- Extracted hardware detection logic from firmware.sh into new modules/hw_detect.sh. Declares shared arrays (PCI_NET_DEVS, USB_WIFI_DEVS, etc) and _detect_all_network_devices() function. The main script now sources hw_detect.sh immediately after utils.sh. firmware.sh retains only _DETECTED_FW_PKGS and _FW_PLAN_PKG_LINES plus installation logic — the detection loop is fully removed, eliminating the circular dependency with bluetooth.sh.
- Fixed interrupt safety in main script: removed pkill -f "apt.*install" and pkill -f "dpkg.*configure" from _on_interrupt(); updated exit message to "Temp files cleaned." Only the signal handler (trap _on_interrupt INT TERM) remains.
- Added strict URL validation to modules/gaming/heroic.sh and modules/gaming/tools.sh using regex ^https://[A-Za-z0-9./_-]+\.deb$ before passing $deb_url to _run_cmd. Blocks command substitution, non-https URLs, and path traversal attempts that could bypass shell quoting.
- Implemented real Bullseye Archive rewrite in modules/bullseye/legacy.sh: adds idempotency check (grep -q archive.debian.org && return 0), creates timestamped backup of /etc/apt/sources.list with sudo cp, writes exact archive Debian sources via sudo tee heredoc, and runs sudo apt-get update || true on failure.
- Added local scope to modules/bluetooth.sh variable service_enable_only=false before the conditional assignment, preventing state bleed from the previous global-only declaration.
- Applied safe array pattern (while IFS= read -r _pkg; do ...) across 32+ files in modules/extras/* and modules/bullseye/legacy.sh, replacing all vulnerable for pkg in $cleaned / for pkg in $install_list loops. Eliminates word-splitting and command-injection risks.
- Fixed command injection in desktop_display.sh by converting word-splitting loops to safe array-based iteration for LightDM/GDM3 configuration and XFCE package installation.
- Added symlink detection guard before repository file operations in repos.sh to prevent TOCTOU attacks during restore_previous_repos().
- Hardened SUDO_USER resolution with awk validation against /etc/passwd to prevent root fallback and ensure real login users are targeted for sudoers configuration.
- Implemented algorithm (lz4/zstd) and size validation before ZRAM configuration writes in zram.sh to reject invalid inputs.
- Protected grep MemTotal read from /proc/meminfo with 2>/dev/null and default assignment under set -u.
- Added || true guards around apt-cache madison pipelines in firmware.sh, kernel.sh, gpu.sh, and utils.sh to prevent pipefail aborts when backports unavailable.
- Wrapped whiptail installation in if/else blocks to allow offline error messages instead of script termination under set -e.
- Fixed grep -c output duplication in swap.sh with proper || true pattern and default variable assignment.
- Replaced unquoted $cleaned loops with array conversion using while read for secure package iteration across gaming, desktop_display, firmware, and kernel modules.
- Anchored sed regex patterns to space-delimited "main" components to prevent mirror URL corruption in sources.list editing.
- Escaped % characters in _msg() function before passing to whiptail to prevent printf format interpretation crashes.
- Consolidated package version helpers into canonical wrappers: _get_pkg_version, _get_installed_version, _get_backports_version for consistent apt/dpkg queries.
- Created _install_if_missing() and _install_pkg() with proper error handling that respects set -e while providing user feedback on installation failures.
- Removed 6 dead code functions (~51 lines): check_system_time, sync_system_time, get_cpu_summary, get_ram_summary, pkg_versions, get_backports_kernel_version.
- Added detect_displayserver and detect_audio_server to refresh_system_state() for complete state refresh when returning from menus.
- Enhanced _on_interrupt() trap handler to kill lingering apt/dpkg child processes and clean /tmp/debianito.* temporary files on Ctrl+C or TERM.
- Improved restore_previous_repos() with manifest-based backup verification (.backed_up_* markers) to prevent destructive repository file deletion.
- Added mktemp usage for secure temporary deb file downloads in nvidia.sh, heroic.sh, and tools.sh to eliminate TOCTOU vulnerabilities in /tmp.
- Fixed Bluetooth USB dongle misclassification as WiFi devices by excluding "bluetooth" strings from USB_WIFI_DEVS detection in firmware.sh.
- Properly utilized the need array for selective package installation in internet.sh instead of hardcoding full package list.
- Corrected fwupdmgr duplicate execution and grep false positives in system.sh with strict pattern matching for available updates.
- update docs and added quickstart guide
- Removed redundant confirmation dialogs from `_install_nvidia_stack`. Users can now access driver management (including removal) without first confirming installation intent; initial plan display is followed by pause for review instead of blocking prompt.
- Automated CUDA repository enabling on Debian 13/Bookworm paths (590/595). Manual confirmation prompts eliminated; script auto-enables repo via `_enable_cuda_repo` with error handling while maintaining safety checks.
- Split CUDA driver installation into two distinct APT transactions in `nvidia.sh`. Step 1 installs mandatory version pinning (`nvidia-driver-pinning-${ver}`); failure aborts process. Step 2 installs `nvidia-open`, relying on transitive dependencies for firmware rather than explicit package listing.
- Eliminated all Bookworm backports support due to EOL (2026-08-09). Removed `_install_nvidia_bookworm_bpo()`, dead code `install_nvidia_driver()`, and dispatcher logic for Debian 12. Turing now installs standard packages only; Trixie backports remain intact.
- Updated documentation (`docs/gpu.md`) to reflect actual installation flow and removed references to deprecated functions.
- Fixed critical abort in `_install_nvidia_cuda_repo` for Debian 13 (Trixie) when installing v590/v595 due to `nvidia-open` availability checks.
- Removed pre-install `apt-cache policy` verification that caused premature script termination on version mismatches.
- Eliminated manual creation of `/etc/apt/preferences.d/block-nvidia`, relying exclusively on official NVIDIA pinning packages (`nvidia-driver-pinning-${ver}`).
- Updated error handling to display real `apt` output on failure instead of generic abort messages, improving troubleshooting visibility.
- Synchronized documentation in `docs/gpu.md` to reflect the simplified CUDA repo flow and removed references to manual pinning or candidate checks.
- Fixed critical NVIDIA driver bug on Debian 13 (Trixie) where repo configuration installed v550 instead of selected v595. Implemented version-specific enabling: cuda-keyring for Trixie, extrepo for Bookworm. Added explicit apt update after repo enable and candidate verification before pinning checks to abort cleanly if expected driver unavailable.
- Rewrote `_install_nvidia_standard()` with auto-detected architecture via `_get_nvidia_arch_family()`. Turing/Ampere/Ada/Blackwell → nvidia-open-kernel-dkms (open module); Maxwell/Pascal/Volta/unknown/empty → nvidia-kernel-dkms (closed, safe fallback). Removed all `nvidia-detect` references across modules and docs.
- Fixed `_install_nvidia_cuda_repo()` to use correct CUDA repository package names: v590/v595 → nvidia-open metapackage (includes nvidia-kernel-open-dkms); v550 and below → nvidia-driver. Added dynamic warning message based on installed module type.
- Fixed uninitialized variable bug in `modules/gaming/tools.sh` causing script abortion under `set -u`. Initialized all local variables (`deb_url`, `sha256`, `json`, `deb_suffix`) with default values and added defensive initialization for `$USER` environment variable.
- Fixed ZRAM configuration persistence bug where old config persisted after changes. Added device reset sequence (swapoff + modprobe -r) before writing new config, post-config verification check, and changed default recommendation from 50% to 25% for systems with >16GB RAM.
- Added `_warn_nvidia_gnome_wayland()` function in `gpu.sh` to warn about Debian bug #1109409 (GDM3 + NVIDIA + Wayland black screen issue). Warning displays only when gdm3 present, GNOME Shell 4.x detected, and NVIDIA driver installed.
- Standardized menu headers across all modules using centralized SCROLL_HINT variable, replacing hardcoded strings with uniform Whiptail instructions. Updated documentation for cuda-keyring (Trixie) and ZRAM configuration flow diagrams.
- Refactored NVIDIA installation with robust DKMS verification (`_verify_nvidia_dkms_build`). Automatically detects build failures for the current kernel and repairs them via `dpkg-reconfigure`, ensuring modules compile against active kernels without manual intervention.
- Added Secure Boot detection (`_nvidia_secure_boot_enabled`) to warn users if the NVIDIA module is compiled but unsigned, preventing boot issues on systems with UEFI security enabled.
- Implemented `_configure_nvidia_wayland()` for Wayland support. Detects hybrid laptops (Optimus) vs desktops using DMI chassis types and battery presence. Configures `NVreg_PreserveVideoMemoryAllocations` only for desktops to avoid Optimus conflicts, and adds architecture-specific guards (e.g., Kepler warnings).
- Introduced version selection menu (`_show_nvidia_version_menu`). Users can select driver versions (470/535/550/590/595) based on Debian release. Parametrized CUDA repo installation for 590/595 with post-install DKMS branch verification.
- Fixed state inconsistency bugs in `NVIDIA_DRIVER_MODE`. Added guards to ensure configuration files are only written upon successful installation, preventing partial setups after failures (e.g., backports, CUDA repo).
- Improved hardware detection helpers (`_is_hybrid_laptop`, `_get_nvidia_arch_family`). Prevents false positives on multi-GPU desktops by verifying iGPU presence alongside dGPU.
- Updated Java/Minecraft support in `modules/extras/java.sh`. Added Temurin 25 ("Minecraft 26+") to the runtime selection menu and updated documentation.
- Enhanced utility robustness (`_run_cmd`, `_configure_lightdm`). Properly propagates exit codes from commands and handles failures gracefully (yellow warnings + skip) instead of crashing under `set -e`.
- LightDM Overhaul: Rewrote `install_lightdm()` logic to verify both lightdm and lightdm-gtk-gtk-greeter-settings. Now installs the trio in a single command if missing, skipping only when fully present. Added "Enable autologin" option modifying `/etc/lightdm/lightdm.conf` with robust `sed` patterns for `SUDO_USER`. Fixed missing `debconf-set-selections` to ensure LightDM is set as default during installation.
- GDM3 Implementation: Created a new sub-menu in `modules/desktop_display.sh` allowing independent installation of GDM3, User List toggle (hide/show), Autologin configuration via `/etc/gdm3/daemon.conf`, and conditional "Force Enable Wayland on NVIDIA" for Debian 12/13 using udev symlinks.
- SDDM Integration: Added SDDM as option 3 in the Display Manager menu. Implemented automatic session detection (Wayland > X11) to populate `/etc/sddm.conf.d/autologin.conf` without user input, defaulting to plasmawayland, lxqt-wayland, or generic fallbacks.
- greetd support: Added conditional support for Debian 12 and 13 only. Implemented sub-menu with base install, recommended `tuigreet` (with backports handling for Bookworm), and other manual setup options (`gtkgreet`, `nwg-hello`, `wlgreet`) exclusive to Trixie.
- ZRAM UX Improvements: Updated descriptions in `modules/zram.sh` to explicitly mention I/O reduction and responsiveness benefits for low-RAM systems (e.g., 4GB). Cleaned up compression algorithm labels (`lz4`, `zstd`) to remove redundancy in menu values.
- General Code Quality: Standardized all user-facing messages to English across modules. Ensured independent package installation checks prevent script abortion if one DM fails, while maintaining strict error handling for system configurations.
- update docs and readme
- System Time (NTP)*: Overhauled `modules/utils.sh`. `check_system_time()` now warns if year < 2025 and enables NTP silently if off but valid. `sync_system_time()` conditionally installs/starts `systemd-timesyncd` and verifies synchronization via `timedatectl NTPSynchronized`.
- LightDM Configuration: Added `_configure_lightdm()` to ensure the user list is visible in the greeter. Installs `lightdm-gtk-greeter-settings` and creates an override config (`99-show-users.conf`) during startup without interrupting the flow.
- Wine Installation: Simplified Wine setup in `system.sh` and Bullseye `extras.sh`. Removed i386 multiarch logic; now installs only `wine64 fonts-wine`. Added post-install version verification to confirm successful deployment.
- Lutris Dependencies: Updated `install_lutris()` in `tools.sh` and `legacy.sh`. Now conditionally adds `wine32` only if the system supports i386 architectures, preventing dependency failures on 64-bit-only setups.
- Boot Rescue Module: Created new standalone `modules/rescue.sh`. Provides UEFI boot repair tools: Secure Boot refirm (shim + GRUB) and Initramfs regeneration for all kernels. Integrated into the main menu as a dedicated rescue section.
- update docs
- Added `_detect_lang()` helper to `modules/utils.sh` (extracts first 2 chars from `$LANG`, fallback to `en`).
- Created `_detect_lang_pkg()` utility for LibreOffice localization: handles regional variants (`es-ar` → `es`) and skips English packages.
- Implemented `_check_network()` with cascade methods (ping→wget→curl) in `modules/utils.sh`. Warning-only pre-flight check after `check_sudo` in `debianito.sh`, compatible with `set -euo pipefail`.
- Fixed system time validation: changed `2026` threshold to `2025` in `check_system_time()` (replaced self-referential `$(date +%Y)` which always evaluated false).
- Refactored LibreOffice language selection in `office.sh`: replaced 10 lines of inline logic with `_detect_lang_pkg "libreoffice-l10n"`.
- Overhauled Firefox ESR integration in `internet.sh`: added state detection, mutual exclusion guard (both Firefox variants selected → warning), new `install_firefox_esr()` function with language support.
- Updated `install_firefox_mozilla()`: added Debian version guard (`<12`), replaced `_run_install` with `_run_cmd`.
- Standardized header in internet menu and improved whiptail UX for Firefox options.
- NVIDIA CUDA extrepo refactor in `modules/gpu/nvidia.sh`: removed unnecessary `i386_active` lines, updated warning to reference `v590 (unified metapackage)`, simplified installation from 18+10 versioned packages → `nvidia-driver-pinning-590 nvidia-driver firmware-nvidia-gsp`, eliminated `apt-mark hold` since pinning packages now handle it. DKMS verification and `NVIDIA_DRIVER_MODE="cuda-repo"` preserved.
- CUDA repo case fix in `modules/gaming.sh`: replaced silent bypass with detection of `nvidia-driver-libs:i386` v590 installation; if missing, prompts user confirmation before installing via active CUDA repo + pinning.
- Palemoon internet module overhaul (`modules/extras/internet/internet.sh`): removed deprecated `_enable_palemoon_repo()`, created new `install_palemoon()` with AVX2→AVX→SSE2 CPU detection from `/proc/cpuinfo`, proper `extrepo enable` call, and package installation.
- ProtonVPN module rewrite (`modules/extras/internet/internet.sh`): removed broken `_enable_protonvpn_repo()` that failed due to missing suite; created new `install_protonvpn()` using `stable` suite + `proton-vpn-gtk-app` package with proper validation.
- Java/Minecraft rename across `modules/gaming.sh` and `modules/extras/java.sh`: renamed `_install_gaming_java()` → `install_minecraft_java()`, updated menu title from "Java Runtimes for Gaming" to "Java Runtimes for Minecraft", changed whiptail tag from `"java-jre"` to `"java"`.
- RetroArch + 4 classic cores (`modules/gaming/tools.sh` and `.sh`): added RetroArch entry to gaming menu, new case handler in `gaming.sh`, updated installation command to include `libretro-mgba libretro-snes9x libretro-nestopia libretro-gambatte`, enhanced notice with emojis, core enumeration, DFSG warning, and wiki link.
- OnlyOffice server status (`modules/extras/office/office.sh`): added fallback message for slow or down OnlyOffice servers to improve user experience during installation.
- Full syntax validation: all modified files pass `bash -n` without errors; no residual references to old variables (`i386_active`, `590.48.01`) or functions remain.
- Documentation about Debian and the script is added to supplement important information.
- update README.md
stornic56