V9.14.016.2026.06.06

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

lib/lib_arg_parser.sh

@@ -238,45 +238,6 @@ arg_parser() {
           fi
           ;;
 
-        --sops-version)
-          if [[ -n "${2-}" ]]; then
-            declare sops_version="${2#v}"
-            if [[ "${sops_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-              # shellcheck disable=SC2034
-              declare -gx VAR_SOPS_VERSION="${sops_version}"
-              shift 2
-            else
-              if ! ${VAR_HANDLER_AUTOBUILD}; then boot_screen_cleaner; fi
-              printf "\e[91m❌ ERROR: --sops-version MUST match '<MAJOR>.<MINOR>.<PATCH>' or 'v<MAJOR>.<MINOR>.<PATCH>'.\e[0m\n" >&2
-              read -r -p $'\e[92m✅ Press \'ENTER\' to exit the script ... \e[0m'
-              # shellcheck disable=SC2154
-              exit "${ERR__SOPS__VER}"
-            fi
-          else
-            if ! ${VAR_HANDLER_AUTOBUILD}; then boot_screen_cleaner; fi
-            printf "\e[91m❌ ERROR: --sops-version MUST be provided with a semantic version.\e[0m\n" >&2
-            read -r -p $'\e[92m✅ Press \'ENTER\' to exit the script ... \e[0m'
-            # shellcheck disable=SC2154
-            exit "${ERR__SOPS__VER}"
-          fi
-          ;;
-
-        --sops-version=*)
-          declare sops_version="${1#*=}"
-          sops_version="${sops_version#v}"
-          if [[ "${sops_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            # shellcheck disable=SC2034
-            declare -gx VAR_SOPS_VERSION="${sops_version}"
-            shift 1
-          else
-            if ! ${VAR_HANDLER_AUTOBUILD}; then boot_screen_cleaner; fi
-            printf "\e[91m❌ ERROR: --sops-version MUST match '<MAJOR>.<MINOR>.<PATCH>' or 'v<MAJOR>.<MINOR>.<PATCH>'.\e[0m\n" >&2
-            read -r -p $'\e[92m✅ Press \'ENTER\' to exit the script ... \e[0m'
-            # shellcheck disable=SC2154
-            exit "${ERR__SOPS__VER}"
-          fi
-          ;;
-
         --jump-host)
           if [[ -n "${2-}" && "${2}" != -* ]]; then
             declare -i count=0
@@ -571,6 +532,45 @@ arg_parser() {
           shift 1
           ;;
 
+        --sops-version)
+          if [[ -n "${2-}" ]]; then
+            declare sops_version="${2#v}"
+            if [[ "${sops_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              # shellcheck disable=SC2034
+              declare -gx VAR_SOPS_VERSION="${sops_version}"
+              shift 2
+            else
+              if ! ${VAR_HANDLER_AUTOBUILD}; then boot_screen_cleaner; fi
+              printf "\e[91m❌ ERROR: --sops-version MUST match '<MAJOR>.<MINOR>.<PATCH>' or 'v<MAJOR>.<MINOR>.<PATCH>'.\e[0m\n" >&2
+              read -r -p $'\e[92m✅ Press \'ENTER\' to exit the script ... \e[0m'
+              # shellcheck disable=SC2154
+              exit "${ERR__SOPS__VER}"
+            fi
+          else
+            if ! ${VAR_HANDLER_AUTOBUILD}; then boot_screen_cleaner; fi
+            printf "\e[91m❌ ERROR: --sops-version MUST be provided with a semantic version.\e[0m\n" >&2
+            read -r -p $'\e[92m✅ Press \'ENTER\' to exit the script ... \e[0m'
+            # shellcheck disable=SC2154
+            exit "${ERR__SOPS__VER}"
+          fi
+          ;;
+
+        --sops-version=*)
+          declare sops_version="${1#*=}"
+          sops_version="${sops_version#v}"
+          if [[ "${sops_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            # shellcheck disable=SC2034
+            declare -gx VAR_SOPS_VERSION="${sops_version}"
+            shift 1
+          else
+            if ! ${VAR_HANDLER_AUTOBUILD}; then boot_screen_cleaner; fi
+            printf "\e[91m❌ ERROR: --sops-version MUST match '<MAJOR>.<MINOR>.<PATCH>' or 'v<MAJOR>.<MINOR>.<PATCH>'.\e[0m\n" >&2
+            read -r -p $'\e[92m✅ Press \'ENTER\' to exit the script ... \e[0m'
+            # shellcheck disable=SC2154
+            exit "${ERR__SOPS__VER}"
+          fi
+          ;;
+
         --ssh-port)
           if [[ -n "${2-}" && "${2}" =~ ^-?[0-9]+$ && "${2}" -ge 1 && "${2}" -le 65535 ]]; then
 

lib/lib_arg_priority_check.sh

@@ -27,7 +27,7 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 arg_priority_check() {
   declare var=""
 
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   ### Check if nice PRIORITY is set and adjust nice priority.
   if [[ "${VAR_HANDLER_PRIORITY:-}" -ne 0 ]]; then
@@ -36,11 +36,11 @@ arg_priority_check() {
 
       renice "${VAR_HANDLER_PRIORITY}" -p "$$"
       var=$(ps -o ni= -p $$) > /dev/null 2>&1
-      printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ New renice value: %s\e[0m\n" "${var}"
+      printf "\e[92m✅ New renice value: %s\e[0m\n" "${var}"
 
     else
 
-      printf "\e[93m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ renice not installed (util-linux) \e[0m\n"
+      printf "\e[93m❌ renice not installed (util-linux) \e[0m\n"
 
     fi
 
@@ -53,17 +53,17 @@ arg_priority_check() {
 
       ionice -c"${VAR_REIONICE_CLASS:-2}" -n"${VAR_REIONICE_PRIORITY:-4}" -p "$$"
       var=$(ionice -p $$) > /dev/null 2>&1
-      printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ New ionice value: %s\e[0m\n" "${var}"
+      printf "\e[92m✅ New ionice value: %s\e[0m\n" "${var}"
 
     else
 
-      printf "\e[93m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ ionice not installed (util-linux) \e[0m\n"
+      printf "\e[93m❌ ionice not installed (util-linux) \e[0m\n"
 
     fi
 
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_cdi.sh

@@ -26,7 +26,7 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 #   0: on success
 #######################################
 cdi() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   if [[ "${VAR_HANDLER_CDI}" == "true" ]]; then
 
@@ -67,7 +67,7 @@ EOF
 
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_change_splash.sh

@@ -25,27 +25,27 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 #   0: on success
 #######################################
 change_splash() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   if [[ ${VAR_HANDLER_SPLASH} == "club" ]]; then
 
-    printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 Grub Splash 'club.png' selected ...\e[0m\n"
+    printf "\e[95m🧪 Grub Splash 'club.png' selected ...\e[0m\n"
     cp -af "${VAR_WORKDIR}"/.archive/background/club.png "${VAR_HANDLER_BUILD_DIR}"/config/bootloaders/splash.png
     cp -af "${VAR_WORKDIR}"/.archive/background/club.png "${VAR_HANDLER_BUILD_DIR}"/config/bootloaders/grub-efi/splash.png
     cp -af "${VAR_WORKDIR}"/.archive/background/club.png "${VAR_HANDLER_BUILD_DIR}"/config/bootloaders/grub-pc/splash.png
-    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Grub Splash 'club.png' selected done. \e[0m\n"
+    printf "\e[92m✅ Grub Splash 'club.png' selected done. \e[0m\n"
 
   elif [[ ${VAR_HANDLER_SPLASH} == "hexagon" ]]; then
 
-    printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 Grub Splash 'hexagon.png' selected ...\e[0m\n"
+    printf "\e[95m🧪 Grub Splash 'hexagon.png' selected ...\e[0m\n"
     cp -af "${VAR_WORKDIR}"/.archive/background/hexagon.png "${VAR_HANDLER_BUILD_DIR}"/config/bootloaders/splash.png
     cp -af "${VAR_WORKDIR}"/.archive/background/hexagon.png "${VAR_HANDLER_BUILD_DIR}"/config/bootloaders/grub-efi/splash.png
     cp -af "${VAR_WORKDIR}"/.archive/background/hexagon.png "${VAR_HANDLER_BUILD_DIR}"/config/bootloaders/grub-pc/splash.png
-    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Grub Splash 'hexagon.png' selected done. \e[0m\n"
+    printf "\e[92m✅ Grub Splash 'hexagon.png' selected done. \e[0m\n"
 
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_check_dhcp.sh

@@ -24,13 +24,13 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 #   0: on success
 #######################################
 check_dhcp() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   if [[ ${VAR_HANDLER_DHCP} -eq 1 ]]; then
     chmod +x "${VAR_WORKDIR}/scripts/0010_dhcp_supersede.sh" && "${VAR_WORKDIR}/scripts/0010_dhcp_supersede.sh"
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_check_secrets.sh

@@ -23,7 +23,7 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 #   0: on success
 #######################################
 x_remove() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   declare _old_nullglob="" _old_dotglob=""
 
@@ -54,7 +54,7 @@ x_remove() {
   eval "${_old_nullglob}" 2>/dev/null || true
   eval "${_old_dotglob}"  2>/dev/null || true
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_ciss_signatures.sh

@@ -30,7 +30,7 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 #   0: on success
 #######################################
 ciss_signatures() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   declare -ar _ary_target=(
     "/etc/initramfs-tools/files/unlock_wrapper.sh"
@@ -58,7 +58,7 @@ ciss_signatures() {
 
   done
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_ciss_upgrades_boot.sh

@@ -29,7 +29,7 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 #   0: on success
 #######################################
 ciss_upgrades_boot() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   gpg --batch --yes --export "${VAR_SIGNING_KEY_FPR}" >| "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.ciss/attestation/${VAR_SIGNING_KEY_FPR}.gpg"
 
@@ -66,7 +66,7 @@ ciss_upgrades_boot() {
   [[ -e "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/live/boot/0030-verify-checksums" ]] && \
     rm -f "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/live/boot/0030-verify-checksums"
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_ciss_upgrades_build.sh

@@ -23,7 +23,7 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 #   0: on success
 #######################################
 ciss_upgrades_build() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   ### CISS 0030-ciss-verify-checksums override. --------------------------------------------------------------------------------
   if [[ -e /usr/lib/live/boot/0030-verify-checksums ]]; then
@@ -66,7 +66,7 @@ ciss_upgrades_build() {
   rm -f /usr/lib/live/build/binary_rootfs
   install -m 0755 -o root -g root "${VAR_WORKDIR}/scripts/usr/lib/live/build/binary_rootfs.sh" /usr/lib/live/build/binary_rootfs
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_copy_integrity.sh

@@ -35,7 +35,7 @@ copy_db() {
 
   else
 
-    printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ '%s' NOT successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+    printf "\e[91m❌ '%s' NOT successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   fi
 }

lib/lib_gnupg.sh

@@ -37,7 +37,7 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 #   ERR_GPG__AGENT: on failure
 #######################################
 init_gnupg() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   if [[ "${VAR_SIGNER}" == "true" ]]; then
 
@@ -47,7 +47,7 @@ init_gnupg() {
     ### Avoid collision with Gitea runner workflows.
     if [[ "${VAR_CDLB_INSIDE_RUNNER}" != "true" ]]; then
 
-      printf "\e[93m++++ ++++ ++++ ++++ ++++ ++++ ++ 🔐 VAR_CDLB_INSIDE_RUNNER: [%s] \e[0m\n" "${VAR_CDLB_INSIDE_RUNNER}"
+      printf "\e[93m🔐 VAR_CDLB_INSIDE_RUNNER: [%s] \e[0m\n" "${VAR_CDLB_INSIDE_RUNNER}"
 
       declare -grx GNUPGHOME="${VAR_WORKDIR}/cdlb_$$_gnupg"
 
@@ -61,14 +61,14 @@ EOF
 
       if ! gpgconf --launch gpg-agent 2>&1; then
 
-        printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ Failed to launch gpg-agent. \e[0m\n"
+        printf "\e[91m❌ Failed to launch gpg-agent. \e[0m\n"
         return "${ERR_GPG__AGENT}"
 
       fi
 
     else
 
-      printf "\e[93m++++ ++++ ++++ ++++ ++++ ++++ ++ 🔐 VAR_CDLB_INSIDE_RUNNER: [%s] leaving GNUPGHOME untouched.\e[0m\n" "${VAR_CDLB_INSIDE_RUNNER}"
+      printf "\e[93m🔐 VAR_CDLB_INSIDE_RUNNER: [%s] leaving GNUPGHOME untouched.\e[0m\n" "${VAR_CDLB_INSIDE_RUNNER}"
 
     fi
 
@@ -89,7 +89,7 @@ EOF
 
     if ! gpg --batch --yes --pinentry-mode=loopback --passphrase-file "${VAR_SIGNING_KEY_PASSFILE}" --import "${VAR_TMP_SECRET}/${VAR_SIGNING_KEY}"; then
 
-      printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ Failed to import signing key. \e[0m\n"
+      printf "\e[91m❌ Failed to import signing key. \e[0m\n"
       return "${ERR_GPG__AGENT}"
 
     fi
@@ -105,7 +105,7 @@ EOF
 
       if ! gpg --batch --import "${VAR_TMP_SECRET}/${VAR_SIGNING_CA}"; then
 
-        printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ Failed to import CA public key. \e[0m\n"
+        printf "\e[91m❌ Failed to import CA public key. \e[0m\n"
         return "${ERR_GPG__AGENT}"
 
       fi
@@ -128,7 +128,7 @@ EOF
 
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_hardening_root_pw.sh

@@ -24,16 +24,16 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 #   0: on success
 #######################################
 hardening_root_pw() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   if [[ -z ${VAR_HASHED_PWD} ]]; then
 
-    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ No Root Password for Console set, skipping root password hook.\e[0m\n"
+    printf "\e[92m✅ No Root Password for Console set, skipping root password hook.\e[0m\n"
     return 0
 
   fi
 
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 Setup Root Password for Console ... \e[0m\n"
+  printf "\e[95m🧪 Setup Root Password for Console ... \e[0m\n"
 
   declare cfg_dir="${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/etc/live"
   declare dropin_dir="${cfg_dir}/config.conf.d"
@@ -82,9 +82,9 @@ EOF
   #touch "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/systemd/system-generators/live-config-getty-generator"
   #chmod -x "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/systemd/system-generators/live-config-getty-generator"
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Setup Root Password for Console done. \e[0m\n"
+  printf "\e[92m✅ Setup Root Password for Console done. \e[0m\n"
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_hardening_ssh_tcp.sh

@@ -24,7 +24,7 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 #   0: on success
 #######################################
 hardening_ssh_tcp() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   if ((${#ARY_HANDLER_JUMPHOST[@]} > 0)); then
     declare allowed=""
@@ -90,7 +90,7 @@ ALL: ALL
 EOF
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_hardening_ultra.sh

@@ -30,13 +30,13 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 #   0: on success
 #######################################
 hardening_ultra() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   # shellcheck disable=SC2164
   cd "${VAR_WORKDIR}"
 
   ### ./config/bootloaders -----------------------------------------------------------------------------------------------------
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 Copying ./config/bootloaders ... \e[0m\n"
+  printf "\e[95m🧪 Copying ./config/bootloaders ... \e[0m\n"
 
   if [[ ! -d "${VAR_HANDLER_BUILD_DIR}/config/bootloaders" ]]; then
 
@@ -49,11 +49,11 @@ hardening_ultra() {
 
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Copying ./config/bootloaders done.\e[0m\n"
+  printf "\e[92m✅ Copying ./config/bootloaders done.\e[0m\n"
 
 
   ### ./config/includes.binary -------------------------------------------------------------------------------------------------
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 Copying ./config/includes.binary ... \e[0m\n"
+  printf "\e[95m🧪 Copying ./config/includes.binary ... \e[0m\n"
 
   if [[ ! -d "${VAR_HANDLER_BUILD_DIR}/config/includes.binary" ]]; then
 
@@ -66,11 +66,11 @@ hardening_ultra() {
 
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Copying ./config/includes.binary done.\e[0m\n"
+  printf "\e[92m✅ Copying ./config/includes.binary done.\e[0m\n"
 
 
   ### ./config/includes.chroot -------------------------------------------------------------------------------------------------
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 Copying ./config/includes.chroot ... \e[0m\n"
+  printf "\e[95m🧪 Copying ./config/includes.chroot ... \e[0m\n"
 
   if [[ ! -d "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot" ]]; then
 
@@ -87,13 +87,13 @@ hardening_ultra() {
 
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Copying ./config/includes.chroot done.\e[0m\n"
+  printf "\e[92m✅ Copying ./config/includes.chroot done.\e[0m\n"
 
 
   ### ./config/hooks/early -----------------------------------------------------------------------------------------------------
   if [[ -d "${VAR_WORKDIR}/config/hooks/early" ]]; then
 
-    printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 Copying ./config/hooks/early ... \e[0m\n"
+    printf "\e[95m🧪 Copying ./config/hooks/early ... \e[0m\n"
 
     if [[ ! -d "${VAR_HANDLER_BUILD_DIR}/config/hooks/early" ]]; then
 
@@ -106,13 +106,13 @@ hardening_ultra() {
 
     fi
 
-    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Copying ./config/hooks/early done.\e[0m\n"
+    printf "\e[92m✅ Copying ./config/hooks/early done.\e[0m\n"
 
   fi
 
 
   ### ./config/hooks/live ------------------------------------------------------------------------------------------------------
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 Copying ./config/hooks/live ... \e[0m\n"
+  printf "\e[95m🧪 Copying ./config/hooks/live ... \e[0m\n"
 
   if [[ ! -d "${VAR_HANDLER_BUILD_DIR}/config/hooks/live" ]]; then
 
@@ -125,11 +125,11 @@ hardening_ultra() {
 
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Copying ./config/hooks/live done.\e[0m\n"
+  printf "\e[92m✅ Copying ./config/hooks/live done.\e[0m\n"
 
 
   ### ./config/package-lists ---------------------------------------------------------------------------------------------------
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 Copying ./config/package-lists ... \e[0m\n"
+  printf "\e[95m🧪 Copying ./config/package-lists ... \e[0m\n"
   if [[ ! -d "${VAR_HANDLER_BUILD_DIR}/config/package-lists" ]]; then
     mkdir -p "${VAR_HANDLER_BUILD_DIR}/config/package-lists"
   fi
@@ -145,7 +145,7 @@ hardening_ultra() {
       declare arch_comment="# arm64 specific packages"
       ;;
     *)
-      printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ Unsupported architecture '%s'.\e[0m\n" "${VAR_ARCHITECTURE}"
+      printf "\e[91m❌ Unsupported architecture '%s'.\e[0m\n" "${VAR_ARCHITECTURE}"
       exit 1
       ;;
   esac
@@ -173,12 +173,12 @@ hardening_ultra() {
     print
     }
     ' "${VAR_HANDLER_BUILD_DIR}/config/package-lists/live.list.chroot" >| temp && mv temp "${VAR_HANDLER_BUILD_DIR}/config/package-lists/live.list.chroot"
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Copying ./config/package-lists done.\e[0m\n"
+  printf "\e[92m✅ Copying ./config/package-lists done.\e[0m\n"
 
 
 
   ### Updating SSH Keys, Ports -------------------------------------------------------------------------------------------------
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 Updating SSH Keys, Ports ... \e[0m\n"
+  printf "\e[95m🧪 Updating SSH Keys, Ports ... \e[0m\n"
 
   ### ./config/includes.chroot/root/.ssh ---------------------------------------------------------------------------------------
   install -d -m 0700 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.ssh"
@@ -212,7 +212,7 @@ hardening_ultra() {
 
     if [[ -z "${line}" ]]; then
 
-      printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌'ufw default deny forward' not found in: '%s'\e[0m\n" "${file}" >&2
+      printf "\e[91m❌'ufw default deny forward' not found in: '%s'\e[0m\n" "${file}" >&2
       exit 1
 
     fi
@@ -229,13 +229,13 @@ hardening_ultra() {
 
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Updating SSH Keys, Ports done. \e[0m\n"
+  printf "\e[92m✅ Updating SSH Keys, Ports done. \e[0m\n"
 
 
   ### ./config/includes.chroot/etc/hosts. --------------------------------------------------------------------------------------
   if [[ -f "${VAR_WORKDIR}/hosts.allow" ]]; then
 
-    printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 SSH Hardening Ultra ... \e[0m\n"
+    printf "\e[95m🧪 SSH Hardening Ultra ... \e[0m\n"
 
     mv "${VAR_WORKDIR}/hosts.allow" "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/etc"
     mv "${VAR_WORKDIR}/hosts.deny" "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/etc"
@@ -243,7 +243,7 @@ hardening_ultra() {
     chmod 0644 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/etc/hosts.allow"
     chmod 0644 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/etc/hosts.deny"
 
-    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ SSH Hardening Ultra done.\e[0m\n"
+    printf "\e[92m✅ SSH Hardening Ultra done.\e[0m\n"
 
   fi
 
@@ -251,7 +251,7 @@ hardening_ultra() {
   ### ./config/hooks/live/9950_hardening_fail2ban.chroot -----------------------------------------------------------------------
   if ((${#ARY_HANDLER_JUMPHOST[@]} > 0)); then
 
-    printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 Updating fail2ban Jumphosts IPs ... \e[0m\n"
+    printf "\e[95m🧪 Updating fail2ban Jumphosts IPs ... \e[0m\n"
 
     # Join array entries with spaces, preserving any newlines
     declare ips="${ARY_HANDLER_JUMPHOST[*]}"
@@ -265,19 +265,19 @@ hardening_ultra() {
     # Perform an in-place replacement of IGNORE_IP_MUST_BE_SET with the cleaned list
     sed -i -E "/^[[:space:]]*ignoreip[[:space:]]*=/ s|IGNORE_IP_MUST_BE_SET|${flat_ips}|g" "${VAR_HANDLER_BUILD_DIR}/config/hooks/live/9950_hardening_fail2ban.chroot"
 
-    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Updating fail2ban Jumphosts IPs done. \e[0m\n"
+    printf "\e[92m✅ Updating fail2ban Jumphosts IPs done. \e[0m\n"
 
   else
 
-    printf "\e[93m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 No jump hosts configured, removing placeholder ... \e[0m\n"
+    printf "\e[93m🧪 No jump hosts configured, removing placeholder ... \e[0m\n"
 
     sed -i 's/IGNORE_IP_MUST_BE_SET//g' "${VAR_HANDLER_BUILD_DIR}/config/hooks/live/9950_hardening_fail2ban.chroot"
 
-    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Placeholder removed. \e[0m\n"
+    printf "\e[92m✅ Placeholder removed. \e[0m\n"
 
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_lb_build_start.sh

@@ -27,7 +27,7 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 lb_build_start() {
   declare -i var_build_rc=""
 
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🔨 Start Build... Log file: %s \e[0m\n" "${VAR_BUILD_LOG}"
+  printf "\e[95m🔨 Start Build... Log file: %s \e[0m\n" "${VAR_BUILD_LOG}"
 
   # shellcheck disable=SC2164
   cd "${VAR_WORKDIR}"

lib/lib_lb_config_start.sh

@@ -23,14 +23,14 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 #   0: on success
 #######################################
 lb_config_start() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   if [[ ! -d ${VAR_HANDLER_BUILD_DIR} ]]; then
 
     mkdir -p "${VAR_HANDLER_BUILD_DIR}"
     # shellcheck disable=SC2164
     cd "${VAR_HANDLER_BUILD_DIR}"
-    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' created. \e[0m\n" "${VAR_HANDLER_BUILD_DIR}"
+    printf "\e[92m✅ '%s' created. \e[0m\n" "${VAR_HANDLER_BUILD_DIR}"
 
   else
 
@@ -44,7 +44,7 @@ lb_config_start() {
     # shellcheck disable=SC2164
     cd "${VAR_HANDLER_BUILD_DIR}"
 
-    printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 Deleting former config, binary and cache ... \e[0m\n"
+    printf "\e[95m🧪 Deleting former config, binary and cache ... \e[0m\n"
 
     lb clean --binary --cache --purge --source
 
@@ -54,11 +54,11 @@ lb_config_start() {
 
     fi
 
-    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Deleting former config, binary and cache done.\e[0m\n"
+    printf "\e[92m✅ Deleting former config, binary and cache done.\e[0m\n"
 
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_lb_config_write_trixie.sh

@@ -134,7 +134,7 @@ var/lib/initramfs-tools/*-amd64
 EOF
   chmod 0644 "${VAR_HANDLER_BUILD_DIR}/config/rootfs/excludes"
 
-  printf "\e[92m✅ Writing new config done.\e[0m\n"
+  printf "\e[92m✅ Writing new config done. \e[0m\n"
   printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0

lib/lib_note_target.sh

@@ -29,7 +29,7 @@
 #   0: on success
 #######################################
 note_target() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   cat << EOF >| "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/ciss-debian-live-builder.txt"
 ################################################################################
@@ -77,7 +77,7 @@ export CDLB_SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH}"
 EOF
   chmod 0444 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/ciss-debian-live-builder.env"
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_primordial.sh

@@ -253,4 +253,5 @@ normalize_ssh_keys_in_dir() {
 ### Prevents accidental 'unset -f'.
 # shellcheck disable=SC2034
 readonly -f normalize_ssh_keys_in_dir
+
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

lib/lib_provider_netcup.sh

@@ -27,7 +27,7 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 provider_netcup() {
   if "${VAR_HANDLER_NETCUP_IPV6}"; then
 
-    printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+    printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
     declare handler_netcup_ipv6_string="${ARY_HANDLER_NETCUP_IPV6[*]}"
 
@@ -79,7 +79,7 @@ UseHostname=no
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
 
-    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+    printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   fi
 

lib/lib_run_analysis.sh

@@ -107,11 +107,12 @@ run_analysis() {
   printf "\e[97m🔐 SHA256SUM         : %s \e[0m\n" "${sha_sum}"
   printf "\e[92m----------------------------------------------------------------------------------------\e[0m\n"
   printf "\e[97m📅 Analysis Time     : %s \e[0m\n" "${time}"
-  printf "\e[92m✅ Analysis completed.\e[0m\n"
+  printf "\e[92m✅ Analysis completed.    \e[0m\n"
 
   return 0
 }
 ### Prevents accidental 'unset -f'.
 # shellcheck disable=SC2034
 readonly -f run_analysis
+
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

lib/lib_sanitizer.sh

@@ -142,4 +142,5 @@ sanitize_shell_literal() {
 ### Prevents accidental 'unset -f'.
 # shellcheck disable=SC2034
 readonly -f sanitize_shell_literal
+
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

lib/lib_secureboot_profile.sh

@@ -9,7 +9,6 @@
 # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
-# shellcheck disable=SC2154,SC2312
 
 guard_sourcing || return "${ERR_GUARD_SRCE}"
 
@@ -41,6 +40,7 @@ secureboot_profile_guard_private_keys() {
       continue
     fi
 
+    # shellcheck disable=SC2312
     while IFS= read -r -d '' private_file; do
 
       printf "\e[91m❌ Refusing private Secure Boot key inside build artifact path: '%s'. \e[0m\n" "${private_file}" >&2
@@ -74,8 +74,8 @@ readonly -f secureboot_profile_guard_private_keys
 secureboot_profile_apply() {
   declare profile="${VAR_CISS_SECUREBOOT_PROFILE,,}"
   declare hooks_dir="${VAR_HANDLER_BUILD_DIR}/config/hooks/live"
-  declare build_uki_hook="${hooks_dir}/zzzz_ciss_build_uki.hook.binary"
-  declare install_uki_hook="${hooks_dir}/9910-ciss-install-uki-into-efi-img.hook.binary"
+  declare build_uki_hook="${hooks_dir}/zzzz_ciss_uki_build.hook.binary"
+  declare install_uki_hook="${hooks_dir}/zzzz_ciss_uki_install.hook.binary"
   declare secureboot_dir="${VAR_WORKDIR}/ciss.secureboot"
   declare secureboot_key="${secureboot_dir}/private/ciss-efi-image.key"
   declare secureboot_cert="${secureboot_dir}/public/ciss-efi-image.crt"
@@ -141,4 +141,5 @@ secureboot_profile_apply() {
 ### Prevents accidental 'unset -f'.
 # shellcheck disable=SC2034
 readonly -f secureboot_profile_apply
+
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

lib/lib_update_microcode.sh

@@ -22,7 +22,7 @@
 #   0: on success
 #######################################
 update_microcode() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   if [[ "${VAR_ARCHITECTURE,,}" == "amd64" ]]; then
 
@@ -33,7 +33,7 @@ EOF
 
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }

lib/lib_usage.sh

@@ -39,13 +39,13 @@ usage() {
   # shellcheck disable=SC2155
   declare var_header=$(center "CDLB(1)                        CISS.debian.live.builder                        CDLB(1)" "${var_cols}")
   # shellcheck disable=SC2155
-  declare var_footer=$(center "V9.14.008.2026.06.04                        2026-06-04                         CDLB(1)" "${var_cols}")
+  declare var_footer=$(center "V9.14.016.2026.06.06                        2026-06-04                         CDLB(1)" "${var_cols}")
 
   {
     echo -e "\e[1;97m${var_header}\e[0m"
     echo
     echo -e "\e[92mCISS.debian.live.builder from https://git.coresecret.dev/msw \e[0m"
-    echo -e "\e[92mMaster V9.14.008.2026.06.04\e[0m"
+    echo -e "\e[92mMaster V9.14.016.2026.06.06\e[0m"
     echo -e "\e[92mA lightweight Shell Wrapper for building a hardened Debian Live ISO Image.\e[0m"
     echo
     echo -e "\e[97m(c) Marc S. Weidner, 2018 - 2026 \e[0m"
@@ -101,14 +101,6 @@ usage() {
     echo "    <./upgrades/dropbear/dropbear-<STRING>.tar.bz2>"
     echo "    If omitted defaults to VAR_DROPBEAR_VERSION from <./var/global.var.sh>."
     echo
-    echo -e "\e[97m  --sops-version <STRING> \e[0m"
-    echo "    Selects the upstream SOPS release version used for the SOPS binary installed into the Live System."
-    echo "    The value MUST be a semantic version such as '3.13.1'. A leading 'v' is accepted and normalized."
-    echo "    The expected amd64 upstream asset is:"
-    echo "    <https://github.com/getsops/sops/releases/download/v<STRING>/sops-v<STRING>.linux.amd64>"
-    echo "    SOPS checksums are verified with Cosign using either Sigstore bundle mode or legacy split certificate/signature mode."
-    echo "    If omitted defaults to VAR_SOPS_VERSION from <./var/global.var.sh>."
-    echo
     echo -e "\e[97m  --jump-host <IP | IP | ... > \e[0m"
     echo "    Provide up to 10 IPs for '/etc/host.allow' whitelisting of SSH access. Could be either IPv4 and / or IPv6 "
     echo "    addresses and / or CCDIR notation. If provided, than it MUST be a <SPACE> separated list."
@@ -171,6 +163,14 @@ usage() {
     echo "    Change '*' to your desired files / fingerprint. Files MUST be placed in:"
     echo "    </dev/shm/cdlb_secrets>"
     echo
+    echo -e "\e[97m  --sops-version <STRING> \e[0m"
+    echo "    Selects the upstream SOPS release version used for the SOPS binary installed into the Live System."
+    echo "    The value MUST be a semantic version such as '3.13.1'. A leading 'v' is accepted and normalized."
+    echo "    The expected amd64 upstream asset is:"
+    echo "    <https://github.com/getsops/sops/releases/download/v<STRING>/sops-v<STRING>.linux.amd64>"
+    echo "    SOPS checksums are verified with Cosign using either Sigstore bundle mode or legacy split certificate/signature mode."
+    echo "    If omitted defaults to VAR_SOPS_VERSION from <./var/global.var.sh>."
+    echo
     echo -e "\e[97m  --sshfp \e[0m"
     echo "    Desired SSH id-files that should be incorporated in '/root/.ssh/id*'."
     echo "    Desired SSH host-files that should be incorporated in '/etc/ssh/ssh_host_*'."