V8.13.392.2025.11.07

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

lib/lib_arg_parser.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Argument Parser.

lib/lib_arg_priority_check.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Check and setup Script Priorities

lib/lib_boot_screen.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Set up a gauge Dialog Wrapper.

lib/lib_cdi.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # CISS.debian.installer 'GRUB' and 'autostart' generator.

lib/lib_change_splash.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Change Grub Boot Screen Splash

lib/lib_check_dhcp.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Check if hardened Centurion DNS servers are desired.

lib/lib_check_hooks.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Check and apply 0755 Permissions on every '"${VAR_HANDLER_BUILD_DIR}"/./config/hooks/live/*.chroot'-file.

lib/lib_check_kernel.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Kernel Image Selector

lib/lib_check_pkgs.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Check for required Deb Packages to run the script.
@@ -43,18 +43,8 @@ check_pkgs() {
 
   if ! command -v debootstrap >/dev/null 2>&1; then
 
-    if grep -RqsE '^[[:space:]]*deb .*backports' /etc/apt/sources.list /etc/apt/sources.list.d; then
-
-      # shellcheck disable=SC2155
-      declare codename=$(lsb_release -sc)
-      apt-get install -y -t "${codename}-backports" debootstrap
-
-    else
-
       apt-get install -y debootstrap
 
-    fi
-
   fi
 
   if [[ ! -f /usr/share/live/build/VERSION ]]; then

lib/lib_check_provider.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Notes Textbox.

lib/lib_check_stats.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Check if analysis run is desired only.

lib/lib_check_var.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Unbound variable check and call trap on 'ERR'.

lib/lib_ciss_upgrades_boot.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Integrates primordial SSH identity- and / or ssh_host-files.

lib/lib_ciss_upgrades_build.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Module to update '/usr/lib/live/build/...' scripts.

lib/lib_clean_screen.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Terminal cleaner before Trap on Error

lib/lib_clean_up.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Cleanup wrapper on the traps on 'ERR' and 'EXIT'.

lib/lib_copy_integrity.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Copy Initial ISO aide Database into Host System

lib/lib_debug.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Debugger module for xtrace to debug log.

lib/lib_debug_header.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Generates the debug log header.

lib/lib_gnupg.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Init GNUPGHOME.
@@ -51,8 +51,20 @@ init_gnupg() {
       # shellcheck disable=SC2174
       mkdir -p -m 0700 "${GNUPGHOME}"
 
-      echo 'allow-loopback-pinentry' >| "${GNUPGHOME}/gpg-agent.conf"
-      gpgconf --reload gpg-agent || true
+      cat << EOF >> "${GNUPGHOME}/gpg-agent.conf"
+allow-loopback-pinentry
+pinentry-program /usr/bin/pinentry-tty
+EOF
+
+      gpgconf --kill gpg-agent || true
+
+      if ! gpgconf --launch gpg-agent >/dev/null 2>&1; then
+
+        printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ Failed to launch gpg-agent. \e[0m\n"
+        umask "${__umask}"
+        return "${ERR_GPG__AGENT}"
+
+      fi
 
     else
 
@@ -60,14 +72,11 @@ init_gnupg() {
 
     fi
 
-    gpg --batch --import "${VAR_TMP_SECRET}/${VAR_SIGNING_KEY}"
-    shred -fzu -n 5 -- "${VAR_TMP_SECRET}/${VAR_SIGNING_KEY}"
-
-    gpg --batch --export "${VAR_SIGNING_KEY_FPR}" >| "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/etc/ciss/keys/${VAR_SIGNING_KEY_FPR}_public.gpg"
-    gpg --batch --export "${VAR_SIGNING_KEY_FPR}" >| "${VAR_HANDLER_BUILD_DIR}/config/includes.binary/0030-verify-checksums_public.gpg"
-
+    ### Use pubring as verification keyring reference.
     declare -grx VAR_VERIFY_KEYRING="${GNUPGHOME}/pubring.kbx"
+
     declare -grx VAR_SIGNING_KEY_PASSFILE="${VAR_TMP_SECRET}/${VAR_SIGNING_KEY_PASS}"
+
     ### No tracing for security reasons ------------------------------------------------------------------------------------------
     [[ "${VAR_EARLY_DEBUG}" == "true" ]] && set +x
 
@@ -78,6 +87,20 @@ init_gnupg() {
     ### Turn on tracing again ----------------------------------------------------------------------------------------------------
     [[ "${VAR_EARLY_DEBUG}" == "true" ]] && set -x
 
+    if ! gpg --batch --yes --pinentry-mode=loopback --passphrase-file "${VAR_SIGNING_KEY_PASSFILE}" --import "${VAR_TMP_SECRET}/${VAR_SIGNING_KEY}"; then
+
+      printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ Failed to import signing key. \e[0m\n"
+      umask "${__umask}"
+      return "${ERR_GPG__AGENT}"
+
+    fi
+
+    shred -fzu -n 5 -- "${VAR_TMP_SECRET}/${VAR_SIGNING_KEY}"
+
+    ### Export public key for verification inside ISO / chroot.
+    gpg --batch --yes --export "${VAR_SIGNING_KEY_FPR}" >| "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/etc/ciss/keys/${VAR_SIGNING_KEY_FPR}_public.gpg"
+    gpg --batch --yes --export "${VAR_SIGNING_KEY_FPR}" >| "${VAR_HANDLER_BUILD_DIR}/config/includes.binary/0030-verify-checksums_public.gpg"
+
     umask "${__umask}"
     __umask=""
 

lib/lib_hardening_root_pw.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Updates the Live ISO to use root password authentication for local console access.

lib/lib_hardening_ssh_tcp.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # SSH hardening via TCP wrapper.

lib/lib_hardening_ultra.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Module for accompanying all 'CISS.debian.hardening' features into the Live ISO image.

lib/lib_helper_ip.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # IP notation cleaner for pure IP output only.

lib/lib_lb_build_start.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Wrapper to write a new 'lb config' environment.

lib/lib_lb_config_start.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Wrapper for 'lb config' - set up a build environment or deleting old build artifacts.

lib/lib_lb_config_write_trixie.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Wrapper to write a new 'lb config' environment.

lib/lib_note_target.sh

@@ -15,13 +15,13 @@
 # Globals:
 #   BASH_SOURCE
 #   SOURCE_DATE_EPOCH
-#   VAR_BASH_VER
+#   VAR_VER_BASH
 #   VAR_DATE_INFO
-#   VAR_DS_VER
+#   VAR_VER_DS
 #   VAR_GIT_REL
 #   VAR_HANDLER_BUILD_DIR
 #   VAR_HOST
-#   VAR_LB_VER
+#   VAR_VER_LB
 #   VAR_VERSION
 # Arguments:
 #   None
@@ -43,9 +43,9 @@ note_target() {
   Epoch       : ${SOURCE_DATE_EPOCH}
   Date        : ${VAR_DATE_INFO}
   Host        : ${VAR_HOST}
-  Bash        : ${VAR_BASH_VER}
-  Debootstrap : ${VAR_DS_VER}
-  Live-Build  : ${VAR_LB_VER}
+  Bash        : ${VAR_VER_BASH}
+  Debootstrap : ${VAR_VER_DS}
+  Live-Build  : ${VAR_VER_LB}
 
   This program is free software. Distribution and modification under
   EUPL-1.2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
@@ -70,9 +70,9 @@ export CDLB_VERSION="${VAR_VERSION}"
 export CDLB_GIT_REL="${VAR_GIT_REL}"
 export CDLB_CR_DATE="${VAR_DATE_INFO}"
 export CDLB_CR_HOST="${VAR_HOST}"
-export CDLB_BASHVER="${VAR_BASH_VER}"
-export CDLB_DS_VER="${VAR_DS_VER}"
-export CDLB_LB_VER="${VAR_LB_VER}"
+export CDLB_BASHVER="${VAR_VER_BASH}"
+export CDLB_DS_VER="${VAR_VER_DS}"
+export CDLB_LB_VER="${VAR_VER_LB}"
 export CDLB_SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH}"
 EOF
   chmod 0444 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/ciss-debian-live-builder.env"

lib/lib_primordial.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Integrate primordial SSH identity files.

lib/lib_provider_netcup.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Module for Netcup static IPv6 address.

lib/lib_run_analysis.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Wrapper for statistic functions of the final build.

lib/lib_sanitizer.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Arguments check wrapper.

lib/lib_trap_on_err.sh

@@ -10,42 +10,50 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Print Error Message for Trap on 'ERR' in ${ERROR_LOG}
 # Globals:
+#   BASHOPTS
+#   EPOCHREALTIME
 #   ERRCMMD
 #   ERRCODE
 #   ERRFUNC
 #   ERRLINE
 #   ERRSCRT
+#   EUID
 #   LOG_DEBUG
 #   LOG_ERROR
 #   LOG_VAR
 #   SECONDS
+#   SHELLOPTS
+#   UID
 #   VAR_ARG_SANITIZED
-#   VAR_BASH_VER
-#   VAR_DS_VER
 #   VAR_EARLY_DEBUG
 #   VAR_GIT_REL
-#   VAR_LB_VER
 #   VAR_PARAM_COUNT
 #   VAR_PARAM_STRNG
 #   VAR_SYSTEM
 #   VAR_VERSION
+#   VAR_VER_BASH
+#   VAR_VER_DS
+#   VAR_VER_LB
 # Arguments:
 #   None
 #######################################
 print_file_err() {
   {
-    printf "❌ CISS.debian.live.builder Script failed. \n"
+    printf "❌ Trap on 'ERR'          : CISS.debian.live.builder Script failed. \n"
     printf "❌ Git Commit             : %s \n" "${VAR_GIT_REL}"
     printf "❌ Version                : %s \n" "${VAR_VERSION}"
+    printf "❌ Epoch                  : %s \n" "${EPOCHREALTIME}"
+    printf "❌ Bash                   : %s \n" "${VAR_VER_BASH}"
+    printf "❌ Live-Build             : %s \n" "${VAR_VER_LB}"
+    printf "❌ Debootstrap            : %s \n" "${VAR_VER_DS}"
+    printf "❌ UID                    : %s \n" "${UID}"
+    printf "❌ EUID                   : %s \n" "${EUID}"
     printf "❌ Hostsystem             : %s \n" "${VAR_SYSTEM}"
-    printf "❌ Bash                   : %s \n" "${VAR_BASH_VER}"
-    printf "❌ Live-Build             : %s \n" "${VAR_LB_VER}"
-    printf "❌ Debootstrap            : %s \n" "${VAR_DS_VER}"
     printf "❌ Error                  : %s \n" "${ERRCODE}"
     printf "❌ Line                   : %s \n" "${ERRLINE}"
     printf "❌ Script                 : %s \n" "${ERRSCRT}"
@@ -55,6 +63,8 @@ print_file_err() {
     printf "❌ Arguments Counter      : %s \n" "${VAR_PARAM_COUNT}"
     printf "❌ Arguments Original     : %s \n" "${VAR_PARAM_STRNG}"
     printf "❌ Arguments Sanitized    : %s \n" "${VAR_ARG_SANITIZED}"
+    printf "❌ Bashopts               : %s \n" "${BASHOPTS}"
+    printf "❌ Shellopts              : %s \n" "${SHELLOPTS}"
 
     if "${VAR_EARLY_DEBUG}"; then
 
@@ -72,7 +82,7 @@ print_file_err() {
 readonly -f print_file_err
 
 #######################################
-# Print Error Message for Trap on 'ERR' on Terminal
+# Print Error Message for Trap on 'ERR' on Terminal.
 # Globals:
 #   ERRCMMD
 #   ERRCODE
@@ -84,26 +94,29 @@ readonly -f print_file_err
 #   LOG_VAR
 #   SECONDS
 #   VAR_ARG_SANITIZED
-#   VAR_BASH_VER
-#   VAR_DS_VER
 #   VAR_EARLY_DEBUG
 #   VAR_GIT_REL
-#   VAR_LB_VER
 #   VAR_PARAM_COUNT
 #   VAR_PARAM_STRNG
 #   VAR_SYSTEM
 #   VAR_VERSION
+#   VAR_VER_BASH
+#   VAR_VER_DS
+#   VAR_VER_LB
 # Arguments:
 #   None
 #######################################
 print_scr_err() {
-  printf "\e[91m❌ CISS.debian.live.builder Script failed. \e[0m\n" >&2
+  printf "\e[91m❌ Trap on 'ERR'          : CISS.debian.live.builder Script failed. \e[0m\n" >&2
   printf "\e[91m❌ Git Commit             : %s \e[0m\n" "${VAR_GIT_REL}" >&2
   printf "\e[91m❌ Version                : %s \e[0m\n" "${VAR_VERSION}" >&2
+  printf "\e[91m❌ Epoch                  : %s \e[0m\n" "${EPOCHREALTIME}" >&2
+  printf "\e[91m❌ Bash                   : %s \e[0m\n" "${VAR_VER_BASH}" >&2
+  printf "\e[91m❌ Live-Build             : %s \e[0m\n" "${VAR_VER_LB}" >&2
+  printf "\e[91m❌ Debootstrap            : %s \e[0m\n" "${VAR_VER_DS}" >&2
+  printf "\e[91m❌ UID                    : %s \e[0m\n" "${UID}" >&2
+  printf "\e[91m❌ EUID                   : %s \e[0m\n" "${EUID}" >&2
   printf "\e[91m❌ Hostsystem             : %s \e[0m\n" "${VAR_SYSTEM}" >&2
-  printf "\e[91m❌ Bash                   : %s \e[0m\n" "${VAR_BASH_VER}" >&2
-  printf "\e[91m❌ Live-Build             : %s \e[0m\n" "${VAR_LB_VER}" >&2
-  printf "\e[91m❌ Debootstrap            : %s \e[0m\n" "${VAR_DS_VER}" >&2
   printf "\e[91m❌ Error                  : %s \e[0m\n" "${ERRCODE}" >&2
   printf "\e[91m❌ Line                   : %s \e[0m\n" "${ERRLINE}" >&2
   printf "\e[91m❌ Script                 : %s \e[0m\n" "${ERRSCRT}" >&2
@@ -113,6 +126,8 @@ print_scr_err() {
   printf "\e[91m❌ Arguments Counter      : %s \e[0m\n" "${VAR_PARAM_COUNT}" >&2
   printf "\e[91m❌ Arguments Original     : %s \e[0m\n" "${VAR_PARAM_STRNG}" >&2
   printf "\e[91m❌ Arguments Sanitized    : %s \e[0m\n" "${VAR_ARG_SANITIZED}" >&2
+  printf "\e[91m❌ Bashopts               : %s \e[0m\n" "${BASHOPTS}" >&2
+  printf "\e[91m❌ Shellopts              : %s \e[0m\n" "${SHELLOPTS}" >&2
   printf "\e[91m❌ Error Log saved at     : %s \e[0m\n" "${LOG_ERROR}" >&2
   printf "\e[91m❌ batcat --pager='less -r' %s \e[0m\n" "${LOG_ERROR}" >&2
 
@@ -124,7 +139,8 @@ print_scr_err() {
 
   fi
 
-  printf "\n"
+  print_stacktrace
+  printf "%b" "${NL}"
 }
 ### Prevents accidental 'unset -f'.
 # shellcheck disable=SC2034
@@ -216,4 +232,49 @@ dump_user_vars() {
 ### Prevents accidental 'unset -f'.
 # shellcheck disable=SC2034
 readonly -f dump_user_vars
+
+#######################################
+# Print function() stacktrace.
+# Globals:
+#   BASH_LINENO
+#   BASH_SOURCE
+#   FUNCNAME
+#   LINENO
+#   LOG_ERROR
+#   NL
+#   RED
+#   RES
+# Arguments:
+#   None
+#######################################
+print_stacktrace() {
+  declare -i i=0
+
+  printf "%b❌ %b%b" "${RED}" "${RES}" "${NL}"
+  printf "❌ %b" "${NL}" >> "${LOG_ERROR}"
+
+  printf "%b❌ Raw Stacktrace         : %b%b" "${RED}" "${RES}" "${NL}"
+  printf "❌ Raw Stacktrace         : %b" "${NL}" >> "${LOG_ERROR}"
+
+  for ((i=0; i<${#FUNCNAME[@]}-1; i++)); do
+
+    if (( i == 0 )); then
+
+      printf "%b❌   ➥ %s() at: [%s:%s] %b%b" "${RED}" "${FUNCNAME[i]}" "${BASH_SOURCE[i]}" "${LINENO:-?}" "${RES}" "${NL}"
+      printf "❌   ➥ %s() at: [%s:%s] %b" "${FUNCNAME[i]}" "${BASH_SOURCE[i]}" "${LINENO:-?}" "${NL}" >> "${LOG_ERROR}"
+
+    else
+
+      printf "%b❌   ➥ %s() at: [%s:%s] %b%b" "${RED}" "${FUNCNAME[i]}" "${BASH_SOURCE[i]}" "${BASH_LINENO[i-1]:-?}" "${RES}" "${NL}"
+      printf "❌   ➥ %s() at: [%s:%s] %b" "${FUNCNAME[i]}" "${BASH_SOURCE[i]}" "${BASH_LINENO[i-1]:-?}" "${NL}" >> "${LOG_ERROR}"
+
+    fi
+
+  done
+
+  printf "%b" "${NL}"
+}
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f print_stacktrace
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

lib/lib_trap_on_exit.sh

@@ -10,33 +10,60 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-guard_sourcing
+guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
 # Trap function to be called on 'EXIT'.
 # Globals:
+#   ERRCMMD
+#   ERRCODE
+#   ERRFUNC
+#   ERRLINE
+#   ERRSCRT
+#   ERRTRAP
 #   VAR_EARLY_DEBUG
 # Arguments:
 #   1: $?
+#   2: ${BASH_SOURCE[0]}
+#   3: ${LINENO}
+#   4: ${FUNCNAME[0]:-main}
+#   5: ${BASH_COMMAND}
 #######################################
 trap_on_exit() {
+  declare errcode="${ERRCODE:-$1}"
+  declare errscrt="${ERRSCRT:-$2}"
+  declare errline="${ERRLINE:-$3}"
+  declare errfunc="${ERRFUNC:-$4}"
+  declare errcmmd="${ERRCMMD:-$5}"
+
   trap - DEBUG ERR EXIT INT TERM
 
-  declare -r var_trap_on_exit_code="$1"
+  ### Defensive shell behavior inside trap.
+  set +e +o pipefail
 
-  if (( var_trap_on_exit_code == 0 )); then
+  if (( errcode == 0 )); then
 
     if "${VAR_EARLY_DEBUG}"; then dump_user_vars; fi
 
-    clean_up "${var_trap_on_exit_code}"
+    clean_up "${errcode}"
 
-    print_scr_exit "${var_trap_on_exit_code}"
+    print_scr_exit "${errcode}"
 
-    exit "${var_trap_on_exit_code}"
+    exit "${errcode}"
 
   else
 
-    exit "${var_trap_on_exit_code}"
+    if [[ ! "${ERRTRAP}" == "true" ]]; then
+
+      if "${VAR_EARLY_DEBUG}"; then dump_user_vars; fi
+
+      clean_up "${errcode}"
+
+      print_scr_exit_non_zero "${errcode}" "${errscrt}" "${errline}" "${errfunc}" "${errcmmd}"
+
+    fi
+
+    exit "${errcode}"
 
   fi
 }
@@ -45,22 +72,22 @@ trap_on_exit() {
 readonly -f trap_on_exit
 
 #######################################
-# Print Success Message for Trap on 'EXIT' on 'stdout'.
+# Print success message for trap on 'EXIT' on 'stdout'.
 # Globals:
 #   LOG_DEBUG
 #   LOG_VAR
 #   SECONDS
-#   VAR_BASH_VER
-#   VAR_DS_VER
 #   VAR_EARLY_DEBUG
 #   VAR_GIT_REL
 #   VAR_HANDLER_BUILD_DIR
-#   VAR_LB_VER
 #   VAR_SCRIPT_SUCCESS
 #   VAR_SYSTEM
 #   VAR_VERSION
+#   VAR_VER_BASH
+#   VAR_VER_DS
+#   VAR_VER_LB
 # Arguments:
-#   1: ${var_trap_on_exit_code} of trap_on_exit()
+#   1: ${errcode} of trap_on_exit()
 #######################################
 print_scr_exit() {
   declare -r var_print_scr_exit_code="$1"
@@ -74,9 +101,9 @@ print_scr_exit() {
       printf "\e[92m✅ Git Commit             : %s \e[0m\n" "${VAR_GIT_REL}"
       printf "\e[92m✅ Version                : %s \e[0m\n" "${VAR_VERSION}"
       printf "\e[92m✅ Hostsystem             : %s \e[0m\n" "${VAR_SYSTEM}"
-      printf "\e[92m✅ Bash                   : %s \e[0m\n" "${VAR_BASH_VER}"
-      printf "\e[92m✅ Live-Build             : %s \e[0m\n" "${VAR_LB_VER}"
-      printf "\e[92m✅ Debootstrap            : %s \e[0m\n" "${VAR_DS_VER}"
+      printf "\e[92m✅ Bash                   : %s \e[0m\n" "${VAR_VER_BASH}"
+      printf "\e[92m✅ Live-Build             : %s \e[0m\n" "${VAR_VER_LB}"
+      printf "\e[92m✅ Debootstrap            : %s \e[0m\n" "${VAR_VER_DS}"
       printf "\e[92m✅ Aide Initial DB at     : %s \e[0m\n" "${VAR_HANDLER_BUILD_DIR}/.integrity/"
       printf "\e[92m✅ Exited with Status     : %s \e[0m\n" "${var_print_scr_exit_code}"
       printf "\n"
@@ -102,4 +129,86 @@ print_scr_exit() {
 ### Prevents accidental 'unset -f'.
 # shellcheck disable=SC2034
 readonly -f print_scr_exit
+
+#######################################
+# Trap on 'EXIT' handler for 'non-0' exit-code.
+# Globals:
+#   BASHOPTS
+#   EPOCHREALTIME
+#   ERRCMMD
+#   ERRCODE
+#   ERRFUNC
+#   ERRLINE
+#   ERRSCRT
+#   EUID
+#   LOG_DEBUG
+#   LOG_ERROR
+#   LOG_VAR
+#   NL
+#   SECONDS
+#   SHELLOPTS
+#   UID
+#   VAR_ARG_SANITIZED
+#   VAR_EARLY_DEBUG
+#   VAR_GIT_REL
+#   VAR_PARAM_COUNT
+#   VAR_PARAM_STRNG
+#   VAR_SYSTEM
+#   VAR_VERSION
+#   VAR_VER_BASH
+#   VAR_VER_DS
+#   VAR_VER_LB
+# Arguments:
+#   1: $?
+#   2: ${BASH_SOURCE[0]}
+#   3: ${LINENO}
+#   4: ${FUNCNAME[0]:-main}
+#   5: ${BASH_COMMAND}
+#######################################
+print_scr_exit_non_zero() {
+  declare errcode="${ERRCODE:-$1}"
+  declare errscrt="${ERRSCRT:-$2}"
+  declare errline="${ERRLINE:-$3}"
+  declare errfunc="${ERRFUNC:-$4}"
+  declare errcmmd="${ERRCMMD:-$5}"
+
+  printf "\e[91m❌ Trap on 'EXIT'         : CISS.debian.live.builder Script failed. \e[0m\n" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌                        : This was most probably caused by an unbound variable. \e[0m\n" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Git Commit             : %s \e[0m\n" "${VAR_GIT_REL}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Version                : %s \e[0m\n" "${VAR_VERSION}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Epoch                  : %s \e[0m\n" "${EPOCHREALTIME}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Bash                   : %s \e[0m\n" "${VAR_VER_BASH}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Live-Build             : %s \e[0m\n" "${VAR_VER_LB}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Debootstrap            : %s \e[0m\n" "${VAR_VER_DS}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ UID                    : %s \e[0m\n" "${UID}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ EUID                   : %s \e[0m\n" "${EUID}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Hostsystem             : %s \e[0m\n" "${VAR_SYSTEM}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Error                  : %s \e[0m\n" "${errcode}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Line                   : %s \e[0m\n" "${errline}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Script                 : %s \e[0m\n" "${errscrt}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Function               : %s \e[0m\n" "${errfunc}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Command                : %s \e[0m\n" "${errcmmd}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Script Runtime         : %s \e[0m\n" "${SECONDS}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Arguments Counter      : %s \e[0m\n" "${VAR_PARAM_COUNT}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Arguments Original     : %s \e[0m\n" "${VAR_PARAM_STRNG}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Arguments Sanitized    : %s \e[0m\n" "${VAR_ARG_SANITIZED}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Bashopts               : %s \e[0m\n" "${BASHOPTS}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Shellopts              : %s \e[0m\n" "${SHELLOPTS}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ Error Log saved at     : %s \e[0m\n" "${LOG_ERROR}" | tee -a "${LOG_ERROR}"
+  printf "\e[91m❌ batcat --pager='less -r' %s \e[0m\n" "${LOG_ERROR}" | tee -a "${LOG_ERROR}"
+
+  if "${VAR_EARLY_DEBUG}"; then
+
+    printf "\e[91m❌ Vars Dump saved at     : %s \e[0m\n" "${LOG_VAR}" | tee -a "${LOG_ERROR}"
+    printf "\e[91m❌ Debug Log saved at     : %s \e[0m\n" "${LOG_DEBUG}" | tee -a "${LOG_ERROR}"
+    printf "\e[91m❌ batcat --pager='less -r' %s \e[0m\n" "${LOG_DEBUG}" | tee -a "${LOG_ERROR}"
+
+  fi
+
+  print_stacktrace
+  printf "%b" "${NL}"
+}
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f print_scr_exit_non_zero
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

lib/lib_usage.sh

@@ -39,13 +39,13 @@ usage() {
   # shellcheck disable=SC2155
   declare var_header=$(center "CDLB(1)                        CISS.debian.live.builder                        CDLB(1)" "${var_cols}")
   # shellcheck disable=SC2155
-  declare var_footer=$(center "V8.13.384.2025.11.06                        2025-11-06                         CDLB(1)" "${var_cols}")
+  declare var_footer=$(center "V8.13.392.2025.11.07                        2025-11-06                         CDLB(1)" "${var_cols}")
 
   {
     echo -e "\e[1;97m${var_header}\e[0m"
     echo
     echo -e "\e[92mCISS.debian.live.builder from https://git.coresecret.dev/msw \e[0m"
-    echo -e "\e[92mMaster V8.13.384.2025.11.06\e[0m"
+    echo -e "\e[92mMaster V8.13.392.2025.11.07\e[0m"
     echo -e "\e[92mA lightweight Shell Wrapper for building a hardened Debian Live ISO Image.\e[0m"
     echo
     echo -e "\e[97m(c) Marc S. Weidner, 2018 - 2025 \e[0m"

lib/lib_version.sh

@@ -13,7 +13,7 @@
 #######################################
 # Version module 'CISS.debian.live.builder'.
 # Globals:
-#   VAR_BASH_VER
+#   VAR_VER_BASH
 #   VAR_GIT_REL
 #   VAR_HOST
 #   VAR_VERSION
@@ -43,7 +43,7 @@ $(echo -e "\e[97m###############################################################
 
   Using   : lb (${VAR_VER_LB}) debootstrap (${VAR_VER_DS})
   on      : ${VAR_HOST}
-  Bash    : ${VAR_BASH_VER}
+  Bash    : ${VAR_VER_BASH}
 
 EOF