diff --git a/lib/functions/rootfs/create-cache.sh b/lib/functions/rootfs/create-cache.sh
index 8872f7c3c9..c3099170db 100644
--- a/lib/functions/rootfs/create-cache.sh
+++ b/lib/functions/rootfs/create-cache.sh
@@ -287,7 +287,7 @@ function create_new_rootfs_cache() {
 
 	# Mask `systemd-firstboot.service` which will prompt locale, timezone and root-password too early.
 	# `armbian-first-run` will do the same thing later
-	chroot $SDCARD /bin/bash -c "systemctl mask systemd-firstboot.service >/dev/null 2>&1"
+	chroot_sdcard systemctl mask systemd-firstboot.service
 
 	# stage: make rootfs cache archive
 	display_alert "Ending debootstrap process and preparing cache" "$RELEASE" "info"
diff --git a/lib/functions/rootfs/distro-agnostic.sh b/lib/functions/rootfs/distro-agnostic.sh
index a20257c684..edb06da4d9 100644
--- a/lib/functions/rootfs/distro-agnostic.sh
+++ b/lib/functions/rootfs/distro-agnostic.sh
@@ -15,6 +15,9 @@ function install_distribution_agnostic() {
 
 	fi
 
+	# Bail if $ROOTFS_TYPE not set
+	[[ -z $ROOTFS_TYPE ]] && exit_with_error "ROOTFS_TYPE not set" "install_distribution_agnostic"
+
 	# add dummy fstab entry to make mkinitramfs happy
 	echo "/dev/mmcblk0p1 / $ROOTFS_TYPE defaults 0 1" >> "${SDCARD}"/etc/fstab
 	# required for initramfs-tools-core on Stretch since it ignores the / fstab entry
@@ -94,7 +97,7 @@ function install_distribution_agnostic() {
 		sed "s/^parport_pc/#parport_pc/" -i "${SDCARD}"/etc/modules-load.d/cups-filters.conf
 	fi
 
-	# console fix due to Debian bug
+	# console fix due to Debian bug # @TODO: rpardini: still needed?
 	sed -e 's/CHARMAP=".*"/CHARMAP="'$CONSOLE_CHAR'"/g' -i "${SDCARD}"/etc/default/console-setup
 
 	# add the /dev/urandom path to the rng config file
@@ -103,15 +106,14 @@ function install_distribution_agnostic() {
 	# @TODO: security problem?
 	# ping needs privileged action to be able to create raw network socket
 	# this is working properly but not with (at least) Debian Buster
-	chroot "${SDCARD}" /bin/bash -c "chmod u+s /bin/ping" 2>&1
+	chroot_sdcard chmod u+s /bin/ping
 
 	# change time zone data
 	echo "${TZDATA}" > "${SDCARD}"/etc/timezone
-	# @TODO: a more generic logging helper needed
-	chroot "${SDCARD}" /bin/bash -c "dpkg-reconfigure -f noninteractive tzdata" 2>&1
+	chroot_sdcard dpkg-reconfigure -f noninteractive tzdata
 
-	# set root password
-	chroot "${SDCARD}" /bin/bash -c "(echo $ROOTPWD;echo $ROOTPWD;) | passwd root >/dev/null 2>&1"
+	# set root password. it is written to the log, of course. Escuse the escaping needed here.
+	chroot_sdcard "(" echo "'${ROOTPWD}'" ";" echo "'${ROOTPWD}'" ";" ")" "|" passwd root
 
 	# enable automated login to console(s)
 	if [[ $CONSOLE_AUTOLOGIN == yes ]]; then
@@ -133,7 +135,7 @@ function install_distribution_agnostic() {
 	# change console welcome text
 	echo -e "${VENDOR} ${REVISION} ${RELEASE^} \\l \n" > "${SDCARD}"/etc/issue
 	echo "${VENDOR} ${REVISION} ${RELEASE^}" > "${SDCARD}"/etc/issue.net
-	sed -i "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${VENDOR} $REVISION "${RELEASE^}"\"/" "${SDCARD}"/etc/os-release
+	sed -i "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${VENDOR} $REVISION ${RELEASE^}\"/" "${SDCARD}"/etc/os-release
 
 	# enable few bash aliases enabled in Ubuntu by default to make it even
 	sed "s/#alias ll='ls -l'/alias ll='ls -l'/" -i "${SDCARD}"/etc/skel/.bashrc
@@ -303,7 +305,7 @@ function install_distribution_agnostic() {
 			install_deb_chroot "${DEB_STORAGE}/${CHOSEN_UBOOT}_${REVISION}_${ARCH}.deb"
 		else
 			install_deb_chroot "linux-u-boot-${BOARD}-${BRANCH}" "remote" "yes" # @TODO: rpardini: this is completely different! "remote" "yes"
-			UBOOT_REPO_VERSION=$(dpkg-deb -f "${SDCARD}"/var/cache/apt/archives/linux-u-boot-${BOARD}-${BRANCH}*_${ARCH}.deb Version)
+			UBOOT_REPO_VERSION=$(dpkg-deb -f "${SDCARD}/var/cache/apt/archives/linux-u-boot-${BOARD}-${BRANCH}*_${ARCH}.deb" Version)
 		fi
 	}
 
@@ -430,8 +432,8 @@ function install_distribution_agnostic() {
 	# freeze armbian packages
 	if [[ $BSPFREEZE == yes ]]; then
 		display_alert "Freezing Armbian packages" "$BOARD" "info"
-		chroot "${SDCARD}" /bin/bash -c "apt-mark hold ${CHOSEN_KERNEL} ${CHOSEN_KERNEL/image/headers} \
-		linux-u-boot-${BOARD}-${BRANCH} ${CHOSEN_KERNEL/image/dtb}" 2>&1
+		# @TODO: rpardini: this will probably fail if one or more packages are not installed
+		chroot_sdcard apt-mark hold "${CHOSEN_KERNEL}" "${CHOSEN_KERNEL/image/headers}" "linux-u-boot-${BOARD}-${BRANCH}" "${CHOSEN_KERNEL/image/dtb}"
 	fi
 
 	# remove deb files
@@ -475,7 +477,8 @@ function install_distribution_agnostic() {
 	chroot_sdcard chmod u+s /usr/lib/dbus-1.0/dbus-daemon-launch-helper
 
 	# disable samba NetBIOS over IP name service requests since it hangs when no network is present at boot
-	chroot_sdcard systemctl --quiet disable nmbd
+	# @TODO: rpardini: still needed? people might want working Samba
+	disable_systemd_service_sdcard nmbd
 
 	# disable low-level kernel messages for non betas
 	if [[ -z $BETA ]]; then
diff --git a/lib/functions/rootfs/distro-specific.sh b/lib/functions/rootfs/distro-specific.sh
index 1487939f38..4c00429fcf 100644
--- a/lib/functions/rootfs/distro-specific.sh
+++ b/lib/functions/rootfs/distro-specific.sh
@@ -1,28 +1,25 @@
 #!/usr/bin/env bash
-install_distribution_specific() {
-	display_alert "Applying distribution specific tweaks for" "$RELEASE" "info"
 
-	# disable broken service
-	# the problem is in default misconfiguration
-	chroot "${SDCARD}" /bin/bash -c "systemctl --no-reload disable smartmontools.service >/dev/null 2>&1"
-	chroot "${SDCARD}" /bin/bash -c "systemctl --no-reload disable smartd.service >/dev/null 2>&1"
+function install_distribution_specific() {
+	display_alert "Applying distribution specific tweaks for" "${RELEASE:-}" "info"
 
-	# disable hostapd as it needs to be configured
-	chroot "${SDCARD}" /bin/bash -c "systemctl --no-reload disable hostapd.service  >/dev/null 2>&1"
+	# disable broken service, the problem is in default misconfiguration
+	# disable hostapd as it needs to be configured to start correctly
+	disable_systemd_service_sdcard smartmontools.service smartd.service hostapd.service
 
-	case $RELEASE in
+	case "${RELEASE}" in
 
-		focal | jammy | kinetic | lunar )
+		focal | jammy | kinetic | lunar)
 
 			# by using default lz4 initrd compression leads to corruption, go back to proven method
+			# @TODO: rpardini: this should be a config option (which is always set to zstd ;-D )
 			sed -i "s/^COMPRESS=.*/COMPRESS=gzip/" "${SDCARD}"/etc/initramfs-tools/initramfs.conf
 
-			run_host_command_logged rm -fv "${SDCARD}"/etc/update-motd.d/{10-uname,10-help-text,50-motd-news,80-esm,80-livepatch,90-updates-available,91-release-upgrade,95-hwe-eol}
+			run_host_command_logged rm -f "${SDCARD}"/etc/update-motd.d/{10-uname,10-help-text,50-motd-news,80-esm,80-livepatch,90-updates-available,91-release-upgrade,95-hwe-eol}
 
+			declare RENDERER=networkd
 			if [ -d "${SDCARD}"/etc/NetworkManager ]; then
 				local RENDERER=NetworkManager
-			else
-				local RENDERER=networkd
 			fi
 
 			# DNS fix
@@ -44,7 +41,7 @@ install_distribution_specific() {
 			[[ -f "${SDCARD}"/etc/default/chrony ]] && sed -i '/DAEMON_OPTS=/s/"-F -1"/"-F 0"/' "${SDCARD}"/etc/default/chrony
 
 			# disable conflicting services
-			chroot "${SDCARD}" /bin/bash -c "systemctl --no-reload mask ondemand.service >/dev/null 2>&1"
+			disable_systemd_service_sdcard ondemand.service
 			;;
 	esac
 
@@ -52,12 +49,11 @@ install_distribution_specific() {
 	[[ -d "${SDCARD}"/etc/netplan ]] && cat <<- EOF > "${SDCARD}"/etc/netplan/armbian-default.yaml
 		network:
 		  version: 2
-		  renderer: $RENDERER
+		  renderer: ${RENDERER}
 	EOF
 
 	# cleanup motd services and related files
-	chroot_sdcard systemctl disable motd-news.service
-	chroot_sdcard systemctl disable motd-news.timer
+	disable_systemd_service_sdcard motd-news.service motd-news.timer
 
 	# remove motd news from motd.ubuntu.com
 	[[ -f "${SDCARD}"/etc/default/motd-news ]] && sed -i "s/^ENABLED=.*/ENABLED=0/" "${SDCARD}"/etc/default/motd-news
@@ -70,7 +66,7 @@ install_distribution_specific() {
 
 	# use list modules INITRAMFS
 	if [ -f "${SRC}"/config/modules/"${MODULES_INITRD}" ]; then
-		display_alert "Use file list modules INITRAMFS" "${MODULES_INITRD}"
+		display_alert "Use file list modules MODULES_INITRD" "${MODULES_INITRD}"
 		sed -i "s/^MODULES=.*/MODULES=list/" "${SDCARD}"/etc/initramfs-tools/initramfs.conf
 		cat "${SRC}"/config/modules/"${MODULES_INITRD}" >> "${SDCARD}"/etc/initramfs-tools/modules
 	fi
@@ -81,9 +77,9 @@ install_distribution_specific() {
 # <release>: bullseye|bookworm|sid|focal|jammy|kinetic|lunar
 # <basedir>: path to root directory
 #
-create_sources_list() {
+function create_sources_list() {
 	local release=$1
-	local basedir=$2
+	local basedir=$2 # @TODO: rpardini: this is SDCARD in all practical senses. Why not just use SDCARD?
 	[[ -z $basedir ]] && exit_with_error "No basedir passed to create_sources_list"
 
 	case $release in
@@ -154,7 +150,7 @@ create_sources_list() {
 		gpg --dearmor < "${SRC}"/config/armbian.key > "${basedir}"/usr/share/keyrings/armbian.gpg
 		SIGNED_BY="[signed-by=/usr/share/keyrings/armbian.gpg] "
 	else
-		# use old method for compatibility reasons
+		# use old method for compatibility reasons # @TODO: rpardini: not gonna fix this?
 		cp "${SRC}"/config/armbian.key "${basedir}"
 		chroot "${basedir}" /bin/bash -c "cat armbian.key | apt-key add - > /dev/null 2>&1"
 	fi
@@ -165,7 +161,7 @@ create_sources_list() {
 	elif [[ $DOWNLOAD_MIRROR == "bfsu" ]]; then
 		echo "deb ${SIGNED_BY}http://mirrors.bfsu.edu.cn/armbian $RELEASE main ${RELEASE}-utils ${RELEASE}-desktop" > "${basedir}"/etc/apt/sources.list.d/armbian.list
 	else
-		echo "deb ${SIGNED_BY}http://"$([[ $BETA == yes ]] && echo "beta" || echo "apt")".armbian.com $RELEASE main ${RELEASE}-utils ${RELEASE}-desktop" > "${basedir}"/etc/apt/sources.list.d/armbian.list
+		echo "deb ${SIGNED_BY}http://$([[ $BETA == yes ]] && echo "beta" || echo "apt").armbian.com $RELEASE main ${RELEASE}-utils ${RELEASE}-desktop" > "${basedir}"/etc/apt/sources.list.d/armbian.list
 	fi
 
 	# replace local package server if defined. Suitable for development
diff --git a/lib/functions/rootfs/rootfs-desktop.sh b/lib/functions/rootfs/rootfs-desktop.sh
index a040b43837..288a16759d 100644
--- a/lib/functions/rootfs/rootfs-desktop.sh
+++ b/lib/functions/rootfs/rootfs-desktop.sh
@@ -4,12 +4,13 @@
 desktop_postinstall() {
 
 	# disable display manager for the first run
-	chroot_sdcard "systemctl --no-reload disable lightdm.service"
-	chroot_sdcard "systemctl --no-reload disable gdm3.service"
+	disable_systemd_service_sdcard lightdm.service
+	disable_systemd_service_sdcard gdm3.service
 
 	# update packages index
 	chroot_sdcard_apt_get "update"
 
+	# @TODO: rpardini: this is... missing from aggregation...?
 	# install per board packages
 	if [[ -n ${PACKAGE_LIST_DESKTOP_BOARD} ]]; then
 		chroot_sdcard_apt_get_install "$PACKAGE_LIST_DESKTOP_BOARD"
diff --git a/lib/functions/rootfs/systemd-utils.sh b/lib/functions/rootfs/systemd-utils.sh
new file mode 100644
index 0000000000..7a21c1f2e9
--- /dev/null
+++ b/lib/functions/rootfs/systemd-utils.sh
@@ -0,0 +1,7 @@
+function disable_systemd_service_sdcard() {
+	display_alert "Disabling systemd service(s) on target" "${*}" "debug"
+	declare service
+	for service in "${@}"; do
+		chroot_sdcard systemctl --no-reload disable "${service}" "||" true
+	done
+}
diff --git a/lib/library-functions.sh b/lib/library-functions.sh
index 574c209181..fe7fb87309 100644
--- a/lib/library-functions.sh
+++ b/lib/library-functions.sh
@@ -829,6 +829,15 @@ set -o errexit  ## set -e : exit the script if any statement returns a non-true
 # shellcheck source=lib/functions/rootfs/rootfs-desktop.sh
 source "${SRC}"/lib/functions/rootfs/rootfs-desktop.sh
 
+# no errors tolerated. invoked before each sourced file to make sure.
+#set -o pipefail  # trace ERR through pipes - will be enabled "soon"
+#set -o nounset   ## set -u : exit the script if you try to use an uninitialised variable - one day will be enabled
+set -o errtrace # trace ERR through - enabled
+set -o errexit  ## set -e : exit the script if any statement returns a non-true return value - enabled
+### lib/functions/rootfs/systemd-utils.sh
+# shellcheck source=lib/functions/rootfs/systemd-utils.sh
+source "${SRC}"/lib/functions/rootfs/systemd-utils.sh
+
 
 # no errors tolerated. one last time for the win!
 #set -o pipefail  # trace ERR through pipes - will be enabled "soon"