")
+          var_filesystem_label=$(get_label "${var_encryption_path}" "${var_fs}" "file")
 
-            mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev}${var_part}" 1M
+          mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev_part}" 1M
-            do_log "info" "file_only" "3220() Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'."
+          do_log "info" "file_only" "3220() Ephemeral: '${var_encryption_path}' prepared on: '/dev/${var_dev_part}'."
 
-            HMP_EPHEMERAL_DEV["${var_mount_path}"]="/dev/${var_dev}${var_part}"
-            HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]="${var_encryption_label}"
-            HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]="${var_filesystem_label}"
 
-            do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_DEV]     : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
+          HMP_EPHEMERAL_ENCLABEL["${var_encryption_path}"]="${var_encryption_label}"
-            do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
+          HMP_EPHEMERAL_FS_LABEL["${var_encryption_path}"]="${var_filesystem_label}"
-            do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]}'"
+
+          do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_encryption_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_encryption_path}"]}'"
+          do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_encryption_path}' -> '${HMP_EPHEMERAL_FS_LABEL["${var_encryption_path}"]}'"
+
+          ### The setup of ephemeral devices MUST stop here.
           continue
           ;;
 
         *)
-            do_log "error" "file_only" "3220() Invalid mount path: '${var_mount_path}' for partition: '/dev/${var_dev}${var_part}'."
+
+          do_log "error" "file_only" "3220() Invalid mount path: '${var_encryption_path}' for partition: '/dev/${var_dev_part}'."
+          ### There is no other need to implement ephemeral devices.
           continue
           ;;
 
@@ -138,48 +139,49 @@ partition_encryption() {
 
     fi
 
-      cryptsetup luksFormat "${ary_luks_opts[@]}" "/dev/${var_dev}${var_part}"
+    cryptsetup luksFormat "${ary_luks_opts[@]}" "/dev/${var_dev_part}"
 
     if [[ "${var_encryption_integrity,,}" == "true" ]]; then
 
-        do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' dm-integrity encrypted."
+      do_log "debug" "file_only" "3220() [cryptsetup luksFormat ${ary_luks_opts[*]} /dev/${var_dev_part}]."
+      do_log "info" "file_only" "3220() Partition: '/dev/${var_dev_part}' dm-integrity encrypted."
 
     else
 
-        do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' encrypted."
+      do_log "debug" "file_only" "3220() [cryptsetup luksFormat ${ary_luks_opts[*]} /dev/${var_dev_part}]."
+      do_log "info" "file_only" "3220() Partition: '/dev/${var_dev_part}' encrypted."
 
     fi
 
-      cryptsetup luksHeaderBackup --header-backup-file="${DIR_BAK}/luks_header_${var_dev}${var_part}.bak" "/dev/${var_dev}${var_part}"
+    cryptsetup luksHeaderBackup --header-backup-file="${DIR_BAK}/luks_header_${var_dev_part}.bak" "/dev/${var_dev_part}"
-      do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev}${var_part}.bak'."
+    do_log "info" "file_only" "3220() Partition: '/dev/${var_dev_part}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev_part}.bak'."
 
     ### Opening encrypted container.
-      if [[ "${var_mount_path,,}" == "/boot" ]]; then
+    if [[ "${var_encryption_path,,}" == "/boot" ]]; then
-        cryptsetup luksOpen "/dev/${var_dev}${var_part}" \
+      cryptsetup luksOpen "/dev/${var_dev_part}" \
         --key-file="${DIR_CNF}/password_luks_boot.txt" \
         "${var_encryption_label}"
     else
-        cryptsetup luksOpen "/dev/${var_dev}${var_part}" \
+      cryptsetup luksOpen "/dev/${var_dev_part}" \
         --key-file="${DIR_CNF}/password_luks_common.txt" \
         "${var_encryption_label}"
     fi
-      do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' opened as '/dev/mapper/${var_encryption_label}'."
+    do_log "info" "file_only" "3220() Partition: '/dev/${var_dev_part}' opened as '/dev/mapper/${var_encryption_label}'."
 
     ### Create luksDump log entry.
-      printf "#------------------------------------------------------------------#\n" >> "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
+    cryptsetup luksDump "/dev/${var_dev_part}" >> "${DIR_LOG}/cryptsetup_luksdump_${var_dev_part}.log"
-      cryptsetup luksDump "/dev/${var_dev}${var_part}" >> "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
 
     ### Store UUID of the LUKS container.
-      var_uuid=$(blkid -s UUID -o value "/dev/${var_dev}${var_part}")
+    var_uuid=$(blkid -s UUID -o value "/dev/${var_dev_part}")
-      # shellcheck disable=SC2155
-      [[ "${var_mount_path}" == "/" ]] && declare -grx VAR_CRYPT_ROOT="${var_uuid}"
-      [[ "${var_mount_path}" == "/recovery" ]] && declare -grx VAR_CRYPT_RECOVERY="${var_uuid}"
-      HMP_PATH_LUKSUUID["UUID_${var_mount_path}"]="${var_uuid}"
-      HMP_PATH_ENCLABEL["LABEL_${var_mount_path}"]="${var_encryption_label}"
-      do_log "debug" "file_only" "3220() Stored in HashMap [HMP_PATH_LUKSUUID]     : '${var_mount_path}' -> '${HMP_PATH_LUKSUUID["UUID_${var_mount_path}"]}'"
-      do_log "debug" "file_only" "3220() Stored in HashMap [HMP_PATH_ENCLABEL]     : '${var_mount_path}' -> '${HMP_PATH_ENCLABEL["LABEL_${var_mount_path}"]}'"
 
-    done
+    [[ "${var_encryption_path}" == "/" ]] && declare -grx VAR_CRYPT_ROOT="${var_uuid}"
+    [[ "${var_encryption_path}" == "/recovery" ]] && declare -grx VAR_CRYPT_RECOVERY="${var_uuid}"
+
+    HMP_PATH_LUKSUUID["${var_encryption_path}"]="${var_uuid}"
+    HMP_PATH_ENCLABEL["${var_encryption_path}"]="${var_encryption_label}"
+
+    do_log "debug" "file_only" "3220() [HMP_PATH_LUKSUUID] : '${var_encryption_path}' -> '${HMP_PATH_LUKSUUID["${var_encryption_path}"]}'"
+    do_log "debug" "file_only" "3220() [HMP_PATH_ENCLABEL] : '${var_encryption_path}' -> '${HMP_PATH_ENCLABEL["${var_encryption_path}"]}'"
 
   done
 

func/partitioning/3240_partition_formatting.sh

@@ -25,22 +25,21 @@ guard_sourcing
 #   0: on success
 #######################################
 partition_formatting() {
-  ### Declare Arrays and Variables.
+  ### Declare Arrays, HashMaps, and Variables.
-  declare -Ag HMP_PATH_FSUUID
+  declare -Ag HMP_PATH_FSUUID        # Used in: 3290() - [Mount Path:Filesystem UUID].
-  declare var_dev var_part \
+                                     # Used in: 4060() - [Mount Path:Filesystem UUID].
-    var_encryption_enable var_encryption_label var_fs_btrfs_checksum var_fs_btrfs_compress var_fs_btrfs_mdup \
+  declare var_dev="" var_part="" \
-    var_fs_format var_fs_label var_fs_options var_fs_version var_mount_path var_node var_fs_uuid
+    var_encryption_enable="" var_encryption_label="" var_fs_btrfs_checksum="" var_fs_btrfs_compress="" var_fs_btrfs_mdup="" \
-  declare -a ary_devs ary_parts ary_opts ary_fmt_opts
+    var_fs_format="" var_fs_label="" var_fs_options="" var_fs_version="" var_mount_path="" var_node="" var_fs_uuid=""
 
-  ### Iterate over all devices in the recipe.
+  declare -a ary_devs=() ary_parts=() ary_opts=() ary_fmt_opts=()
-  # shellcheck disable=SC2312
-  readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
-  for var_dev in "${ary_devs[@]}"; do
 
-    ### Iterate over all partitions for this device.
+  for var_format_path in "${ARY_FORMT_MOUNT_PATHS[@]}"; do
-    # shellcheck disable=SC2312
+
-    readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
+    ### Generates physical device location.
-    for var_part in "${ary_parts[@]}"; do
+    var_dev_part="${HMP_PATH_DEV_PART[${var_format_path}]}"
+
+    ### Extract parameters from YAML.
 
       ### Extract parameters from YAML.
       var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable"         "${VAR_SETUP_PART}")
@@ -76,32 +75,45 @@ partition_formatting() {
         btrfs)
           ary_opts=( -L "${var_fs_label}" -f --csum "${var_fs_btrfs_checksum}" )
           [[ "${var_fs_btrfs_mdup,,}" == "true" ]] && ary_opts+=( -m dup )
+
           mkfs.btrfs "${ary_opts[@]}" "${var_node}"
+
           do_log "debug" "file_only" "3240() [mkfs.btrfs ${ary_opts[*]} ${var_node}]."
           do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'btrfs' options: '${ary_opts[*]}'."
+
           echo "Partition: '${var_node}':" >> "${DIR_LOG}/btrfs.log"
           btrfs filesystem show "${var_node}" >> "${DIR_LOG}/btrfs.log"
+
           var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
-          HMP_PATH_FSUUID["UUID_${var_mount_path}"]="${var_fs_uuid}"
+          ### Gathering information for '/etc/fstab'-generation in 4040().
+          HMP_PATH_FSUUID["${var_mount_path}"]="${var_fs_uuid}"
           ;;
 
         ext4)
           read -r -a ary_fmt_opts <<< "${var_fs_options}"
+
           mkfs.ext4 -L "${var_fs_label}" "${ary_fmt_opts[@]}" "${var_node}"
+
           do_log "debug" "file_only" "3240() [mkfs.ext4 -L ${var_fs_label} ${ary_fmt_opts[*]} ${var_node}]."
           do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'ext4' options: '${ary_fmt_opts[*]}'."
+
           echo "Partition: '${var_node}':" >> "${DIR_LOG}/ext4.log"
           tune2fs -l "${var_node}" >> "${DIR_LOG}/ext4.log"
+
           var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
-          HMP_PATH_FSUUID["UUID_${var_mount_path}"]="${var_fs_uuid}"
+          ### Gathering information for '/etc/fstab'-generation in 4040().
+          HMP_PATH_FSUUID["${var_mount_path}"]="${var_fs_uuid}"
           ;;
 
         fat32)
           mkfs.fat -F 32 -n "${var_fs_label}" "${var_node}"
+
           do_log "debug" "file_only" "3240() [mkfs.fat -F 32 -n ${var_fs_label} ${var_node}]."
           do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'FAT32'."
+
           var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
-          HMP_PATH_FSUUID["UUID_${var_mount_path}"]="${var_fs_uuid}"
+          ### Gathering information for '/etc/fstab'-generation in 4040().
+          HMP_PATH_FSUUID["${var_mount_path}"]="${var_fs_uuid}"
           ;;
 
         *)
@@ -112,7 +124,14 @@ partition_formatting() {
 
     done
 
-  done
+    lsblk -o NAME,MAJ:MIN,FSTYPE,FSVER,SIZE,UUID,MOUNTPOINT,PATH "/dev/${var_dev}" >| "${DIR_LOG}/${var_dev}_overview.log"
+    printf "%b" "${NL}" >> "${DIR_LOG}/${var_dev}_overview.log"
+    lsblk "/dev/${var_dev}" >> "${DIR_LOG}/${var_dev}_overview.log"
+
+
+
+
+
 
   return 0
 }

func/partitioning/3260_setup_filesystem.sh

@@ -24,9 +24,12 @@ guard_sourcing
 #   0: on success
 #######################################
 setup_filesystem() {
-  ### Declare Arrays and Variables.
+  ### Declare Arrays, HashMaps, and Variables.
-  declare -Ag HMP_MOUNTPATH_DEV
+  declare -Ag HMP_MOUNTPATH_DEV  # HMP_MOUNTPATH_DEV["${var_mount_path}"]="${var_node}"
-  declare var_dev var_part var_encryption_enable var_encryption_label var_fs_version var_mount_enable var_mount_path var_node
+
+  declare var_dev="" var_part="" \
+    var_encryption_enable="" var_encryption_label="" var_fs_version="" var_mount_enable="" var_mount_path="" var_node=""
+
   declare -a ary_devs ary_parts
 
   ### Iterate over all devices in the recipe.
@@ -72,10 +75,6 @@ setup_filesystem() {
 
     done
 
-  lsblk -o NAME,MAJ:MIN,FSTYPE,FSVER,SIZE,UUID,MOUNTPOINT,PATH "/dev/${var_dev}" >| "${DIR_LOG}/${var_dev}_overview.log"
-  printf "%b" "${NL}" >> "${DIR_LOG}/${var_dev}_overview.log"
-  lsblk "/dev/${var_dev}" >> "${DIR_LOG}/${var_dev}_overview.log"
-
   done
 
   return 0

func/partitioning/3280_mount_partition.sh

@@ -22,13 +22,13 @@ guard_sourcing
 #######################################
 skip_path() {
   declare -a ary_skip=( "/" "/boot" "/boot/efi" "/recovery" )
-  declare p
+  declare p=""
   for p in "${ary_skip[@]}"; do [[ "$1" == "${p}" ]] && return 0; done
   return 1
 }
 
 #######################################
-# Function to create the mount path and mount the respective device on it.
+# Function to create the mount command, incl. mount path and options, and mount the respective device.
 # Globals:
 #   ERR_MOUNTING_DEV
 #   TARGET
@@ -36,23 +36,45 @@ skip_path() {
 #   1: MOUNT_PATH
 #   2: MOUNT_DEVICE
 #   3: MOUNT_OPTIONS
+# Returns:
+#   0: on success
 #######################################
 mount_with_dir() {
   declare var_mount_path="$1" var_mount_device="$2" var_mount_options="${3:-}"
+  declare -a ary_cmd=(mount)
+
+  if [[ "${var_mount_device}" =~ ^[0-9a-fA-F-]{8,}$ ]]; then
+
+    if [[ -e "/dev/disk/by-uuid/${var_mount_device}" ]]; then
+
+      var_mount_device="/dev/disk/by-uuid/${var_mount_device}"
+
+    else
+
+      do_log "error" "file_only" "3280() FS-UUID for mount path: '${var_mount_device}' not found by '/dev/disk/by-uuid/${var_mount_device}'."
+      return "${ERR_MOUNTING_DEV}"
+
+    fi
+
+  fi
 
   [[ "${var_mount_path}" != "/" ]] && mkdir -p "${TARGET}${var_mount_path}"
 
-  ### Build the command in an array to keep word boundaries intact
+  ### Build the command in an array to keep word boundaries intact.
-  declare -a ary_cmd=(mount)
   [[ -n "${var_mount_options}" ]] && ary_cmd+=("-o" "${var_mount_options}")
   ary_cmd+=("${var_mount_device}" "${TARGET}${var_mount_path}")
 
   safe_exec "${ary_cmd[@]}" "${ERR_MOUNTING_DEV}" || return
+  do_log "debug" "file_only" "3280() [safe_exec ${ary_cmd[*]} ${ERR_MOUNTING_DEV}]."
   do_log "info" "file_only" "3280() Mounted: '${var_mount_device}' on: '${TARGET}${var_mount_path}' (Options='${var_mount_options}')."
+
+  return 0
 }
 
 #######################################
-# Device Path Resolver
+# Device Path Resolver.
+# Outputs '/dev/mapper/<encryption_label>'
+# Outputs '/dev/<dev><partition>'
 # Arguments:
 #   1: Device
 #   2: Partition
@@ -81,7 +103,7 @@ validate_btrfs_compression() {
   declare var_algo="$1" var_level="$2"
   case "${var_algo}:${var_level}" in
     zstd:|zstd:[0-9]|zstd:1[0-9]|zstd:2[0-2]|lzo:) return 0 ;;
-    *) do_log "error" "file_only" "3280() Invalid btrfs compression '${var_algo}:${var_level}'"; return "${ERR_BTRFS_OPTION}" ;;
+    *) do_log "error" "file_only" "3280() Invalid btrfs compression: '${var_algo}:${var_level}'"; return "${ERR_BTRFS_OPTION}" ;;
   esac
 }
 
@@ -96,50 +118,56 @@ validate_btrfs_compression() {
 # Arguments:
 #   None
 # Returns:
+#   0: on success
 #   ERR_BTRFS_INITPH
 #   ERR_BTRFS_OPTION
 #   ERR_BTRFS_SUBVOL
 #   ERR_MOUNTING_DEV
 #   ERR_MOUNTING_ROOT
-#   0: on success
 #######################################
 mount_partition() {
-  ### Mount "/"-filesystem
+  ### Declare Arrays, HashMaps, and Variables.
+  declare -Ag HMP_FSTAB_MOUNT_OPTS   # Used in: 4040() - [Mount Path:Mount Options].
   declare -r var_mount_path_root="/"
 
-  if [[ -n "${HMP_MOUNTPATH_DEV[${var_mount_path_root}]}" ]]; then
+  declare var_path="" var_dev="" var_part="" \
+    var_fs_btrfs_compress="" var_fs_btrfs_level="" var_fs_btrfs_subvolume="" var_fs_btrfs_snapshot="" \
+    var_encryption_enable="" var_encryption_label="" var_fs_options="" var_fs_version="" var_mount_path="" \
+    var_mount_options="" var_snapshot="" var_mount_optsnap="" var_fs_uuid=""
 
-    mount_with_dir "${var_mount_path_root}" "${HMP_MOUNTPATH_DEV[${var_mount_path_root}]}" || return "${ERR_MOUNTING_DEV}"
+  declare -a ary_devs=() ary_parts=()
 
+  ### Mount "/"-filesystem
+  if [[ -n "${HMP_PATH_FSUUID["${var_mount_path_root}"]}" ]]; then
+    mount_with_dir "${var_mount_path_root}" "${HMP_PATH_FSUUID["${var_mount_path_root}"]}" || return "${ERR_MOUNTING_DEV}"
   else
-
+    do_log "error" "file_only" "3280() Root-filesystem '${var_mount_path_root}' not found in Hashmap: 'HMP_PATH_FSUUID'."
-    do_log "error" "file_only" "3280() Root-filesystem '${var_mount_path_root}' not found in Hashmap: 'HMP_MOUNTPATH_DEV'."
     return "${ERR_MOUNTING_ROOT}"
-
   fi
 
+  #if [[ -n "${HMP_MOUNTPATH_DEV[${var_mount_path_root}]}" ]]; then
+  #  mount_with_dir "${var_mount_path_root}" "${HMP_MOUNTPATH_DEV[${var_mount_path_root}]}" || return "${ERR_MOUNTING_DEV}"
+  #else
+  #  do_log "error" "file_only" "3280() Root-filesystem '${var_mount_path_root}' not found in Hashmap: 'HMP_MOUNTPATH_DEV'."
+  #  return "${ERR_MOUNTING_ROOT}"
+  #fi
+
   ### Ensure order of "/boot" and "/boot/efi"
-  declare var_path
-
   for var_path in "/boot" "/boot/efi"; do
-
+    if [[ -n "${HMP_PATH_FSUUID["${var_path}"]}" ]]; then
-    if [[ -n "${HMP_MOUNTPATH_DEV[${var_path}]}" ]]; then
+      mount_with_dir "${var_path}" "${HMP_PATH_FSUUID["${var_path}"]}" || return "${ERR_MOUNTING_DEV}"
-
-      mount_with_dir "${var_path}" "${HMP_MOUNTPATH_DEV[${var_path}]}" || return "${ERR_MOUNTING_DEV}"
-
     else
-
+      do_log "info" "file_only" "3280() Entry '${var_path}' not found in Hashmap: 'HMP_PATH_FSUUID'."
-      do_log "info" "file_only" "3280() Entry '${var_path}' not found in Hashmap: 'HMP_MOUNTPATH_DEV'."
-
     fi
-
   done
 
-  declare var_dev var_part \
+  #for var_path in "/boot" "/boot/efi"; do
-    var_fs_btrfs_compress var_fs_btrfs_level var_fs_btrfs_subvolume var_fs_btrfs_snapshot \
+  #  if [[ -n "${HMP_MOUNTPATH_DEV[${var_path}]}" ]]; then
-    var_encryption_enable var_encryption_label \
+  #    mount_with_dir "${var_path}" "${HMP_MOUNTPATH_DEV[${var_path}]}" || return "${ERR_MOUNTING_DEV}"
-    var_fs_label var_fs_options var_fs_version var_mount_path var_mount_options var_snapshot var_mount_optsnap
+  #  else
-  declare -a ary_devs ary_parts
+  #    do_log "info" "file_only" "3280() Entry '${var_path}' not found in Hashmap: 'HMP_MOUNTPATH_DEV'."
+  #  fi
+  #done
 
   ### Iterate over all devices in the recipe.
   # shellcheck disable=SC2312
@@ -166,14 +194,16 @@ mount_partition() {
       skip_path "${var_mount_path}" && continue
 
       var_encryption_label=$(get_label "${var_mount_path}" "${var_fs_version}" "luks")
+      var_fs_uuid="${HMP_PATH_FSUUID["${var_path}"]}"
 
-      if [[ "${var_mount_path}" == "SWAP" ]]; then
+      if [[ "${var_mount_path,,}" == "swap" ]]; then
 
-        var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
+        #var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
 
         cryptsetup open --type plain --key-file /dev/random \
           --offset 2048 --cipher aes-xts-plain64 --key-size 512 \
-          --sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
+          --sector-size 4096 "/dev/disk/by-uuid/${var_fs_uuid}" "${var_encryption_label}"
+          #--sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
 
         mkswap "/dev/mapper/${var_encryption_label}"
         do_log "debug" "file_only" "3280() [mkswap /dev/mapper/${var_encryption_label}]."
@@ -184,27 +214,16 @@ mount_partition() {
 
         continue
 
-      elif [[ "${var_mount_path}" == "/tmp" ]]; then
+      elif [[ "${var_mount_path,,}" == "/tmp" ]]; then
-
-        var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
 
         cryptsetup open --type plain --key-file /dev/random \
           --offset 2048 --cipher aes-xts-plain64 --key-size 512 \
-          --sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
+          --sector-size 4096 "/dev/disk/by-uuid/${var_fs_uuid}" "${var_encryption_label}"
 
         mkdir -p "${TARGET}/tmp"
 
-        # TODO: Remove Debug
-        #[[ -b "/dev/mapper/${var_encryption_label}" ]] || {
-        #  do_log "error" "file_only" "Mapper-Device: '/dev/mapper/${var_encryption_label}' non-existing."
-        #}
-
-        #echo "lsblk -o NAME,SIZE,TYPE,FSTYPE,LABEL /dev/mapper/${var_encryption_label}"
-        #lsblk -o NAME,SIZE,TYPE,FSTYPE,LABEL /dev/mapper/"${var_encryption_label}"
-
         echo "safe_exec mkfs.ext4 -E nodiscard,lazy_itable_init=1,lazy_journal_init=1 /dev/mapper/${var_encryption_label} ${ERR_MOUNTING_DEV}"
         safe_exec mkfs.ext4 -E nodiscard,lazy_itable_init=1,lazy_journal_init=1 "/dev/mapper/${var_encryption_label}" "${ERR_MOUNTING_DEV}" || return "${ERR_MOUNTING_DEV}"
-        # TODO: Remove Debug
 
         ### Build the command in an array to keep word boundaries intact
         declare -a ary_cmd2=(mount)
@@ -218,15 +237,14 @@ mount_partition() {
 
       fi
 
-      declare var_resolved_dev
+      #var_resolved_dev=$(resolve_device "${var_dev}" "${var_part}" "${var_encryption_enable}" "${var_encryption_label}")
-      var_resolved_dev=$(resolve_device "${var_dev}" "${var_part}" "${var_encryption_enable}" "${var_encryption_label}")
 
       if [[ "${var_fs_version,,}" == "btrfs" ]]; then
 
         var_fs_btrfs_subvolume=$(get_label "${var_mount_path}" "${var_fs_version}" "sub")
 
         ### Mount toplevel (subvolid=0) without extra options.
-        declare -a ary_cmd_mount=(mount -o "subvolid=0" "${var_resolved_dev}" "${VAR_SAFE_MNT_BASE}")
+        declare -a ary_cmd_mount=(mount -o "subvolid=0" "${var_fs_uuid}" "${VAR_SAFE_MNT_BASE}")
         safe_exec "${ary_cmd_mount[@]}" "${ERR_BTRFS_INITPH}" || return "${ERR_BTRFS_INITPH}"
 
         btrfs subvolume create "${VAR_SAFE_MNT_BASE}/${var_fs_btrfs_subvolume}"
@@ -257,26 +275,34 @@ mount_partition() {
 
           [[ -n "${var_mount_options}" ]] && var_btrfs_compression_options+=",${var_mount_options},subvol=${var_fs_btrfs_subvolume}"
 
-          mount_with_dir "${var_mount_path}" "${var_resolved_dev}" "${var_btrfs_compression_options}" || return "${ERR_MOUNTING_DEV}"
+          ### Gathering information for '/etc/fstab'-generation in 4040().
+          HMP_FSTAB_MOUNT_OPTS["${var_mount_path}"]="${var_btrfs_compression_options[*]}"
+          do_log "debug" "file_only" "3280() Stored in HashMap [HMP_FSTAB_MOUNT_OPTS]  : '${var_mount_path}' -> '${HMP_FSTAB_MOUNT_OPTS["${var_mount_path}"]}'."
+
+          mount_with_dir "${var_mount_path}" "${var_fs_uuid}" "${var_btrfs_compression_options}" || return "${ERR_MOUNTING_DEV}"
 
           if [[ "${var_fs_btrfs_snapshot}" == "true" ]]; then
 
+            ### Preparing "/.snapshot"-directory
             mkdir -p "${TARGET}${var_mount_path}/.snapshots"
-
             do_log "info" "file_only" "3280() Created: '${TARGET}${var_mount_path}/.snapshots'."
 
             var_mount_optsnap="${var_mount_optsnap},subvol=${var_snapshot}"
 
-            mount_with_dir "${var_mount_path}/.snapshots" "${var_resolved_dev}" "${var_mount_optsnap}"
+            ### Gathering information for '/etc/fstab'-generation in 4040().
+            HMP_FSTAB_MOUNT_OPTS["${var_mount_path}/.snapshots"]="${var_mount_optsnap[*]}"
+            do_log "debug" "file_only" "3280() Stored in HashMap [HMP_FSTAB_MOUNT_OPTS]  : '${var_mount_path}/.snapshots' -> '${HMP_FSTAB_MOUNT_OPTS["${var_mount_path}/.snapshots"]}'."
 
-            do_log "info" "file_only" "3280() Mounted: '${var_resolved_dev}' on: '${TARGET}${var_mount_path}/.snapshots' (Options='${var_mount_optsnap}')."
+            mount_with_dir "${var_mount_path}/.snapshots" "${var_fs_uuid}" "${var_mount_optsnap}"
+
+            do_log "info" "file_only" "3280() Mounted: '${var_fs_uuid}' on: '${TARGET}${var_mount_path}/.snapshots' (Options='${var_mount_optsnap}')."
 
           fi
           ;;
 
         ext4:*)
 
-          mount_with_dir "${var_mount_path}" "${var_resolved_dev}" "${var_mount_options}" || return "${ERR_MOUNTING_DEV}"
+          mount_with_dir "${var_mount_path}" "${var_fs_uuid}" "${var_mount_options}" || return "${ERR_MOUNTING_DEV}"
           ;;
 
         *) do_log "error" "file_only" "3280() Unsupported fs/encryption combination."

func/partitioning/3290_uuid_logger.sh

@@ -15,8 +15,8 @@ guard_sourcing
 #######################################
 # Logger for all generated partition, LUKS container and file system UUIDs.
 # Globals:
-#   HMP_PATH_ENCLABEL
 #   HMP_PATH_FSUUID
+#   HMP_PATH_LUKSUUID
 #   HMP_PATH_PARTUUID
 #   LOG_UID
 # Arguments:
@@ -29,8 +29,7 @@ uuid_logger() {
 
   printf 'PARTITION UUID Partition:\n' >> "${LOG_UID}"
   for var_key in "${!HMP_PATH_PARTUUID[@]}"; do
-    ### Remove Prefix "PARTUUID_"
+    var_mountpoint="${var_key}"
-    var_mountpoint="${var_key#PARTUUID_}"
     var_uuid="${HMP_PATH_PARTUUID[${var_key}]}"
     ### Left-aligned field width 63; "UUID=" starts directly after column 64.
     printf '%-63sUUID=%s\n' "${var_mountpoint}" "${var_uuid}" >> "${LOG_UID}"
@@ -39,8 +38,7 @@ uuid_logger() {
   printf '\n' >> "${LOG_UID}"
   printf 'LUKS CONTAINER UUID:\n' >> "${LOG_UID}"
   for var_key in "${!HMP_PATH_LUKSUUID[@]}"; do
-    ### Remove Prefix "PARTUUID_"
+    var_mountpoint="${var_key}"
-    var_mountpoint="${var_key#UUID_}"
     var_uuid="${HMP_PATH_LUKSUUID[${var_key}]}"
     ### Left-aligned field width 63; "UUID=" starts directly after column 64.
     printf '%-63sUUID=%s\n' "${var_mountpoint}" "${var_uuid}" >> "${LOG_UID}"
@@ -49,8 +47,7 @@ uuid_logger() {
   printf '\n' >> "${LOG_UID}"
   printf 'FILESYSTEM UUID:\n' >> "${LOG_UID}"
   for var_key in "${!HMP_PATH_FSUUID[@]}"; do
-    ### Remove Prefix "UUID_"
+    var_mountpoint="${var_key}"
-    var_mountpoint="${var_key#UUID_}"
     var_uuid="${HMP_PATH_FSUUID[${var_key}]}"
     ### Left-aligned field width 63; "UUID=" starts directly after column 64.
     printf '%-63sUUID=%s\n' "${var_mountpoint}" "${var_uuid}" >> "${LOG_UID}"

func/partitioning/3295_get_label.sh

@@ -18,13 +18,13 @@ guard_sourcing
 #   None
 # Arguments:
 #   1: Mount path (e.g., '/' '/boot' '/var/log/audit' 'SWAP' '/boot/efi')
-#   2: Filesystem type: one of: [BIOS, btrfs ext4 fat32, swap]
+#   2: Filesystem type: one of: [BIOS, btrfs, ext4, fat32, swap]
 #   3: Desired return label: one of: [part, luks, file, sub, snap]
 # Returns:
 #   Prints resulting label to stdout.
 #######################################
 get_label() {
-  declare -r var_path="${1}"
+  declare -r var_path="${1,,}"
   declare -r var_file="${2,,}"
   declare -r var_kind="${3,,}"
 
@@ -40,7 +40,7 @@ get_label() {
 
       case "${var_path}" in
 
-        SWAP)                var_return_label="part_ephem_swap" ;;
+        swap)                var_return_label="part_ephem_swap" ;;
         /tmp)                var_return_label="part_ephem_tmp" ;;
         /boot/efi)           var_return_label="part_esp" ;;
         /)                   var_return_label="part_root" ;;
@@ -54,7 +54,7 @@ get_label() {
       case "${var_path}" in
 
         /tmp)                var_return_label="crypt_ephem_tmp" ;;
-        SWAP)                var_return_label="crypt_ephem_swap" ;;
+        swap)                var_return_label="crypt_ephem_swap" ;;
         /boot/efi)           var_return_label="" ;;
         /)                   var_return_label="crypt_root" ;;
         *)                   var_return_label="crypt_${var_normalized}" ;;
@@ -66,7 +66,7 @@ get_label() {
 
       case "${var_path}:${var_file}" in
 
-        SWAP:*)              var_return_label="host_swap" ;;
+        swap:*)              var_return_label="host_swap" ;;
         /tmp:*)              var_return_label="host_tmp" ;;
         /boot/efi:*)         var_return_label="ESP" ;;
         /var/log/audit:ext4) var_return_label="ext4_var_audit" ;;

func/system/4040_generate_fstab.sh

@@ -13,7 +13,7 @@
 guard_sourcing
 
 #######################################
-# '/etc/fstab' entry writer and logger.
+# Wrapper to write '/etc/fstab' entries.
 # Globals:
 #   TARGET
 # Arguments:
@@ -26,9 +26,9 @@ guard_sourcing
 #   0: on success
 #######################################
 write_fstab() {
-  declare _uuid="$1" _path="$2" _fs="$3" _opts="$4" _pass="$5"
+  declare write_uuid="$1" write_path="$2" write_type="$3" write_opts="$4" write_pass="$5"
-  printf "%-43s%-28s%-8s%-74s0 %s\n" "UUID=${_uuid}" "${_path}" "${_fs}" "${_opts}" "${_pass}" >> "${TARGET}/etc/fstab"
+  printf "%-43s%-28s%-8s%-74s0 %s\n" "UUID=${write_uuid}" "${write_path}" "${write_type}" "${write_opts}" "${write_pass}" >> "${TARGET}/etc/fstab"
-  do_log "info" "file_only" "4040() fstab entry generated: [UUID=${_uuid}    ${_path}    ${_fs}    ${_opts}    0 ${_pass}]."
+  do_log "info" "file_only" "4040() fstab entry generated: [UUID=${write_uuid}    ${write_path}    ${write_type}    ${write_opts}    0 ${write_pass}]."
   return 0
 }
 
@@ -63,7 +63,7 @@ generate_fstab() {
 # SPDX-PackageName: CISS.debian.installer
 # SPDX-Security-Contact: security@coresecret.eu
 
-# /etc/fstab: static file system information.
+# Static file system information '/etc/fstab'.
 #
 # Use 'blkid' to print the universally unique identifier for a device; this may be used with [UUID=] as a more robust way to
 # name devices that work even if disks are added and removed. See fstab(5).
@@ -71,7 +71,7 @@ generate_fstab() {
 # 'systemd' generates mount units based on this file. See systemd.mount(5). Please run 'systemctl daemon-reload' after making
 # changes here.
 #
-# <file system>                            <mount point>  <type>       <options>                                  <dump>  <pass>
+# <file system UUID>                       <mount point>               <type>  <options>                                                                 <dump> <pass>
 
 
 ### Secure tmpfs mounts for a hardened system
@@ -91,8 +91,20 @@ EOF
 
   ### Generate '${TARGET}/etc/fstab' special entries '/' '/boot' '/boot/efi'.
   ### Define the order of the special paths.
-  declare -a ary_path_order; ary_path_order=("/" "/boot" "/boot/efi")
+  declare -a ary_path_order=("/" "/boot" "/boot/efi")
   declare -a ary_skip=("/" "/boot" "/boot/efi" "/recovery")
+  declare var_path="" var_fs_uuid="" var_fs_path="" var_fs_type="" var_fs_opts=""
+
+  for var_path in "${ary_path_order[@]}"; do
+
+    var_fs_uuid="${HMP_PATH_FSUUID["${var_path}"]}"
+    var_fs_path="${var_path}"
+    var_fs_type="${HMP_FSTAB_MOUNT_FTYPE["${var_path}"]}"
+    var_fs_opts="${HMP_FSTAB_MOUNT_OPTS["${var_path}"]}"
+
+
+  done
+
   declare var_path var_entry var_part var_dev var_key var_uuid var_fs_btrfs_compress var_fs_btrfs_level var_fs_btrfs_subvolume \
     var_fs_version var_mount_options var_mount_optsnap var_btrfs_compression
 
@@ -104,6 +116,9 @@ EOF
       continue
     fi
 
+
+
+
     var_part=$(echo "${var_entry}" | yq e 'path | .[-2]' -)
     var_dev=$(echo "${var_entry}" | yq e 'path | .[-3]' -)
     var_key="UUID_${var_path}"
@@ -154,6 +169,10 @@ EOF
 
   done
 
+
+  for var_path in "${ARY_FSTAB_MOUNT_PATHS[@]}"; do
+    :
+  done
   ### Generate '${TARGET}/etc/fstab' remaining entries.
   for var_path in "${!MAP_MOUNTPATH_DEV[@]}"; do
 

func/system/4150_setup_grub.sh

@@ -204,7 +204,7 @@ EOF
 # Detects and collects all boot devices for GRUB installation.
 # Supports /dev/sdX, /dev/vdX, /dev/hdX, /dev/nvmeXn1, /dev/mmcblkX.
 # Globals:
-#   VAR_RECIPE_DEV_COUNTER
+#   VAR_RECIPE_HIGHEST_DEVICE
 #   ary_bootdev_all
 #   grub_bootdev
 # Arguments:
@@ -223,7 +223,7 @@ get_all_boot_devs() {
   case "${dev_prefix}" in
     sd|vd|hd)
       ascii_start=$(printf '%d' "'a")
-      ascii_end=$(printf '%d' "'${VAR_RECIPE_DEV_COUNTER}")
+      ascii_end=$(printf '%d' "'${VAR_RECIPE_HIGHEST_DEVICE}")
       for ((ascii = ascii_start; ascii <= ascii_end; ascii++)); do
         letter=$(printf "%b" "\\$(printf '%03o' "${ascii}")")
         dev_path="/dev/${dev_prefix}${letter}"

lib/0025_logging_modules.sh

@@ -15,7 +15,7 @@ guard_sourcing
 #######################################
 # Log level values for comparison.
 # Arguments:
-#   1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
+#   1: LOG_LEVEL: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
 #######################################
 log_level_value() {
   case "${1,,}" in
@@ -35,7 +35,7 @@ log_level_value() {
 # Globals:
 #   VAR_DEFAULT_LOG_LEVEL
 # Arguments:
-#   1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
+#   1: LOG_LEVEL: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
 #######################################
 do_should_log() {
   # shellcheck disable=SC2155
@@ -56,7 +56,7 @@ do_should_log() {
 #   WHI
 #   YEL
 # Arguments:
-#   1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
+#   1: LOG_LEVEL: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
 #######################################
 do_get_log_color() {
   case "${1,,}" in
@@ -75,9 +75,9 @@ do_get_log_color() {
 #   LOG_ERR
 #   LOG_INS
 # Arguments:
-#   1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
+#   1: LOG_LEVEL: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
-#   2: "${LOG_ONLY}"  one of: "file_only" | "tty"
+#   2: LOG_ONLY: "file_only" | "tty"
-#   *: "${*}" arbitrary text string to log.
+#   *: Arbitrary text string to log.
 #######################################
 do_log() {
   ### Reading arguments.
@@ -86,9 +86,22 @@ do_log() {
   declare var_msg_string="${*}"
 
   ### Declare variables.
+  declare log_uniform=""
   declare var_color; var_color=$(do_get_log_color "${var_log_level}")
   declare var_ts; var_ts="$(date -u '+%Y-%m-%dT%H:%M:%S.%4N%z')"
-  declare var_log_entry=("${var_ts} [${var_log_level}]: ${var_msg_string}")
+
+  case "${var_log_level,,}" in
+    debug)     log_uniform="[DEBUG]    ";;
+    info)      log_uniform="[INFO]     ";;
+    notice)    log_uniform="[NOTICE]   ";;
+    warn)      log_uniform="[WARNING]  ";;
+    error)     log_uniform="[ERROR]    ";;
+    critical)  log_uniform="[CRITICAL] ";;
+    fatal)     log_uniform="[FATAL]    ";;
+    emergency) log_uniform="[EMERGENCY]";;
+  esac
+
+  declare var_log_entry=("${var_ts} ${log_uniform}: ${var_msg_string}")
 
   if do_should_log "${var_log_level}"; then
     if [[ "${var_log_only,,}" == "file_only" ]]; then