X-Git-Url: http://git.grml.org/?p=grml-live.git;a=blobdiff_plain;f=grml-live;h=daa4da952c92f0c69846c6925596e196232091b4;hp=00321211b36dedb705b7ce8a5d6d3e9d4d5769fd;hb=HEAD;hpb=7beda7dae5063c45ab57c061bcfb27e13fd704ea

diff --git a/grml-live b/grml-live
index 0032121..72fe591 100755
--- a/grml-live
+++ b/grml-live
@@ -43,7 +43,7 @@ $PN - build process script for generating a (grml based) Linux Live-ISO
 
 Usage: $PN [options, see as follows]
 
-   -a <architecture>       architecture; available values: i386 and amd64
+   -a <architecture>       architecture; available values: i386, amd64 + arm64
    -A                      clean build directories before and after running
    -b                      build the ISO without updating the chroot via FAI
    -B                      build the ISO without touching the chroot (skips cleanup)
@@ -164,6 +164,7 @@ umount_all() {
    # make sure we don't leave any mounts - FAI doesn't remove them always
    umount $CHROOT_OUTPUT/proc/sys/fs/binfmt_misc 2>/dev/null || /bin/true
    umount $CHROOT_OUTPUT/proc 2>/dev/null || /bin/true
+   umount $CHROOT_OUTPUT/run/udev 2>/dev/null || /bin/true
    umount $CHROOT_OUTPUT/run  2>/dev/null || /bin/true
    umount $CHROOT_OUTPUT/sys  2>/dev/null || /bin/true
    umount $CHROOT_OUTPUT/dev/pts 2>/dev/null || /bin/true
@@ -183,6 +184,24 @@ umount_all() {
 }
 # }}}
 
+# store logfiles {{{
+store_logfiles() {
+  # move fai logs into grml_logs directory
+  mkdir -p "$LOG_OUTPUT"/fai/
+  cp -r "$CHROOT_OUTPUT"/var/log/fai/"$HOSTNAME"/last/* "$LOG_OUTPUT"/fai/
+  rm -rf "$CHROOT_OUTPUT"/var/log/fai
+
+  # store copy of autogenerated configuration file
+  cp ${GRML_FAI_CONFIG}/nfsroot.conf "$LOG_OUTPUT"/fai/
+
+  # copy fai package list
+  cp "$CHROOT_OUTPUT"/var/log/install_packages.list "$LOG_OUTPUT"/fai/
+  # fixup owners
+  chown root:adm "$LOG_OUTPUT"/fai/*
+  chmod 664 "$LOG_OUTPUT"/fai/*
+}
+# }}}
+
 # clean exit {{{
 bailout() {
   rm -f /var/run/fai/fai_softupdate_is_running \
@@ -202,7 +221,6 @@ bailout() {
 
   # get rid of automatically generated conffiles
   rm -f ${GRML_FAI_CONFIG}/nfsroot.conf
-  rm -f ${GRML_FAI_CONFIG}/make-fai-nfsroot.conf
 
   if [ -n "$CHOWN_USER" ]; then
     log "Setting ownership"
@@ -309,6 +327,54 @@ copy_addon_file() {
   msg="Missing addon file: \"$1\""
   ewarn "$msg" ; eend 1
   log "copy_addon_file: $msg"
+  return 1
+}
+
+# replace placeholders in template files with actual information
+adjust_boot_files() {
+  if [ -z "$1" ] ; then
+    echo "Usage: adjust_boot_files <template_file>" >&2
+    exit 1
+  fi
+
+  local release_info
+  if [ -n "${RELEASE_INFO:-}" ] ; then
+    release_info="${RELEASE_INFO}"
+  else
+    ewarn "Variable RELEASE_INFO is unset, applying fallback for usage in adjust_boot_files." ; eend 1
+    release_info="$GRML_NAME $VERSION - Release Codename $RELEASENAME"
+  fi
+
+  # ensure this has a specific length
+  local fixed_release_info
+  fixed_release_info="$(cut_string 68 "$release_info")"
+  fixed_release_info="$(extend_string_end 68 "$fixed_release_info")"
+
+  for file in "$@" ; do
+    if [ -r "${file}" ] && [ -f "${file}" ] ; then
+      sed -i "s/%ARCH%/$ARCH/g"                    "${file}"
+      sed -i "s/%DATE%/$DATE/g"                    "${file}"
+      sed -i "s/%DISTRI_INFO%/$DISTRI_INFO/g"      "${file}"
+      sed -i "s/%DISTRI_NAME%/$DISTRI_NAME/g"      "${file}"
+      sed -i "s/%DISTRI_SPLASH%/$DISTRI_SPLASH/g"  "${file}"
+      sed -i "s/%GRML_NAME%/$GRML_NAME/g"          "${file}"
+      sed -i "s/%SQUASHFS_NAME%/$SQUASHFS_NAME/g"  "${file}"
+      sed -i "s/%RELEASE_INFO%/$fixed_release_info/g" "${file}"
+      sed -i "s/%SHORT_NAME%/$SHORT_NAME/g"        "${file}"
+      sed -i "s/%VERSION%/$VERSION/g"              "${file}"
+      if [ -n "${BOOT_FILE}" ] ; then
+        sed -i "s;%BOOT_FILE%;$BOOT_FILE;g"        "${file}"
+      fi
+
+      [ -n "$DEFAULT_BOOTOPTIONS" ] && sed -i "s; boot=live; boot=live $DEFAULT_BOOTOPTIONS;"  "${file}"
+
+      if [ -n "$NO_BOOTID" ] ; then
+        sed -i "s/ bootid=%BOOTID%//g" "${file}" # drop bootid bootoption
+      else
+        sed -i "s/%BOOTID%/$BOOTID/g" "${file}" # adjust bootid=... argument
+      fi
+    fi
+  done
 }
 # }}}
 
@@ -394,6 +460,8 @@ fi
 [ -n "$HOSTNAME" ]                || HOSTNAME='grml'
 [ -n "$HYBRID_METHOD" ]           || HYBRID_METHOD='isohybrid'
 [ -n "$RELEASENAME" ]             || RELEASENAME='grml-live rocks'
+[ -n "$SECURE_BOOT" ]             || SECURE_BOOT='disable'
+[ -n "$SQUASHFS_BINARY" ]         || SQUASHFS_BINARY='mksquashfs'
 [ -n "$SQUASHFS_EXCLUDES_FILE" ]  || SQUASHFS_EXCLUDES_FILE="${GRML_FAI_CONFIG}/config/grml/squashfs-excludes"
 [ -n "$SUITE" ]                   || SUITE='testing'
 [ -n "$TEMPLATE_DIRECTORY" ]      || TEMPLATE_DIRECTORY='/usr/share/grml-live/templates'
@@ -402,7 +470,7 @@ fi
 [ -n "$VERSION" ]                 || VERSION='0.0.1'
 
 # output specific stuff, depends on $OUTPUT (iff not set):
-[ -n "$OUTPUT" ]           || OUTPUT='./grml/'
+[ -n "$OUTPUT" ]           || OUTPUT="$PWD/grml/"
 [ -n "$BUILD_OUTPUT" ]     || BUILD_OUTPUT="$OUTPUT/grml_cd"
 [ -n "$CHROOT_OUTPUT" ]    || CHROOT_OUTPUT="$OUTPUT/grml_chroot"
 [ -n "$ISO_OUTPUT" ]       || ISO_OUTPUT="$OUTPUT/grml_isos"
@@ -417,6 +485,12 @@ specify it on the command line using the -c option."
 [ -n "$OUTPUT" ] || bailout 1 "Error: \$OUTPUT unset, please set it in $LIVE_CONF or
 specify it on the command line using the -o option."
 
+if [[ "$(dpkg --print-architecture)" != "arm64" ]] && [[ "$ARCH" == "arm64" ]] ; then
+  eerror "Failure: trying to build for arm64, but not running on arm64."
+  eend 1
+  bailout
+fi
+
 # trim characters that are known to cause problems inside $GRML_NAME;
 # for example isolinux does not like '-' inside the directory name
 [ -n "$GRML_NAME" ] && export SHORT_NAME="$(echo $GRML_NAME | tr -d ',./;\- ')"
@@ -426,6 +500,7 @@ specify it on the command line using the -o option."
 [ -n "$RELEASENAME" ] && export RELEASENAME="$RELEASENAME"
 # }}}
 
+
 # ZERO_LOGFILE - check for backwards compatibility reasons {{{
 # this was default behaviour until grml-live 0.9.34:
 if [ -n "$ZERO_LOGFILE" ] ; then
@@ -457,6 +532,7 @@ if [ -z "$FORCE" ] ; then
    [ -n "$ARCH" ]                && echo "  Architecture:      $ARCH"
    [ -n "$BOOT_METHOD" ]         && echo "  Boot method:       $BOOT_METHOD"
    [ -n "$HYBRID_METHOD" ]       && echo "  Hybrid method:     $HYBRID_METHOD"
+   [ -n "$SECURE_BOOT" ]         && echo "  Secure Boot:       $SECURE_BOOT"
    [ -n "$TEMPLATE_DIRECTORY" ]  && echo "  Template files:    $TEMPLATE_DIRECTORY"
    [ -n "$CHROOT_INSTALL" ]      && echo "  Install files from directory to chroot:  $CHROOT_INSTALL"
    [ -n "$BOOTID" ]              && echo "  Boot identifier:   $BOOTID"
@@ -543,7 +619,8 @@ if [ -n "$CONFIG" ] ; then
    fi
 fi
 
-start_seconds=$(cut -d . -f 1 /proc/uptime)
+SECONDS=unknown
+start_seconds="$(date +%s)"
 log "------------------------------------------------------------------------------"
 log "Starting grml-live [${GRML_LIVE_VERSION}] run on $(date)"
 log "Using local config file: $LOCAL_CONFIG"
@@ -555,7 +632,7 @@ einfo "Logging actions to logfile $LOGFILE"
 
 # dump config variables into file, for script access {{{
 CONFIGDUMP=$(mktemp)
-set | egrep \
+set | grep -E \
   '^(GRML_NAME|RELEASENAME|DATE|VERSION|SUITE|ARCH|DISTRI_NAME|USERNAME|HOSTNAME|APT_PROXY)=' \
   > ${CONFIGDUMP}
 # }}}
@@ -616,20 +693,28 @@ export SUITE # make sure it's available in FAI scripts
 # architecture (option), otherwise installation of kernel will fail
 if echo $CLASSES | grep -qw I386 ; then
    if ! [[ "$ARCH" == "i386" ]] ; then
-      log    "Error: You specified the I386 class but are trying to build something else (AMD64?)."
-      eerror "Error: You specified the I386 class but are trying to build something else (AMD64?)."
+      log    "Error: You specified the I386 class but are trying to build something else (AMD64/ARM64?)."
+      eerror "Error: You specified the I386 class but are trying to build something else (AMD64/ARM64?)."
       eerror "Tip:   Either invoke grml-live with '-a i386' or adjust the architecture class. Exiting."
       eend 1
       bailout
    fi
 elif echo $CLASSES | grep -qi amd64 ; then
    if ! [[ "$ARCH" == "amd64" ]] ; then
-      log    "Error: You specified the AMD64 class but are trying to build something else (I386?)."
-      eerror "Error: You specified the AMD64 class but are trying to build something else (I386?)."
+      log    "Error: You specified the AMD64 class but are trying to build something else (I386/ARM64?)."
+      eerror "Error: You specified the AMD64 class but are trying to build something else (I386/ARM64?)."
       eerror "Tip:   Either invoke grml-live with '-a amd64' or adjust the architecture class. Exiting."
       eend 1
       bailout
    fi
+elif echo $CLASSES | grep -qi arm64 ; then
+   if ! [[ "$ARCH" == "arm64" ]] ; then
+      log    "Error: You specified the ARM64 class but are trying to build something else (I386/AMD64?)."
+      eerror "Error: You specified the ARM64 class but are trying to build something else (I386/AMD64?)."
+      eerror "Tip:   Either invoke grml-live with '-a arm64' or adjust the architecture class. Exiting."
+      eend 1
+      bailout
+   fi
 fi
 
 # generate nfsroot configuration for FAI on the fly
@@ -642,16 +727,7 @@ if [ -z "$FAI_DEBOOTSTRAP" ] ; then
 fi
 
 if [ -z "$FAI_DEBOOTSTRAP_OPTS" ] ; then
-  FAI_DEBOOTSTRAP_OPTS="--exclude=info,tasksel,tasksel-data --include=aptitude --arch $ARCH"
-fi
-
-# create backup of old (not yet automatically generated) config file
-if [ -f "${GRML_FAI_CONFIG}/make-fai-nfsroot.conf" ] ; then
-  if ! grep -q 'This is an automatically generated file by grml-live' "${GRML_FAI_CONFIG}/make-fai-nfsroot.conf" ; then
-    ewarn "Found old ${GRML_FAI_CONFIG}/make-fai-nfsroot.conf - moving to ${GRML_FAI_CONFIG}/make-fai-nfsroot.conf.outdated"
-    mv "${GRML_FAI_CONFIG}/make-fai-nfsroot.conf" "${GRML_FAI_CONFIG}/make-fai-nfsroot.conf.outdated"
-    eend $?
-  fi
+  FAI_DEBOOTSTRAP_OPTS="--exclude=info,tasksel,tasksel-data,isc-dhcp-client,isc-dhcp-common --include=aptitude --arch $ARCH"
 fi
 
 echo "# This is an automatically generated file by grml-live.
@@ -659,8 +735,6 @@ echo "# This is an automatically generated file by grml-live.
 FAI_DEBOOTSTRAP=\"$FAI_DEBOOTSTRAP\"
 FAI_DEBOOTSTRAP_OPTS=\"$FAI_DEBOOTSTRAP_OPTS\"
 # EOF " > "${GRML_FAI_CONFIG}/nfsroot.conf"
-# support FAI <=3.4.8, versions >=4.0 use nfsroot.conf
-( cd ${GRML_FAI_CONFIG} && ln -sf nfsroot.conf make-fai-nfsroot.conf )
 # }}}
 
 # CHROOT_OUTPUT - execute FAI {{{
@@ -707,9 +781,10 @@ else
       RC="$PIPESTATUS" # notice: bash-only
 
       if [ "$RC" != 0 ] ; then
-         log    "Error: critical error while executing fai [exit code ${RC}]. Exiting."
-         eerror "Error: critical error while executing fai [exit code ${RC}]. Exiting." ; eend 1
-         bailout 1
+        store_logfiles  # ensure to have logfiles available even if building failed
+        log    "Error: critical error while executing fai [exit code ${RC}]. Exiting."
+        eerror "Error: critical error while executing fai [exit code ${RC}]. Exiting." ; eend 1
+        bailout 1
       fi
 
       # provide inform fai about the ISO we build, needs to be provided
@@ -721,19 +796,7 @@ else
 
       FORCE_ISO_REBUILD=true
 
-      # move fai logs into grml_logs directory
-      mkdir -p "$LOG_OUTPUT"/fai/
-      cp -r "$CHROOT_OUTPUT"/var/log/fai/"$HOSTNAME"/last/* "$LOG_OUTPUT"/fai/
-      rm -rf "$CHROOT_OUTPUT"/var/log/fai
-
-      # store copy of autogenerated configuration file
-      cp ${GRML_FAI_CONFIG}/nfsroot.conf "$LOG_OUTPUT"/fai/
-
-      # copy fai package list
-      cp "$CHROOT_OUTPUT"/var/log/install_packages.list "$LOG_OUTPUT"/fai/
-      # fixup owners
-      chown root:adm "$LOG_OUTPUT"/fai/*
-      chmod 664 "$LOG_OUTPUT"/fai/*
+      store_logfiles
 
       umount_all
 
@@ -749,10 +812,16 @@ else
          grep 'Unable to write mmap - msync (28 No space left on device)' $CHECKLOG/software.log >> $LOGFILE && ERROR=5
       fi
 
+      # FAI versions <6.0 used to write to shell.log
       if [ -r "$CHECKLOG/shell.log" ] ; then
          grep 'FAILED with exit code' $CHECKLOG/shell.log >> $LOGFILE && ERROR=6
       fi
 
+      # FAI versions >=6.0 always writes to scripts.log
+      if [ -r "$CHECKLOG/scripts.log" ] ; then
+         grep 'FAILED with exit code' $CHECKLOG/scripts.log >> $LOGFILE && ERROR=6
+      fi
+
       if [ -r "$CHECKLOG/fai.log" ] ; then
         grep 'updatebase.*FAILED with exit code' "$CHECKLOG/fai.log" >> "$LOGFILE" && ERROR=7
         grep 'instsoft.*FAILED with exit code'   "$CHECKLOG/fai.log" >> "$LOGFILE" && ERROR=8
@@ -850,328 +919,521 @@ EOF
 fi
 # }}}
 
+# grub boot {{{
+grub_setup() {
+  EFI_IMG="/boot/efi.img"
+
+  local efi_size
+  if [[ "${SECURE_BOOT:-}" == "disable" ]] || [[ "${ARCH:-}" == "i386" ]] ; then
+    efi_size='4M'
+  else
+    # e.g. templates/EFI/debian for Secure Boot has >4MB and needs more space
+    efi_size='8M'
+  fi
+
+  if [[ "$ARCH" == "amd64" ]] || [[ "$ARCH" == "arm64" ]] ; then
+    case "$ARCH" in
+      arm64)
+        BOOTX64="/boot/bootaa64.efi"
+        ;;
+      amd64)
+        BOOTX64="/boot/bootx64.efi"
+        ;;
+    esac
+
+    # important: this depends on execution of ${GRML_FAI_CONFIG}/config/scripts/GRMLBASE/45-grub-images
+    if ! [ -r "${CHROOT_OUTPUT}/${BOOTX64}" ] ; then
+      log    "Can not access GRUB efi image ${CHROOT_OUTPUT}/${BOOTX64}, required for Secure Boot support"
+      eerror "Can not access GRUB efi image ${CHROOT_OUTPUT}/${BOOTX64}, required for Secure Boot support" ; eend 1
+      log    "Possible reason is failure to run ${GRML_FAI_CONFIG}/config/scripts/GRMLBASE/45-grub-images"
+      ewarn  "Possible reason is failure to run ${GRML_FAI_CONFIG}/config/scripts/GRMLBASE/45-grub-images"
+      bailout 50
+    fi
+
+    dd if=/dev/zero of="${CHROOT_OUTPUT}/${EFI_IMG}" bs="${efi_size}" count=1 2>/dev/null || bailout 50
+    mkfs.vfat -n GRML "${CHROOT_OUTPUT}/${EFI_IMG}" >/dev/null || bailout 51
+    mmd -i "${CHROOT_OUTPUT}/${EFI_IMG}" ::EFI || bailout 52
+    mmd -i "${CHROOT_OUTPUT}/${EFI_IMG}" ::EFI/BOOT || bailout 52
+
+    if [ "${SECURE_BOOT:-}" = "disable" ] ; then
+      log   "Secure Boot is disabled."
+      einfo "Secure Boot is disabled." ; eend 0
+
+      # install "$BOOTX64" as ::EFI/BOOT/{bootx64.efi|bootaa64.efi} inside image file "$EFI_IMG":
+      case "$ARCH" in
+        arm64)
+          mcopy -i "${CHROOT_OUTPUT}/${EFI_IMG}" "${CHROOT_OUTPUT}/${BOOTX64}" ::EFI/BOOT/bootaa64.efi >/dev/null || bailout 53
+          ;;
+        amd64)
+          mcopy -i "${CHROOT_OUTPUT}/${EFI_IMG}" "${CHROOT_OUTPUT}/${BOOTX64}" ::EFI/BOOT/bootx64.efi >/dev/null || bailout 53
+          ;;
+      esac
+
+      log   "Generated 64-bit EFI image $BOOTX64"
+      einfo "Generated 64-bit EFI image $BOOTX64" ; eend 0
+    else
+      case "${SECURE_BOOT}" in
+        disable*)
+          log   "Secure Boot is disabled [mode: ${SECURE_BOOT}]"
+          einfo "Secure Boot is disabled [mode: ${SECURE_BOOT}]" ; eend 0
+          ;;
+        debian|ubuntu)
+          log   "Secure Boot is enabled [mode: ${SECURE_BOOT}]"
+          einfo "Secure Boot is enabled [mode: ${SECURE_BOOT}]" ; eend 0
+
+          local GRUBCFG_TEMPLATE="${TEMPLATE_DIRECTORY}/secureboot/grub.cfg"
+          local GRUBCFG_TMP=$(mktemp)
+
+          if ! [ -r "${GRUBCFG_TEMPLATE}" ] ; then
+            log    "Secure Boot template for GRUB [${GRUBCFG_TEMPLATE}] not found."
+            eerror "Secure Boot template for GRUB [${GRUBCFG_TEMPLATE}] not found." ; eend 1
+            bailout 54
+          fi
+
+          cp "${GRUBCFG_TEMPLATE}" "${GRUBCFG_TMP}"
+          adjust_boot_files "${GRUBCFG_TMP}"
+
+          mmd -i "${CHROOT_OUTPUT}/${EFI_IMG}" ::boot      || bailout 55
+          mmd -i "${CHROOT_OUTPUT}/${EFI_IMG}" ::boot/grub || bailout 55
+          mcopy -i "${CHROOT_OUTPUT}/${EFI_IMG}" "${GRUBCFG_TMP}" ::boot/grub/grub.cfg || bailout 56
+
+          rm "${GRUBCFG_TMP}"
+
+          if [ -r "${TEMPLATE_DIRECTORY}/EFI/${SECURE_BOOT}/BOOT/grubx64.efi.signed" ] ; then
+            mcopy -i "${CHROOT_OUTPUT}/${EFI_IMG}" "${TEMPLATE_DIRECTORY}/EFI/${SECURE_BOOT}/BOOT/grubx64.efi.signed" ::EFI/BOOT/grubx64.efi >/dev/null || bailout 57
+          else
+            log    "Secure Boot GRUB binary '${TEMPLATE_DIRECTORY}/EFI/${SECURE_BOOT}/BOOT/grubx64.efi.signed' not found."
+            eerror "Secure Boot GRUB binary '${TEMPLATE_DIRECTORY}/EFI/${SECURE_BOOT}/BOOT/grubx64.efi.signed' not found." ; eend 1
+            bailout 57
+          fi
+
+          if [ -r "${TEMPLATE_DIRECTORY}/EFI/${SECURE_BOOT}/BOOT/shimx64.efi.signed" ] ; then
+            mcopy -i "${CHROOT_OUTPUT}/${EFI_IMG}" "${TEMPLATE_DIRECTORY}/EFI/${SECURE_BOOT}/BOOT/shimx64.efi.signed" ::EFI/BOOT/bootx64.efi >/dev/null || bailout 58
+          else
+            log    "Secure Boot GRUB binary '${TEMPLATE_DIRECTORY}/EFI/${SECURE_BOOT}/BOOT/shimx64.efi.signed' not found."
+            eerror "Secure Boot GRUB binary '${TEMPLATE_DIRECTORY}/EFI/${SECURE_BOOT}/BOOT/shimx64.efi.signed' not found." ; eend 1
+            bailout 57
+          fi
+
+          log   "Generated 64-bit Secure Boot (${SECURE_BOOT}) EFI image ${CHROOT_OUTPUT}/${EFI_IMG}"
+          einfo "Generated 64-bit Secure Boot (${SECURE_BOOT}) EFI image ${CHROOT_OUTPUT}/${EFI_IMG}" ; eend 0
+          ;;
+        *)
+          log   "Secure Boot method '${SECURE_BOOT}' is unsupported."
+          eerror "Secure Boot method '${SECURE_BOOT}' is unsupported." ; eend 1
+          bailout 59
+          ;;
+      esac
+    fi
+  fi
+
+  if [[ "$ARCH" == "i386" ]] ; then
+    BOOTX32="/boot/bootia32.efi"
+    if ! [ -r "${CHROOT_OUTPUT}/${BOOTX32}" ] ; then
+      log    "Can not access GRUB efi image ${CHROOT_OUTPUT}/${BOOTX32}."
+      eerror "Can not access GRUB efi image ${CHROOT_OUTPUT}/${BOOTX32}." ; eend 1
+      log    "Possible reason is failure to run ${GRML_FAI_CONFIG}/config/scripts/GRMLBASE/45-grub-images"
+      ewarn "Possible reason is failure to run ${GRML_FAI_CONFIG}/config/scripts/GRMLBASE/45-grub-images"
+      bailout 50
+    fi
+
+    dd if=/dev/zero of="${CHROOT_OUTPUT}/${EFI_IMG}" bs="${efi_size}" count=1 2>/dev/null || bailout 50
+    mkfs.vfat -n GRML "${CHROOT_OUTPUT}/${EFI_IMG}" >/dev/null || bailout 51
+    mmd -i "${CHROOT_OUTPUT}/${EFI_IMG}" ::EFI || bailout 52
+    mmd -i "${CHROOT_OUTPUT}/${EFI_IMG}" ::EFI/BOOT || bailout 52
+    mcopy -i "${CHROOT_OUTPUT}/${EFI_IMG}" "${CHROOT_OUTPUT}/${BOOTX32}" ::EFI/BOOT/bootia32.efi >/dev/null || bailout 53
+    log   "Generated 32-bit EFI image $BOOTX32"
+    einfo "Generated 32-bit EFI image $BOOTX32" ; eend 0
+  fi
+}
+# }}}
+
 # BUILD_OUTPUT - execute arch specific stuff and squashfs {{{
 [ -n "$BUILD_OUTPUT" ] || BUILD_OUTPUT="$OUTPUT/grml_cd"
 mkdir -p "$BUILD_OUTPUT" || bailout 6 "Problem with creating $BUILD_OUTPUT for stage ARCH"
 
 # prepare ISO
-if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] ; then
+if [ "$ARCH" = i386 ] || [ "$ARCH" = amd64 ] || [ "$ARCH" = arm64 ] ; then
   if [ -n "$BOOTSTRAP_ONLY" ] ; then
-     log   "Skipping stage 'boot' as building with bootstrap only."
-     ewarn "Skipping stage 'boot' as building with bootstrap only." ; eend 0
+    log   "Skipping stage 'boot' as building with bootstrap only."
+    ewarn "Skipping stage 'boot' as building with bootstrap only." ; eend 0
   else
-    if [ -d "$BUILD_OUTPUT"/boot/isolinux -a -z "$UPDATE" -a -z "$BUILD_ONLY" ] ; then
-       log   "Skipping stage 'boot' as $BUILD_OUTPUT/boot/isolinux exists already."
-       ewarn "Skipping stage 'boot' as $BUILD_OUTPUT/boot/isolinux exists already." ; eend 0
+    # booting stuff:
+    mkdir -p "$BUILD_OUTPUT"/boot/isolinux
+    mkdir -p "$BUILD_OUTPUT"/boot/"${SHORT_NAME}"
+
+    # this is a variable we're using for adjusting boot templates, not only in
+    # adjust_boot_files though, so set here
+    RELEASE_INFO="$GRML_NAME $VERSION - Release Codename $RELEASENAME"
+
+    # if we don't have an initrd we a) can't boot and b) there was an error
+    # during build, so check for the file:
+    INITRD="$(ls $CHROOT_OUTPUT/boot/initrd* 2>/dev/null| grep -v '.bak$' | sort -r | head -1)"
+    if [ -n "$INITRD" ] ; then
+      cp $INITRD "$BUILD_OUTPUT"/boot/"${SHORT_NAME}"/initrd.img
+      find $CHROOT_OUTPUT/boot/ -name initrd\*.bak -exec rm {} \;
     else
-       # booting stuff:
-       [ -d "$BUILD_OUTPUT"/boot/isolinux ] || mkdir -p "$BUILD_OUTPUT"/boot/isolinux
-       [ -d "$BUILD_OUTPUT"/boot/"${SHORT_NAME}" ] || mkdir -p "$BUILD_OUTPUT"/boot/"${SHORT_NAME}"
-
-       # if we don't have an initrd we a) can't boot and b) there was an error
-       # during build, so check for the file:
-       INITRD="$(ls $CHROOT_OUTPUT/boot/initrd* 2>/dev/null| grep -v '.bak$' | sort -r | head -1)"
-       if [ -n "$INITRD" ] ; then
-          cp $INITRD "$BUILD_OUTPUT"/boot/"${SHORT_NAME}"/initrd.img
-          find $CHROOT_OUTPUT/boot/ -name initrd\*.bak -exec rm {} \;
-       else
-          log    "Error: No initrd found inside $CHROOT_OUTPUT/boot/ - Exiting"
-          eerror "Error: No initrd found inside $CHROOT_OUTPUT/boot/ - Exiting" ; eend 1
-          bailout 10
-       fi
+      log    "Error: No initrd found inside $CHROOT_OUTPUT/boot/ - Exiting"
+      eerror "Error: No initrd found inside $CHROOT_OUTPUT/boot/ - Exiting" ; eend 1
+      bailout 10
+    fi
 
-       KERNEL_IMAGE="$(ls $CHROOT_OUTPUT/boot/vmlinuz* 2>/dev/null | sort -r | head -1)"
-       if [ -n "$KERNEL_IMAGE" ] ; then
-          cp "$KERNEL_IMAGE" "$BUILD_OUTPUT"/boot/"${SHORT_NAME}"/vmlinuz
-       else
-          log    "Error: No kernel found inside $CHROOT_OUTPUT/boot/ - Exiting"
-          eerror "Error: No kernel found inside $CHROOT_OUTPUT/boot/ - Exiting" ; eend 1
-          bailout 11
-       fi
+    KERNEL_IMAGE="$(ls $CHROOT_OUTPUT/boot/vmlinuz* 2>/dev/null | sort -r | head -1)"
+    if [ -n "$KERNEL_IMAGE" ] ; then
+      cp "$KERNEL_IMAGE" "$BUILD_OUTPUT"/boot/"${SHORT_NAME}"/vmlinuz
+    else
+      log    "Error: No kernel found inside $CHROOT_OUTPUT/boot/ - Exiting"
+      eerror "Error: No kernel found inside $CHROOT_OUTPUT/boot/ - Exiting" ; eend 1
+      bailout 11
+    fi
 
-       # EFI boot files
-       if [ -r "${CHROOT_OUTPUT}/boot/efi.img" -a -r "${CHROOT_OUTPUT}/boot/bootx64.efi" ] ; then
-          einfo "Moving EFI boot files into ISO path."
-          log "Moving EFI boot files into ISO path."
-          RC=$0
-          mv "${CHROOT_OUTPUT}/boot/efi.img" "${BUILD_OUTPUT}/boot/" || RC=$?
-          mkdir -p "${BUILD_OUTPUT}/efi/boot/" || RC=$?
-          mv "${CHROOT_OUTPUT}/boot/bootx64.efi" "${BUILD_OUTPUT}/efi/boot/bootx64.efi" || RC=$?
-          eend $?
-       fi
+    # we need to set "$BOOTID" before we invoke adjust_boot_files for the
+    # first time, being inside grub_setup below
+    if [ -n "$NO_BOOTID" ] ; then
+      log   'Skipping bootid feature as requested via $NO_BOOTID.'
+      einfo 'Skipping bootid feature as requested via $NO_BOOTID.'
+    else
+      [ -n "$BOOTID" ] || BOOTID="$(echo ${GRML_NAME}${VERSION} | tr -d ',./;\- ')"
+      mkdir -p "$BUILD_OUTPUT"/conf
+      einfo "Generating /conf/bootid.txt with entry ${BOOTID}."
+      log   "Generating /conf/bootid.txt with entry ${BOOTID}."
+      echo "$BOOTID" > "$BUILD_OUTPUT"/conf/bootid.txt
+      eend $?
+    fi
 
-       [ -n "$TEMPLATE_DIRECTORY" ] || TEMPLATE_DIRECTORY='/usr/share/grml-live/templates'
-       if ! [ -d "${TEMPLATE_DIRECTORY}"/boot ] ; then
-          log    "Error: ${TEMPLATE_DIRECTORY}/boot does not exist. Exiting."
-          eerror "Error: ${TEMPLATE_DIRECTORY}/boot does not exist. Exiting." ; eend 1
-          bailout 8
-       fi
+    # every recent Grml ISO ships a /conf/bootid.txt, though GRUB might find
+    # the /conf/bootid.txt of a different (Grml) ISO than the one that's
+    # supposed to be running, so within scripts/GRMLBASE/45-grub-images
+    # we generate a random filename, stored inside /boot/grub/bootfile.txt,
+    # which we place on the resulting ISO here
+    if [ -r "${CHROOT_OUTPUT}"/boot/grub/bootfile.txt ] ; then
+      mkdir -p "${BUILD_OUTPUT}"/conf
+      rm -f "${BUILD_OUTPUT}"/conf/bootfile*  # ensure we don't leave any old(er) files behind
+
+      einfo "Generating "${BUILD_OUTPUT}"/conf/bootfile* files"
+      log   "Generating "${BUILD_OUTPUT}"/conf/bootfile* files"
+
+      BOOT_FILE="/conf/bootfile_$(cat "${CHROOT_OUTPUT}"/boot/grub/bootfile.txt)"
+      echo "# This file is relevant for GRUB boot with the Grml ISO." > "${BUILD_OUTPUT}/${BOOT_FILE}"
+      # save information about the random filename inside /conf/bootfile.txt
+      echo "${BOOT_FILE}" > "${BUILD_OUTPUT}"/conf/bootfile.txt
+      eend $?
+    fi
 
-       # copy _required_ isolinux files
-       if [ -d "${CHROOT_OUTPUT}/usr/lib/ISOLINUX" ] ; then
-         copy_addon_file isolinux.bin /usr/lib/ISOLINUX isolinux
-         for file in ${CHROOT_OUTPUT}/usr/lib/syslinux/modules/bios/*.c32 ; do
-           copy_addon_file "$(basename "$file")"  /usr/lib/syslinux/modules/bios/ isolinux
-         done
-       else # syslinux versions <= 3:4.05+dfsg-6+deb8u1
-         copy_addon_file isolinux.bin /usr/lib/syslinux isolinux
-         copy_addon_file ifcpu64.c32  /usr/lib/syslinux isolinux
-         copy_addon_file vesamenu.c32 /usr/lib/syslinux isolinux
-       fi
+    grub_setup
+
+    # EFI boot files
+    if [ -r "${CHROOT_OUTPUT}/boot/efi.img" -a -r "${CHROOT_OUTPUT}/boot/bootaa64.efi" ] ; then
+      einfo "Copying 64-bit EFI boot files (arm64) into ISO path."
+      log   "Copying 64-bit EFI boot files (arm64) into ISO path."
+      RC=$0
+      cp "${CHROOT_OUTPUT}/boot/efi.img" "${BUILD_OUTPUT}/boot/" || RC=$?
+      mkdir -p "${BUILD_OUTPUT}/EFI/BOOT/" || RC=$?
+      cp "${CHROOT_OUTPUT}/boot/bootaa64.efi" "${BUILD_OUTPUT}/EFI/BOOT/bootaa64.efi" || RC=$?
+      eend $?
+    elif [ -r "${CHROOT_OUTPUT}/boot/efi.img" -a -r "${CHROOT_OUTPUT}/boot/bootx64.efi" ] ; then
+      einfo "Copying 64-bit EFI boot files (amd64) into ISO path."
+      log   "Copying 64-bit EFI boot files (amd64) into ISO path."
+      RC=$0
+      cp "${CHROOT_OUTPUT}/boot/efi.img" "${BUILD_OUTPUT}/boot/" || RC=$?
+      mkdir -p "${BUILD_OUTPUT}/EFI/BOOT/" || RC=$?
+      cp "${CHROOT_OUTPUT}/boot/bootx64.efi" "${BUILD_OUTPUT}/EFI/BOOT/bootx64.efi" || RC=$?
+      eend $?
+    elif [ -r "${CHROOT_OUTPUT}/boot/efi.img" -a -r "${CHROOT_OUTPUT}/boot/bootia32.efi" ] ; then
+      einfo "Copying 32-bit EFI boot files into ISO path."
+      log   "Copying 32-bit EFI boot files into ISO path."
+      RC=$0
+      cp "${CHROOT_OUTPUT}/boot/efi.img" "${BUILD_OUTPUT}/boot/" || RC=$?
+      mkdir -p "${BUILD_OUTPUT}/EFI/BOOT/" || RC=$?
+      cp "${CHROOT_OUTPUT}/boot/bootia32.efi" "${BUILD_OUTPUT}/EFI/BOOT/bootia32.efi" || RC=$?
+      eend $?
+    else
+      ewarn "No EFI boot files found, skipping." ; eend 0
+    fi
 
-       # *always* copy files to output directory so the variables
-       # get adjusted according to the build.
-       cp ${TEMPLATE_DIRECTORY}/boot/isolinux/*  "$BUILD_OUTPUT"/boot/isolinux/
+    [ -n "$TEMPLATE_DIRECTORY" ] || TEMPLATE_DIRECTORY='/usr/share/grml-live/templates'
+    if ! [ -d "${TEMPLATE_DIRECTORY}"/boot ] ; then
+      log    "Error: ${TEMPLATE_DIRECTORY}/boot does not exist. Exiting."
+      eerror "Error: ${TEMPLATE_DIRECTORY}/boot does not exist. Exiting." ; eend 1
+      bailout 8
+    fi
 
-       mkdir -p "${BUILD_OUTPUT}/boot/grub"
-       cp -a ${TEMPLATE_DIRECTORY}/boot/grub/* "$BUILD_OUTPUT"/boot/grub/
+    # copy _required_ isolinux files
+    if [ -d "${CHROOT_OUTPUT}/usr/lib/ISOLINUX" ] ; then
+      copy_addon_file isolinux.bin /usr/lib/ISOLINUX isolinux
+      for file in ${CHROOT_OUTPUT}/usr/lib/syslinux/modules/bios/*.c32 ; do
+        copy_addon_file "$(basename "$file")"  /usr/lib/syslinux/modules/bios/ isolinux
+      done
+    else # syslinux versions <= 3:4.05+dfsg-6+deb8u1
+      copy_addon_file isolinux.bin /usr/lib/syslinux isolinux
+      copy_addon_file ifcpu64.c32  /usr/lib/syslinux isolinux
+      copy_addon_file vesamenu.c32 /usr/lib/syslinux isolinux
+    fi
 
-       if [ -n "$NO_ADDONS" ] ; then
-          rm -f "$BUILD_OUTPUT"/boot/grub/addons.cfg
-          log   "Skipping installation of boot addons as requested via \$NO_ADDONS."
-          einfo "Skipping installation of boot addons as requested via \$NO_ADDONS."; eend 0
-       else
-          if ! [ -d "$TEMPLATE_DIRECTORY"/boot/addons ] ; then
-            log   "Boot addons not found, skipping therefore. (Consider installing package grml-live-addons)"
-            ewarn "Boot addons not found, skipping therefore. (Consider installing package grml-live-addons)" ; eend 0
-          else
-            # copy addons from system packages or grml-live-addons
-            copy_addon_file ipxe.lkrn /usr/lib/ipxe addons
-            copy_addon_file pci.ids /usr/share/misc addons
-            copy_addon_file memtest86+.bin /boot addons
-
-            # since syslinux(-common) v3:6.03~pre1+dfsg-4 the files are in a
-            # different directory :(
-            if [ -d "${CHROOT_OUTPUT}/usr/lib/syslinux/modules/bios/" ] ; then
-              syslinux_modules_dir=/usr/lib/syslinux/modules/bios/
-            else
-              syslinux_modules_dir=/usr/lib/syslinux
-            fi
-            for file in chain.c32 hdt.c32 mboot.c32 menu.c32; do
-              copy_addon_file "${file}" "${syslinux_modules_dir}" addons
-            done
-
-            copy_addon_file memdisk /usr/lib/syslinux addons
+    # *always* copy files to output directory so the variables
+    # get adjusted according to the build.
+    cp ${TEMPLATE_DIRECTORY}/boot/isolinux/*  "$BUILD_OUTPUT"/boot/isolinux/
 
-            # make memtest filename FAT16/8.3 compatible
-            mv "${BUILD_OUTPUT}/boot/addons/memtest86+.bin" \
-              "${BUILD_OUTPUT}/boot/addons/memtest"
-
-            # copy only files so we can handle bsd4grml on its own
-            for file in ${TEMPLATE_DIRECTORY}/boot/addons/* ; do
-              test -f $file && cp $file "$BUILD_OUTPUT"/boot/addons/
-            done
-
-            if [ -n "$NO_ADDONS_BSD4GRML" ] ; then
-               log   "Skipping installation of bsd4grml as requested via \$NO_ADDONS_BSD4GRML."
-               einfo "Skipping installation of bsd4grml as requested via \$NO_ADDONS_BSD4GRML."; eend 0
-            else
-               if [ -d "$TEMPLATE_DIRECTORY"/boot/addons/bsd4grml ] ; then
-                 cp -a ${TEMPLATE_DIRECTORY}/boot/addons/bsd4grml "$BUILD_OUTPUT"/boot/addons/
-               else
-                 log   "Missing addon file: bsd4grml"
-                 ewarn "Missing addon file: bsd4grml" ; eend 0
-               fi
-            fi
-
-          fi # no "$TEMPLATE_DIRECTORY"/boot/addons
-       fi # NO_ADDONS
-
-       # generate loopback.cfg config file without depending on grub's regexp module
-       # which isn't available in Debian/squeeze
-       echo "## grub2 loopback configuration" > "${BUILD_OUTPUT}"/boot/grub/loopback.cfg
-       echo "source /boot/grub/header.cfg" >> "${BUILD_OUTPUT}"/boot/grub/loopback.cfg
-       for config in "${BUILD_OUTPUT}"/boot/grub/*_default.cfg "${BUILD_OUTPUT}"/boot/grub/*_options.cfg ; do
-         [ -r "$config" ] || continue
-         echo "source ${config##$BUILD_OUTPUT}" >> "${BUILD_OUTPUT}"/boot/grub/loopback.cfg
-       done
-       if [ -z "$NO_ADDONS" ] ; then
-         echo "source /boot/grub/addons.cfg" >> "${BUILD_OUTPUT}"/boot/grub/loopback.cfg
-       fi
-       echo "source /boot/grub/footer.cfg" >> "${BUILD_OUTPUT}"/boot/grub/loopback.cfg
-
-       # copy grub files from target
-       mkdir -p "${BUILD_OUTPUT}"/boot/grub/i386-pc/
-       cp -a "${CHROOT_OUTPUT}"/usr/lib/grub/*-pc/*.mod "${BUILD_OUTPUT}"/boot/grub/i386-pc/
-       cp -a "${CHROOT_OUTPUT}"/usr/lib/grub/*-pc/*.o "${BUILD_OUTPUT}"/boot/grub/i386-pc/
-       cp -a "${CHROOT_OUTPUT}"/usr/lib/grub/*-pc/*.lst "${BUILD_OUTPUT}"/boot/grub/i386-pc/
-       cp -a "${CHROOT_OUTPUT}"/usr/share/grub/ascii.pf2 "${BUILD_OUTPUT}"/boot/grub/
-       cp -a "${CHROOT_OUTPUT}"/boot/grub/core.img "${BUILD_OUTPUT}"/boot/grub/
-       cp -a "${CHROOT_OUTPUT}"/boot/grub/grub.img "${BUILD_OUTPUT}"/boot/grub/
-
-       # copy modules for UEFI grub
-       mkdir -p "${BUILD_OUTPUT}"/boot/grub/x86_64-efi/
-       cp -a "${CHROOT_OUTPUT}"/usr/lib/grub/x86_64-efi/*.{mod,lst} "${BUILD_OUTPUT}"/boot/grub/x86_64-efi/
-
-       if ! [ -d "${TEMPLATE_DIRECTORY}"/GRML ] ; then
-          log    "Error: ${TEMPLATE_DIRECTORY}/GRML does not exist. Exiting."
-          eerror "Error: ${TEMPLATE_DIRECTORY}/GRML does not exist. Exiting." ; eend 1
-          bailout 9
-       fi
+    mkdir -p "${BUILD_OUTPUT}/boot/grub"
+    cp -a ${TEMPLATE_DIRECTORY}/boot/grub/* "$BUILD_OUTPUT"/boot/grub/
 
-       mkdir -p "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/
-       cp -a ${TEMPLATE_DIRECTORY}/GRML/* "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/
+    if [ -n "$NO_ADDONS" ] ; then
+      rm -f "$BUILD_OUTPUT"/boot/grub/addons.cfg
+      log   "Skipping installation of boot addons as requested via \$NO_ADDONS."
+      einfo "Skipping installation of boot addons as requested via \$NO_ADDONS."; eend 0
+    else
+      if ! [ -r "$TEMPLATE_DIRECTORY"/boot/addons ] ; then
+        log   "Boot addons not found, skipping therefore. (Consider installing package grml-live-addons)"
+        ewarn "Boot addons not found, skipping therefore. (Consider installing package grml-live-addons)" ; eend 0
+      else
+        log   "Installing boot addons."
+        einfo "Installing boot addons."
+
+        # copy addons from system packages or grml-live-addons
+        copy_addon_file ipxe.lkrn /usr/lib/ipxe addons
+        copy_addon_file ipxe.efi /usr/lib/ipxe addons
+        copy_addon_file pci.ids /usr/share/misc addons
+
+        # memtest86+ >=6.00-1
+        if [[ "$ARCH" == "amd64" ]] ; then
+          copy_addon_file memtest86+x64.efi /boot addons
+        elif [[ "$ARCH" == "i386" ]] ; then
+          copy_addon_file memtest86+ia32.efi /boot addons
+        fi
 
-       # adjust boot splash information:
-       RELEASE_INFO="$GRML_NAME $VERSION - Release Codename $RELEASENAME"
-       RELEASE_INFO="$(cut_string 68 "$RELEASE_INFO")"
-       RELEASE_INFO="$(extend_string_end 68 "$RELEASE_INFO")"
+        # provide memtest86+ >=6.00-1 files as "memtest" file
+        # for BIOS boot in isolinux/syslinux
+        if ! [ -r "${BUILD_OUTPUT}/boot/addons/memtest" ] ; then
+          if [[ "$ARCH" == "amd64" ]] ; then
+            copy_addon_file memtest86+x64.bin /boot addons &&
+            # make memtest filename FAT16/8.3 compatible
+            mv "${BUILD_OUTPUT}/boot/addons/memtest86+x64.bin" \
+               "${BUILD_OUTPUT}/boot/addons/memtest"
+          elif [[ "$ARCH" == "i386" ]] ; then
+            copy_addon_file memtest86+ia32.bin /boot addons &&
+            # make memtest filename FAT16/8.3 compatible
+            mv "${BUILD_OUTPUT}/boot/addons/memtest86+ia32.bin" \
+               "${BUILD_OUTPUT}/boot/addons/memtest"
+          fi
+        fi
 
-       if [ -r "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/grml-version ] ; then
-          sed -i "s/%RELEASE_INFO%/$GRML_NAME $VERSION - $RELEASENAME/" "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/grml-version
-          sed -i "s/%DATE%/$DATE/"                                      "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/grml-version
-       fi
+        # fallback: if we still don't have /boot/addons/memtest available, we
+        # might have an older memtest86+ version (<=5.01-3.1) which ships
+        # file "memtest86+.bin" instead
+        if ! [ -r "${BUILD_OUTPUT}/boot/addons/memtest" ] ; then
+          copy_addon_file memtest86+.bin /boot addons &&
+          # make memtest filename FAT16/8.3 compatible
+          mv "${BUILD_OUTPUT}/boot/addons/memtest86+.bin" \
+             "${BUILD_OUTPUT}/boot/addons/memtest"
+        fi
 
-       # make sure the squashfs filename is set accordingly:
-       SQUASHFS_NAME="$GRML_NAME.squashfs"
+        # since syslinux(-common) v3:6.03~pre1+dfsg-4 the files are in a
+        # different directory :(
+        if [ -d "${CHROOT_OUTPUT}/usr/lib/syslinux/modules/bios/" ] ; then
+          syslinux_modules_dir=/usr/lib/syslinux/modules/bios/
+        else
+          syslinux_modules_dir=/usr/lib/syslinux
+        fi
+        for file in chain.c32 hdt.c32 mboot.c32 menu.c32; do
+          copy_addon_file "${file}" "${syslinux_modules_dir}" addons
+        done
 
-       if [ -n "$NO_BOOTID" ] ; then
-          log   'Skipping bootid feature as requested via $NO_BOOTID.'
-          einfo 'Skipping bootid feature as requested via $NO_BOOTID.'
-       else
-          [ -n "$BOOTID" ] || BOOTID="$(echo ${GRML_NAME}${VERSION} | tr -d ',./;\- ')"
-          [ -d "$BUILD_OUTPUT"/conf ] || mkdir "$BUILD_OUTPUT"/conf
-          einfo "Generating /conf/bootid.txt with entry ${BOOTID}."
-          log   "Generating /conf/bootid.txt with entry ${BOOTID}."
-          echo "$BOOTID" > "$BUILD_OUTPUT"/conf/bootid.txt
-          eend $?
-       fi
+        copy_addon_file memdisk /usr/lib/syslinux addons
 
-       # adjust all variables in the templates with the according distribution information
-       for file in "${BUILD_OUTPUT}"/boot/isolinux/*.cfg "${BUILD_OUTPUT}"/boot/isolinux/*.msg \
-                   "${BUILD_OUTPUT}"/boot/grub/* ; do
-         if [ -r "${file}" ] && [ -f "${file}" ] ; then
-           sed -i "s/%ARCH%/$ARCH/g"                    "${file}"
-           sed -i "s/%DATE%/$DATE/g"                    "${file}"
-           sed -i "s/%DISTRI_INFO%/$DISTRI_INFO/g"      "${file}"
-           sed -i "s/%DISTRI_NAME%/$DISTRI_NAME/g"      "${file}"
-           sed -i "s/%DISTRI_SPLASH%/$DISTRI_SPLASH/g"  "${file}"
-           sed -i "s/%GRML_NAME%/$GRML_NAME/g"          "${file}"
-           sed -i "s/%SQUASHFS_NAME%/$SQUASHFS_NAME/g"  "${file}"
-           sed -i "s/%RELEASE_INFO%/$RELEASE_INFO/g"    "${file}"
-           sed -i "s/%SHORT_NAME%/$SHORT_NAME/g"        "${file}"
-           sed -i "s/%VERSION%/$VERSION/g"              "${file}"
-
-           [ -n "$DEFAULT_BOOTOPTIONS" ] && sed -i "s; boot=live; boot=live $DEFAULT_BOOTOPTIONS;"  "${file}"
-
-           if [ -n "$NO_BOOTID" ] ; then
-              sed -i "s/ bootid=%BOOTID%//g" "${file}" # drop bootid bootoption
-           else
-              sed -i "s/%BOOTID%/$BOOTID/g" "${file}" # adjust bootid=... argument
-           fi
-         fi
-       done
-
-       for param in ARCH DATE DISTRI_INFO DISTRI_NAME DISTRI_SPLASH GRML_NAME SQUASHFS_NAME \
-           RELEASE_INFO SHORT_NAME VERSION ; do
-           for file in $(find "${BUILD_OUTPUT}" -name "*%$param%*") ; do
-               value="$(eval echo '$'"$param")"
-               mv ${file} ${file/\%${param}\%/$value}
-           done
-       done
-
-       # adjust bootsplash accordingly but make sure the string has the according lenght
-       SQUASHFS_NAME="$(cut_string 20 "$SQUASHFS_NAME")"
-       SQUASHFS_NAME="$(extend_string_end 20 "$SQUASHFS_NAME")"
-       for file in f4 f5 ; do
-          if [ -r "${BUILD_OUTPUT}/boot/isolinux/${file}" ] ; then
-             sed -i "s/%SQUASHFS_NAME%/$SQUASHFS_NAME/" "${BUILD_OUTPUT}/boot/isolinux/${file}"
-             sed -i "s/%SQUASHFS_NAME%/$SQUASHFS_NAME/" "${BUILD_OUTPUT}/boot/isolinux/${file}"
-          fi
-       done
-
-       # generate addon list
-       rm -f "${BUILD_OUTPUT}/${ADDONS_LIST_FILE}"
-       for name in "${BUILD_OUTPUT}"/boot/isolinux/addon_*.cfg ; do
-         include_name=$(basename "$name")
-         echo "include $include_name"  >> "${BUILD_OUTPUT}/${ADDONS_LIST_FILE}"
-       done
-
-       if ! [ -r "${BUILD_OUTPUT}/boot/isolinux/${DISTRI_NAME}.cfg" ] || [ "$DISTRI_NAME" = "grml" ] ; then
-          log "including grmlmain.cfg in ${BUILD_OUTPUT}/boot/isolinux/distri.cfg"
-          echo "include grmlmain.cfg"    >  "${BUILD_OUTPUT}/boot/isolinux/distri.cfg"
-          echo "include default.cfg"     >  "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
-          echo "include menuoptions.cfg" >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
-          echo "include grml.cfg"        >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
-
-          for f in "${BUILD_OUTPUT}"/boot/isolinux/submenu*.cfg ; do
-            echo "include $(basename $f)"     >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
-          done
-
-          echo "include options.cfg"     >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
-          if [ -z "$NO_ADDONS" ] ; then
-            echo "include addons.cfg"    >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
-          fi
-          echo "include isoprompt.cfg"   >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
-          echo "include hd.cfg"          >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
-          echo "include hidden.cfg"      >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
-       else # assume we are building a custom distribution:
-          log "File ${BUILD_OUTPUT}/boot/isolinux/${DISTRI_NAME}.cfg found, using it."
-          einfo "File ${BUILD_OUTPUT}/boot/isolinux/${DISTRI_NAME}.cfg found, using it."
-          if grep -q "^include ${DISTRI_NAME}.cfg" "${BUILD_OUTPUT}/boot/isolinux/distri.cfg" ; then
-            log "include for ${DISTRI_NAME}.cfg already present, nothing to do."
-            eindent
-            einfo "include for ${DISTRI_NAME}.cfg already present, nothing to do."
-            eoutdent
-            eend $?
-         else
-            log "including ${DISTRI_NAME}.cfg in ${BUILD_OUTPUT}/boot/isolinux/distri.cfg"
-            echo "include ${DISTRI_NAME}.cfg" > "${BUILD_OUTPUT}/boot/isolinux/distri.cfg"
-            if [ -z "$NO_ADDONS" ] ; then
-              echo "include addons.cfg" >> "${BUILD_OUTPUT}/boot/isolinux/distri.cfg"
-            fi
-          fi
-       fi
+        # copy only files so we can handle bsd4grml on its own
+        for file in ${TEMPLATE_DIRECTORY}/boot/addons/* ; do
+          test -f $file && cp $file "$BUILD_OUTPUT"/boot/addons/
+        done
 
-       # use old style console based isolinux method only if requested:
-       if [[ "${ISOLINUX_METHOD}" == "console" ]] ; then
-          log 'Using console based isolinux method as requested via $ISOLINUX_METHOD.'
-          einfo 'Using console based isolinux method as requested via $ISOLINUX_METHOD.'
-          if grep -q '^include console.cfg' "${BUILD_OUTPUT}/boot/isolinux/distri.cfg" ; then
-            einfo "include for console.cfg already found, nothing to do."
-            eend 0
-          else
-            log "including console.cfg in ${BUILD_OUTPUT}/boot/isolinux/isolinux.cfg"
-            einfo "including console.cfg in ${BUILD_OUTPUT}/boot/isolinux/isolinux.cfg"
-            echo "include console.cfg" >> "${BUILD_OUTPUT}/boot/isolinux/isolinux.cfg"
-            eend $?
-          fi
-       else
-          log 'Using graphical boot menu.'
-          if grep -q '^include vesamenu.cfg' "${BUILD_OUTPUT}/boot/isolinux/isolinux.cfg" ; then
-            log "include for vesamenu.cfg already found, nothing to do."
+        eend 0
+
+        if [ -n "$NO_ADDONS_BSD4GRML" ] ; then
+          log   "Skipping installation of bsd4grml as requested via \$NO_ADDONS_BSD4GRML."
+          einfo "Skipping installation of bsd4grml as requested via \$NO_ADDONS_BSD4GRML."; eend 0
+        else
+          if [ -d "$TEMPLATE_DIRECTORY"/boot/addons/bsd4grml ] ; then
+            cp -a ${TEMPLATE_DIRECTORY}/boot/addons/bsd4grml "$BUILD_OUTPUT"/boot/addons/
           else
-            log "including vesamenu.cfg in ${BUILD_OUTPUT}/boot/isolinux/isolinux.cfg"
-            echo "include vesamenu.cfg" >> "${BUILD_OUTPUT}/boot/isolinux/isolinux.cfg"
+            log   "Missing addon file: bsd4grml"
+            ewarn "Missing addon file: bsd4grml" ; eend 0
           fi
-       fi
+        fi
 
-       if [ -e "$BUILD_OUTPUT"/boot/addons/bsd4grml/boot.6 ]; then
-          sed -i "s/%RELEASE_INFO%/$GRML_NAME $VERSION - $RELEASENAME/" "$BUILD_OUTPUT"/boot/addons/bsd4grml/boot.6
-       fi
+      fi # no "$TEMPLATE_DIRECTORY"/boot/addons
+    fi # NO_ADDONS
+
+    # generate loopback.cfg config file without depending on grub's regexp module
+    # which isn't available in Debian/squeeze
+    echo "## grub2 loopback configuration" > "${BUILD_OUTPUT}"/boot/grub/loopback.cfg
+    echo "source /boot/grub/header.cfg" >> "${BUILD_OUTPUT}"/boot/grub/loopback.cfg
+    for config in "${BUILD_OUTPUT}"/boot/grub/*_default.cfg "${BUILD_OUTPUT}"/boot/grub/*_options.cfg ; do
+      [ -r "$config" ] || continue
+      echo "source ${config##$BUILD_OUTPUT}" >> "${BUILD_OUTPUT}"/boot/grub/loopback.cfg
+    done
+    if [ -z "$NO_ADDONS" ] ; then
+      echo "source /boot/grub/addons.cfg" >> "${BUILD_OUTPUT}"/boot/grub/loopback.cfg
+    fi
+    echo "source /boot/grub/footer.cfg" >> "${BUILD_OUTPUT}"/boot/grub/loopback.cfg
+
+    # copy modules for GRUB
+    if [ "${ARCH}" = "arm64" ] ; then
+      mkdir -p "${BUILD_OUTPUT}"/boot/grub/arm64-efi/
+      cp -a "${CHROOT_OUTPUT}"/usr/lib/grub/arm64-efi/*.mod "${BUILD_OUTPUT}"/boot/grub/arm64-efi/
+      cp -a "${CHROOT_OUTPUT}"/usr/lib/grub/arm64-efi/*.lst "${BUILD_OUTPUT}"/boot/grub/arm64-efi/
+      # NOTE: usage of /boot/grub/core.img + /boot/grub/grub.img unclear yet
+    elif [ "${ARCH}" = "amd64" ] || [ "${ARCH}" = "i386" ] ; then
+      # grub-pc-bin
+      mkdir -p "${BUILD_OUTPUT}"/boot/grub/i386-pc/
+      cp -a "${CHROOT_OUTPUT}"/usr/lib/grub/*-pc/*.mod  "${BUILD_OUTPUT}"/boot/grub/i386-pc/
+      cp -a "${CHROOT_OUTPUT}"/usr/lib/grub/*-pc/*.o    "${BUILD_OUTPUT}"/boot/grub/i386-pc/
+      cp -a "${CHROOT_OUTPUT}"/usr/lib/grub/*-pc/*.lst  "${BUILD_OUTPUT}"/boot/grub/i386-pc/
+
+      # grub-efi-amd64-bin
+      mkdir -p "${BUILD_OUTPUT}"/boot/grub/x86_64-efi/
+      cp -a "${CHROOT_OUTPUT}"/usr/lib/grub/x86_64-efi/*.{mod,lst} "${BUILD_OUTPUT}"/boot/grub/x86_64-efi/
+
+      # grub-efi-ia32-bin
+      mkdir -p "${BUILD_OUTPUT}"/boot/grub/i386-efi/
+      cp -a "${CHROOT_OUTPUT}"/usr/lib/grub/i386-efi/*.{mod,lst} "${BUILD_OUTPUT}"/boot/grub/i386-efi/
+
+      cp -a "${CHROOT_OUTPUT}"/boot/grub/core.img       "${BUILD_OUTPUT}"/boot/grub/
+      cp -a "${CHROOT_OUTPUT}"/boot/grub/grub.img       "${BUILD_OUTPUT}"/boot/grub/
+    fi
 
-       DPKG_LIST="/var/log/fai/$HOSTNAME/last/dpkg.list" # the dpkg --list output of the chroot
-       if ! [ -r "$DPKG_LIST" ] ; then
-          ewarn "$DPKG_LIST could not be read, ignoring to store package information on ISO therefore."
-       else
-          einfo "Storing package list information as /GRML/${GRML_NAME}/packages.txt on ISO."
-          cp "$DPKG_LIST" "${BUILD_OUTPUT}"/GRML/"${GRML_NAME}"/packages.txt
-          eend $?
-       fi
+    # arch independent files
+    cp -a "${CHROOT_OUTPUT}"/usr/share/grub/ascii.pf2     "${BUILD_OUTPUT}"/boot/grub/
+    cp -a "${CHROOT_OUTPUT}"/usr/share/grub/unicode.pf2   "${BUILD_OUTPUT}"/boot/grub/  # clarify
 
-       # autostart for Windows:
-       if [ -d "${TEMPLATE_DIRECTORY}/windows/autostart/" ] ; then
-          cp ${TEMPLATE_DIRECTORY}/windows/autostart/* "$BUILD_OUTPUT"/
-       fi
+    if ! [ -d "${TEMPLATE_DIRECTORY}"/GRML ] ; then
+      log    "Error: ${TEMPLATE_DIRECTORY}/GRML does not exist. Exiting."
+      eerror "Error: ${TEMPLATE_DIRECTORY}/GRML does not exist. Exiting." ; eend 1
+      bailout 9
+    fi
+
+    mkdir -p "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/
+    cp -a ${TEMPLATE_DIRECTORY}/GRML/* "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/
+
+    if [ -r "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/grml-version ] ; then
+      sed -i "s/%RELEASE_INFO%/$RELEASE_INFO/" "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/grml-version
+      sed -i "s/%DATE%/$DATE/"                 "$BUILD_OUTPUT"/GRML/"${GRML_NAME}"/grml-version
+    fi
+
+    # make sure the squashfs filename is set accordingly:
+    SQUASHFS_NAME="$GRML_NAME.squashfs"
+    # adjust bootsplash accordingly but make sure the string has the according length
+    fixed_squashfs_name="$(cut_string 20 "$SQUASHFS_NAME")"
+    fixed_squashfs_name="$(extend_string_end 20 "$fixed_squashfs_name")"
+    for file in f4 f5 ; do
+      if [ -r "${BUILD_OUTPUT}/boot/isolinux/${file}" ] ; then
+        sed -i "s/%SQUASHFS_NAME%/${fixed_squashfs_name}/" "${BUILD_OUTPUT}/boot/isolinux/${file}"
+        sed -i "s/%SQUASHFS_NAME%/${fixed_squashfs_name}/" "${BUILD_OUTPUT}/boot/isolinux/${file}"
+      fi
+    done
+
+    # adjust all variables in the templates with the according distribution information
+    adjust_boot_files "${BUILD_OUTPUT}"/boot/isolinux/*.cfg \
+      "${BUILD_OUTPUT}"/boot/isolinux/*.msg \
+      "${BUILD_OUTPUT}"/boot/grub/*
+
+    for param in ARCH DATE DISTRI_INFO DISTRI_NAME DISTRI_SPLASH GRML_NAME SQUASHFS_NAME \
+      RELEASE_INFO SHORT_NAME VERSION ; do
+      for file in $(find "${BUILD_OUTPUT}" -name "*%$param%*") ; do
+        value="$(eval echo '$'"$param")"
+        mv ${file} ${file/\%${param}\%/$value}
+      done
+    done
+
+    # generate addon list
+    rm -f "${BUILD_OUTPUT}/${ADDONS_LIST_FILE}"
+    for name in "${BUILD_OUTPUT}"/boot/isolinux/addon_*.cfg ; do
+      include_name=$(basename "$name")
+      echo "include $include_name"  >> "${BUILD_OUTPUT}/${ADDONS_LIST_FILE}"
+    done
+
+    if ! [ -r "${BUILD_OUTPUT}/boot/isolinux/${DISTRI_NAME}.cfg" ] || [ "$DISTRI_NAME" = "grml" ] ; then
+      log "including grmlmain.cfg in ${BUILD_OUTPUT}/boot/isolinux/distri.cfg"
+      echo "include grmlmain.cfg"    >  "${BUILD_OUTPUT}/boot/isolinux/distri.cfg"
+      echo "include default.cfg"     >  "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
+      echo "include menuoptions.cfg" >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
+      echo "include grml.cfg"        >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
+
+      for f in "${BUILD_OUTPUT}"/boot/isolinux/submenu*.cfg ; do
+        echo "include $(basename $f)"     >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
+      done
+
+      echo "include options.cfg"     >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
+      if [ -z "$NO_ADDONS" ] ; then
+        echo "include addons.cfg"    >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
+      fi
+      echo "include isoprompt.cfg"   >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
+      echo "include hd.cfg"          >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
+      echo "include hidden.cfg"      >> "${BUILD_OUTPUT}/boot/isolinux/grmlmain.cfg"
+    else # assume we are building a custom distribution:
+      log "File ${BUILD_OUTPUT}/boot/isolinux/${DISTRI_NAME}.cfg found, using it."
+      einfo "File ${BUILD_OUTPUT}/boot/isolinux/${DISTRI_NAME}.cfg found, using it."
+      if grep -q "^include ${DISTRI_NAME}.cfg" "${BUILD_OUTPUT}/boot/isolinux/distri.cfg" ; then
+        log "include for ${DISTRI_NAME}.cfg already present, nothing to do."
+        eindent
+        einfo "include for ${DISTRI_NAME}.cfg already present, nothing to do."
+        eoutdent
+        eend $?
+      else
+        log "including ${DISTRI_NAME}.cfg in ${BUILD_OUTPUT}/boot/isolinux/distri.cfg"
+        echo "include ${DISTRI_NAME}.cfg" > "${BUILD_OUTPUT}/boot/isolinux/distri.cfg"
+        if [ -z "$NO_ADDONS" ] ; then
+          echo "include addons.cfg" >> "${BUILD_OUTPUT}/boot/isolinux/distri.cfg"
+        fi
+      fi
+    fi
+
+    # use old style console based isolinux method only if requested:
+    if [[ "${ISOLINUX_METHOD}" == "console" ]] ; then
+      log 'Using console based isolinux method as requested via $ISOLINUX_METHOD.'
+      einfo 'Using console based isolinux method as requested via $ISOLINUX_METHOD.'
+      if grep -q '^include console.cfg' "${BUILD_OUTPUT}/boot/isolinux/distri.cfg" ; then
+        einfo "include for console.cfg already found, nothing to do."
+        eend 0
+      else
+        log "including console.cfg in ${BUILD_OUTPUT}/boot/isolinux/isolinux.cfg"
+        einfo "including console.cfg in ${BUILD_OUTPUT}/boot/isolinux/isolinux.cfg"
+        echo "include console.cfg" >> "${BUILD_OUTPUT}/boot/isolinux/isolinux.cfg"
+        eend $?
+      fi
+    else
+      log 'Using graphical boot menu.'
+      if grep -q '^include vesamenu.cfg' "${BUILD_OUTPUT}/boot/isolinux/isolinux.cfg" ; then
+        log "include for vesamenu.cfg already found, nothing to do."
+      else
+        log "including vesamenu.cfg in ${BUILD_OUTPUT}/boot/isolinux/isolinux.cfg"
+        echo "include vesamenu.cfg" >> "${BUILD_OUTPUT}/boot/isolinux/isolinux.cfg"
+      fi
+    fi
+
+    if [ -e "$BUILD_OUTPUT"/boot/addons/bsd4grml/boot.6 ]; then
+      sed -i "s/%RELEASE_INFO%/$RELEASE_INFO/" "$BUILD_OUTPUT"/boot/addons/bsd4grml/boot.6
+    fi
+
+    DPKG_LIST="/var/log/fai/$HOSTNAME/last/dpkg.list" # the dpkg --list output of the chroot
+    if ! [ -r "$DPKG_LIST" ] ; then
+      ewarn "$DPKG_LIST could not be read, ignoring to store package information on ISO therefore."
+    else
+      einfo "Storing package list information as /GRML/${GRML_NAME}/packages.txt on ISO."
+      cp "$DPKG_LIST" "${BUILD_OUTPUT}"/GRML/"${GRML_NAME}"/packages.txt
+      eend $?
+    fi
+
+    # autostart for Windows:
+    if [ -d "${TEMPLATE_DIRECTORY}/windows/autostart/" ] ; then
+      cp ${TEMPLATE_DIRECTORY}/windows/autostart/* "$BUILD_OUTPUT"/
+    fi
 
     FORCE_ISO_REBUILD=true
     einfo "Finished execution of stage 'boot'" ; eend 0
-    fi
   fi # BOOTSTRAP_ONLY
 else
-   log    'Error: Unsupported ARCH, sorry. Want to support it? Contribute!'
-   eerror 'Error: Unsupported ARCH, sorry. Want to support it? Contribute!' ; eend 1
-   bailout
+  log    'Error: Unsupported ARCH, sorry. Want to support it? Contribute!'
+  eerror 'Error: Unsupported ARCH, sorry. Want to support it? Contribute!' ; eend 1
+  bailout
 fi
 
 # support installation of local files into the chroot/ISO
@@ -1200,11 +1462,6 @@ else
    # make sure we don't leave (even an empty) base.tgz:
    [ -f "$CHROOT_OUTPUT/base.tgz" ] && rm -f "$CHROOT_OUTPUT/base.tgz"
 
-   # if unconfigured default to squashfs-tools' mksquashfs binary
-   if [ -z "$SQUASHFS_BINARY" ] ; then
-      SQUASHFS_BINARY='mksquashfs'
-   fi
-
    if which "$SQUASHFS_BINARY" >/dev/null 2>&1 ; then
       log    "Using mksquashfs binary ${SQUASHFS_BINARY}"
       einfo  "Using mksquashfs binary ${SQUASHFS_BINARY}" ; eend 0
@@ -1216,8 +1473,8 @@ else
 
    # use sane defaults if $SQUASHFS_OPTIONS isn't set
    if [ -z "$SQUASHFS_OPTIONS" ] ; then
-     # use blocksize 256k as this gives best result with regards to time + compression
-     SQUASHFS_OPTIONS="-b 256k"
+     # use block size 1m as this gives good result with regards to time + compression
+     SQUASHFS_OPTIONS="-b 1m"
 
      # set lzma/xz compression by default, unless -z option has been specified on command line
      if [ -z "$SQUASHFS_ZLIB" ] ; then
@@ -1271,12 +1528,74 @@ if [ -z "$BOOTSTRAP_ONLY" ] ; then
 fi
 # }}}
 
+# information how the ISO was generated {{{
+# shellcheck disable=SC2034
+generate_build_info() {
+  jo -p \
+    boot_method="${BOOT_METHOD}" \
+    bootstrap_only="${BOOTSTRAP_ONLY}" \
+    build_date="${DATE}" \
+    build_dirty="${BUILD_DIRTY}" \
+    build_only="${BUILD_ONLY}" \
+    chroot_install="${CHROOT_INSTALL}" \
+    classes="${CLASSES}" \
+    clean_artifacts="${CLEAN_ARTIFACTS}" \
+    default_bootoptions="${DEFAULT_BOOTOPTIONS}" \
+    distri_info="${DISTRI_INFO}" \
+    distri_name="${DISTRI_NAME}" \
+    extract_iso_name="${EXTRACT_ISO_NAME}" \
+    fai_cmdline="BUILD_ONLY=${BUILD_ONLY} BOOTSTRAP_ONLY=${BOOTSTRAP_ONLY} GRML_LIVE_CONFIG=${CONFIGDUMP} WAYBACK_DATE=${WAYBACK_DATE} fai ${VERBOSE} -C ${GRML_FAI_CONFIG} -s file:///${GRML_FAI_CONFIG}/config -c${CLASSES} -u ${HOSTNAME} ${FAI_ACTION} ${CHROOT_OUTPUT} ${FAI_ARGS}" \
+    fai_version="$(fai --help 2>/dev/null | head -1 | awk '{print $2}' | sed 's/\.$//' || true)" \
+    grml_architecture="${ARCH}" \
+    grml_bootid="${BOOTID}" \
+    grml_build_output="${BUILD_OUTPUT}" \
+    grml_chroot_output="${CHROOT_OUTPUT}" \
+    grml_debian_version="${SUITE}" \
+    grml_iso_name="${ISO_NAME}" \
+    grml_iso_output="${ISO_OUTPUT}" \
+    grml_live_cmdline="${CMDLINE}" \
+    grml_live_config_file="${LIVE_CONF}" \
+    grml_live_scripts_directory="${SCRIPTS_DIRECTORY}" \
+    grml_live_template_directory="${TEMPLATE_DIRECTORY}" \
+    grml_live_version="${GRML_LIVE_VERSION}" \
+    grml_local_config="${LOCAL_CONFIG}" \
+    grml_name="${GRML_NAME}" \
+    grml_short_name="${SHORT_NAME}" \
+    grml_username="${USERNAME}" \
+    grml_version="${VERSION}" \
+    host_architecture="$(dpkg --print-architecture || true)" \
+    host_debian_version="$(cat /etc/debian_version 2>/dev/null || true)" \
+    host_kernel_version="$(uname -a)" \
+    hybrid_method="${HYBRID_METHOD}" \
+    mkisofs_cmdline="${MKISOFS} -V ${GRML_NAME} ${VERSION} -publisher 'grml-live | grml.org' -l -r -J ${BOOT_ARGS} ${EFI_ARGS} -no-pad -o ${ISO_OUTPUT}/${ISO_NAME}" \
+    mkisofs_version="$(${MKISOFS} --version 2>/dev/null | head -1 || true)" \
+    mksquashfs_cmdline="${SQUASHFS_BINARY} ${CHROOT_OUTPUT}/ ${BUILD_OUTPUT}/live/${GRML_NAME}/${GRML_NAME}.squashfs -noappend ${SQUASHFS_OPTIONS}" \
+    mksquashfs_version="$(${SQUASHFS_BINARY} -version | head -1 || true)" \
+    output_owner="${CHOWN_USER}" \
+    release_info="${RELEASE_INFO}" \
+    release_name="${RELEASENAME}" \
+    secure_boot="${SECURE_BOOT}" \
+    skip_mkisofs="${SKIP_MKISOFS}" \
+    skip_mksquashfs_="${SKIP_MKSQUASHFS}" \
+    skip_netboot="${SKIP_NETBOOT}" \
+    squashfs_name="${SQUASHFS_NAME}" \
+    template_directory="${TEMPLATE_DIRECTORY}" \
+    timestamp="$(TZ=UTC date +%s)" \
+    update_only="${UPDATE}" \
+    wayback_date="${WAYBACK_DATE}" \
+  --
+}
+# }}}
+
 # ISO_OUTPUT - mkisofs {{{
 [ -n "$ISO_OUTPUT" ] || ISO_OUTPUT="$OUTPUT/grml_isos"
 [ -n "$ISO_NAME" ] || ISO_NAME="${GRML_NAME}_${VERSION}.iso"
 
 if [ "$BOOT_METHOD" = "isolinux" ] ; then
    BOOT_ARGS="-no-emul-boot -boot-load-size 4 -boot-info-table -b boot/isolinux/isolinux.bin -c boot/isolinux/boot.cat"
+   if [ "$HYBRID_METHOD" = "isohybrid" ] ; then
+     EFI_ARGS="-isohybrid-mbr /usr/lib/ISOLINUX/isohdpfx.bin -eltorito-alt-boot -e boot/efi.img -no-emul-boot -isohybrid-gpt-basdat"
+   fi
 elif [ "$BOOT_METHOD" = "grub2" ] ; then
    BOOT_ARGS="-no-emul-boot -boot-load-size 4 -b boot/grub/toriboot.bin"
 fi
@@ -1350,10 +1669,27 @@ else
          echo 1 16 | mksh "${SCRIPTS_DIRECTORY}/bootgrub.mksh" -B 11 | \
             dd of=boot/grub/toriboot.bin conv=notrunc 2>/dev/null
       fi
-      log "$MKISOFS -V '${GRML_NAME} ${VERSION}' -publisher 'grml-live | grml.org' -l -r -J $BOOT_ARGS -o ${ISO_OUTPUT}/${ISO_NAME} ."
+
+      log   "Generating build information in conf/buildinfo.json"
+      einfo "Generating build information in conf/buildinfo.json"
+      mkdir -p conf/
+      generate_build_info > conf/buildinfo.json
+      eend $?
+
+      log "$MKISOFS -V '${GRML_NAME} ${VERSION}' -publisher 'grml-live | grml.org' -l -r -J $BOOT_ARGS $EFI_ARGS -no-pad -o ${ISO_OUTPUT}/${ISO_NAME} ."
+      einfo "Generating ISO file..."
       $MKISOFS -V "${GRML_NAME} ${VERSION}" -publisher 'grml-live | grml.org' \
-              -l -r -J $BOOT_ARGS -no-pad \
+              -l -r -J $BOOT_ARGS $EFI_ARGS -no-pad \
               -o "${ISO_OUTPUT}/${ISO_NAME}" . ; RC=$?
+      eend $RC
+
+      # do not continue on errors, otherwise we might generate/overwrite the ISO with dd if=... stuff
+      if [ "$RC" != 0 ] ; then
+        log    "Error: critical error while generating ISO [exit code ${RC}]. Exiting."
+        eerror "Error: critical error while generating ISO [exit code ${RC}]. Exiting." ; eend 1
+        bailout $RC
+      fi
+
       # both of these need core.img there, so it’s easier to write it here
       if [ "$BOOT_METHOD" = "grub2" ] || [ "$HYBRID_METHOD" = "grub2" ]; then
          # must be <= 30720 bytes
@@ -1400,50 +1736,18 @@ else
           eend $?
         fi
       elif [ "$HYBRID_METHOD" = "isohybrid" ] ; then
-        if ! which isohybrid >/dev/null 2>&1 ; then
-          bailout 12 "isohybrid binary not found - please install syslinux/syslinux-common/syslinux-utils"
-        else
-          log   "Creating hybrid ISO file with isohybrid method"
-          einfo "Creating hybrid ISO file with isohybrid method"
-          # Notes for consideration:
-          # "-entry 4 -type 1c"
-          # * using 4 as the partition number is supposed to help with BIOSes
-          #   that only support USB-Zip boot
-          # * using 1c (i.e. hidden FAT32 LBA), instead of the default 0x17
-          #   (hidden NTFS, IIRC), as the partition type is sometimes needed
-          #   to get the BIOS even look at the partition created by isohybrid
-          if isohybrid --help | grep -q -- --uefi ; then
-            if echo $CLASSES | grep -qw I386 ; then
-              log   "Detected uefi support for isohybrid but 32bit systems do not support it, ignoring."
-              einfo "Detected uefi support for isohybrid but 32bit systems do not support it, ignoring."
-            else
-              log   "Detected uefi support for isohybrid, enabling"
-              einfo "Detected uefi support for isohybrid, enabling"
-              ISOHYBRID_OPTIONS=--uefi
-            fi
-          fi
-
-          log "isohybrid $ISOHYBRID_OPTIONS ${ISO_OUTPUT}/${ISO_NAME}"
-          isohybrid $ISOHYBRID_OPTIONS "${ISO_OUTPUT}/${ISO_NAME}"
-          eend $?
-        fi
+        : # nothing to do, handled via $MKISOFS $EFI_ARGS already
       else
         bailout 12 "Unknown HYBRID_METHOD [${HYBRID_METHOD}]. Supported values: disable, isohybrid, grub2, manifold"
       fi
 
-      # generate md5sum and sha1sum of ISO if we are using class 'RELEASE':
+      # generate ISO checksums if we are using class 'RELEASE':
       case $CLASSES in *RELEASE*)
          [ "$RC" = 0 ] && \
          (
            if cd $ISO_OUTPUT ; then
-             md5sum ${ISO_NAME} > ${ISO_NAME}.md5 && \
-             touch -r ${ISO_NAME} ${ISO_NAME}.md5
-             sha1sum ${ISO_NAME} > ${ISO_NAME}.sha1 && \
-             touch -r ${ISO_NAME} ${ISO_NAME}.sha1
              sha256sum ${ISO_NAME} > ${ISO_NAME}.sha256 && \
              touch -r ${ISO_NAME} ${ISO_NAME}.sha256
-             sha512sum ${ISO_NAME} > ${ISO_NAME}.sha512 && \
-             touch -r ${ISO_NAME} ${ISO_NAME}.sha512
            fi
          )
          ;;
@@ -1465,7 +1769,7 @@ fi
 
 # netboot package {{{
 create_netbootpackage() {
-  local OUTPUT_FILE="${NETBOOT}/grml_netboot_package_${GRML_NAME}_${VERSION}.tar.bz2"
+  local OUTPUT_FILE="${NETBOOT}/grml_netboot_package_${GRML_NAME}_${VERSION}.tar"
 
   if [ -f "${OUTPUT_FILE}" -a -z "$UPDATE" -a -z "$BUILD_ONLY" -a -z "$BUILD_DIRTY" ] ; then
     log   "Skipping stage 'netboot' as $OUTPUT_FILE exists already."
@@ -1520,12 +1824,57 @@ create_netbootpackage() {
     eoutdent
   fi
 
-  if tar -C "$OUTPUTDIR" -jcf "${OUTPUT_FILE}" "grml_netboot_package_${GRML_NAME}_${VERSION}" ; then
+  # don't include shim + grubnetx64 + grub files in i386 netboot packages,
+  # as those don't make much sense there
+  if [ "$ARCH" = amd64 ] ; then
+    if ! [ -r "${BUILD_OUTPUT}/boot/grub/netboot.cfg" ] ; then
+      log   "File ${BUILD_OUTPUT}/boot/grub/netboot.cfg not found."
+      ewarn "File ${BUILD_OUTPUT}/boot/grub/netboot.cfg not found."
+      eindent
+      log   "Hint: Are you using custom templates which do not provide grub.cfg?"
+      ewarn "Hint: Are you using custom templates which do not provide grub.cfg?" ; eend 0
+      eoutdent
+    else
+      cp "${BUILD_OUTPUT}/boot/grub/netboot.cfg" "${WORKING_DIR}/grub.cfg"
+      adjust_boot_files "${WORKING_DIR}/grub.cfg"
+
+      if [ -r "${CHROOT_OUTPUT}"/usr/lib/shim/shimx64.efi.signed ] ; then
+        log "Installing ${CHROOT_OUTPUT}/usr/lib/shim/shimx64.efi.signed as shim.efi in netboot package"
+        cp "${CHROOT_OUTPUT}"/usr/lib/shim/shimx64.efi.signed "${WORKING_DIR}"/shim.efi
+      elif [ -r "${CHROOT_OUTPUT}"/usr/lib/shim/shimx64.efi ] ; then
+        log "Installing ${CHROOT_OUTPUT}/usr/lib/shim/shimx64.efi as shim.efi in netboot package"
+        cp "${CHROOT_OUTPUT}"/usr/lib/shim/shimx64.efi "${WORKING_DIR}"/shim.efi
+      else
+        log   "No shimx64.efi for usage with PXE boot found (shim-signed not present?)"
+        ewarn "No shimx64.efi for usage with PXE boot found (shim-signed not present?)" ; eend 0
+      fi
+
+      if [ -r "${CHROOT_OUTPUT}"/usr/lib/grub/x86_64-efi-signed/grubnetx64.efi.signed ] ; then
+        log "Installing /usr/lib/grub/x86_64-efi-signed/grubnetx64.efi.signed as grubx64.efi in netboot package"
+        cp "${CHROOT_OUTPUT}"/usr/lib/grub/x86_64-efi-signed/grubnetx64.efi.signed "${WORKING_DIR}"/grubx64.efi
+      elif [ -r "${CHROOT_OUTPUT}"/usr/lib/grub/x86_64-efi/monolithic/grubnetx64.efi ] ; then
+        log "Installing /usr/lib/grub/x86_64-efi/monolithic/grubnetx64.efi as grubx64.efi in netboot package"
+        cp "${CHROOT_OUTPUT}"/usr/lib/grub/x86_64-efi/monolithic/grubnetx64.efi "${WORKING_DIR}"/grubx64.efi
+      else
+        log   "No grubnetx64.efi for usage with PXE boot found (grub-efi-amd64-signed not present?)"
+        ewarn "No grubnetx64.efi for usage with PXE boot found (grub-efi-amd64-signed not present?)." ; eend 0
+      fi
+
+      if [ -r "${CHROOT_OUTPUT}"/usr/share/grub/unicode.pf2 ] ; then
+        log "Installing ${CHROOT_OUTPUT}/usr/share/grub/unicode.pf2 as grub/fonts/unicode.pf2 in netboot package"
+        mkdir -p "${WORKING_DIR}"/grub/fonts/
+        cp "${CHROOT_OUTPUT}"/usr/share/grub/unicode.pf2 "${WORKING_DIR}"/grub/fonts/
+      else
+        log   "No unicode.pf2 for usage with PXE boot found (grub-common not present?)"
+        ewarn "No unicode.pf2 for usage with PXE boot found (grub-common not present?)" ; eend 0
+      fi
+    fi
+  fi
+
+  if tar -C "$OUTPUTDIR" -cf "${OUTPUT_FILE}" "grml_netboot_package_${GRML_NAME}_${VERSION}" ; then
     (
       cd $(dirname "${OUTPUT_FILE}")
-      sha1sum $(basename "${OUTPUT_FILE}") > "${OUTPUT_FILE}.sha1"
       sha256sum $(basename "${OUTPUT_FILE}") > "${OUTPUT_FILE}.sha256"
-      sha512sum $(basename "${OUTPUT_FILE}") > "${OUTPUT_FILE}.sha512"
     )
     einfo "Generated netboot package ${OUTPUT_FILE}" ; eend 0
     rm -rf "${OUTPUTDIR}"
@@ -1586,7 +1935,10 @@ fi
 # }}}
 
 # finalize {{{
-[ -n "$start_seconds" ] && SECONDS="$[$(cut -d . -f 1 /proc/uptime)-$start_seconds]" || SECONDS="unknown"
+if [ -n "${start_seconds}" ] ; then
+  end_seconds="$(date +%s)"
+  SECONDS="$(( end_seconds - start_seconds ))"
+fi
 log "Successfully finished execution of $PN [$(date) - running ${SECONDS} seconds]"
 
 dpkg_to_db # make sure we catch the last log line as well, therefore execute between log + einfo