boneio 1.6.0.dev23__tar.gz → 1.6.0.dev24__tar.gz

{boneio-1.6.0.dev23/boneio.egg-info → boneio-1.6.0.dev24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boneio
-Version: 1.6.0.dev23
+Version: 1.6.0.dev24
 Summary: Python App for BoneIO
 Author-email: Paweł Szafer <pszafer@gmail.com>
 License: GNU General Public License v3.0

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/components/input/binary_sensor.py

@@ -131,6 +131,15 @@ class GpioInputBinarySensor(GpioBaseClass):
         """Send initial state after setup."""
         self.send_current_state()
 
+    def send_current_state_when_ready(self) -> None:
+        """Send the current state now, or as soon as the GPIO manager starts.
+
+        Before start the pin cannot be read, and ``read_value`` answers False —
+        which a non-inverted input reports as ``pressed``. Publishing that would
+        put a wrong state on a retained topic.
+        """
+        get_gpio_manager(loop=self._loop).register_on_start_callback(self.send_current_state)
+
     def send_current_state(self) -> None:
         """Send current state to MQTT without triggering actions.
         

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/components/input/remote/base.py

@@ -137,7 +137,7 @@ class RemoteInputBase:
     # Helpers for subclasses
     # ------------------------------------------------------------------
 
-    def _handle_binary_state_change(self, new_state: bool) -> None:
+    def _handle_binary_state_change(self, new_state: bool, publish_only: bool = False) -> None:
         """Process a state change in binary_sensor mode.
 
         Emits ``pressed`` or ``released`` directly to EventBus.
@@ -146,10 +146,14 @@ class RemoteInputBase:
 
         Args:
             new_state: ``True`` if the sensor is now active/on.
+            publish_only: Take the state without running actions — for a state
+                learnt rather than seen changing, e.g. a retained replay.
         """
         self._state = new_state
         click_type = PRESSED if new_state else RELEASED
-        self.press_callback(click_type=click_type, duration=None, start_time=time.time())
+        self.press_callback(
+            click_type=click_type, duration=None, start_time=time.time(), publish_only=publish_only
+        )
 
     def _feed_detector(self, is_pressed: bool) -> None:
         """Feed a state change into the MultiClickDetector (event mode).
@@ -189,6 +193,7 @@ class RemoteInputBase:
         click_type: ClickTypes,
         duration: float | None = None,
         start_time: float | None = None,
+        publish_only: bool = False,
     ) -> None:
         """Schedule async event processing.
 
@@ -196,14 +201,16 @@ class RemoteInputBase:
             click_type: Type of click.
             duration: Duration of the press in seconds.
             start_time: Start time of the press.
+            publish_only: Publish the state, run no actions.
         """
-        asyncio.create_task(self._handle_press_with_lock(click_type, duration, start_time))
+        asyncio.create_task(self._handle_press_with_lock(click_type, duration, start_time, publish_only))
 
     async def _handle_press_with_lock(
         self,
         click_type: ClickTypes,
         duration: float | None = None,
         start_time: float | None = None,
+        publish_only: bool = False,
     ) -> None:
         """Emit InputEvent on EventBus (serialised with lock)."""
         async with self._event_lock:
@@ -232,6 +239,7 @@ class RemoteInputBase:
                     click_type=click_type,
                     duration=duration,
                     state=event_state,
+                    publish_only=publish_only,
                 )
             )
 

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/components/input/remote/mqtt.py

@@ -98,7 +98,7 @@ class MqttBinarySensorInput(RemoteInputBase):
             return False
         return None
 
-    async def on_mqtt_message(self, _topic: str, payload: str) -> None:
+    async def on_mqtt_message(self, _topic: str, payload: str, retained: bool = False) -> None:
         """Handle a message on the subscribed topic.
 
         Two payload shapes are understood. A plain on/off state is the usual
@@ -107,12 +107,24 @@ class MqttBinarySensorInput(RemoteInputBase):
         mode it is passed through as-is rather than re-derived from a state
         this side never saw.
 
+        A retained message is the broker replaying what it stored, on every
+        subscribe — so on every reconnect. It says what the state *is*, not
+        that it just changed: binary_sensor mode takes it without running
+        actions, and event mode ignores it, because a lone ``pressed`` with no
+        release would turn into a long press.
+
         Args:
             _topic: The topic it arrived on; unused, one subscription per input.
             payload: The message.
+            retained: The broker is replaying its stored copy, not forwarding
+                a live message.
         """
         text = (payload or "").strip()
 
+        if retained and self._mode == "event":
+            _LOGGER.debug("Input %s: ignoring retained message in event mode", self.id)
+            return
+
         if text.startswith("{"):
             try:
                 event_type = json.loads(text).get("event_type")
@@ -145,4 +157,4 @@ class MqttBinarySensorInput(RemoteInputBase):
         if self._mode == "event":
             self._feed_detector(is_pressed=state)
         else:
-            self._handle_binary_state_change(state)
+            self._handle_binary_state_change(state, publish_only=retained)

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/core/cloud/registration.py

@@ -524,10 +524,10 @@ class CloudRegistration:
     def _check_compose_ownership(self) -> bool:
         """Check the compose file is managed by the privileged helper.
 
-        This used to check the opposite — that the file was *writable* — and its
-        error message told the operator to ``sudo chown $USER`` it. That advice
-        reopens F-04: ``docker compose up`` executes this file, so whoever can
-        write it can start a container as root with the host filesystem mounted.
+        The file must *not* be writable by the application, and no error here
+        should tell the operator to ``chown`` it: ``docker compose up`` executes
+        this file, so whoever can write it can start a container as root with
+        the host filesystem mounted.
 
         Returns:
             True when the cloud switch can proceed.

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/core/config/secret_masking.py

@@ -1,7 +1,7 @@
-"""Keep configured secrets out of API responses (F-03).
+"""Keep configured secrets out of API responses.
 
-``GET /api/config`` returned the MQTT password, and any other password in the
-configuration, in clear text. Masking it is only half the job: the settings
+Unmasked, ``GET /api/config`` would return the MQTT password, and any other
+password in the configuration, in clear text. Masking it is only half the job: the settings
 forms are populated from that same response and post the whole section back, so
 a mask that is written straight through would overwrite the real password with
 its own placeholder the first time anyone saved an unrelated field.

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/core/containers.py

@@ -1,17 +1,16 @@
 """Container operations, through the privileged helper when it is there.
 
-The application talks to Docker today because the ``boneio`` account is in the
-``docker`` group — which is root-equivalent, since a container can bind-mount
-the host root and write to it. Taking the account out of that group is the fix
-(F-04), and this module is what makes it possible: every container operation
-goes through ``boneio-containers``, which accepts a fixed verb and passes
-nothing from the caller to Docker.
+The ``boneio`` account is kept out of the ``docker`` group, because that group
+is root-equivalent: a container can bind-mount the host root and write to it.
+Every container operation goes through ``boneio-containers`` instead, which
+accepts a fixed verb and passes nothing from the caller to Docker. Nothing else
+in the application should call ``docker``; it comes through here.
 
 Direct ``docker`` invocation stays as a fallback while the helper is not
-installed. That is not a loophole, it is the transition: a device that has not
-applied the trust-transition migration yet is in exactly the state it is in
-today, and refusing to manage its containers would break Node-RED and the TLS
-panel for no gain. Once the helper is present it is always preferred, and once
+installed. That is not a loophole: a device that has not applied the
+trust-transition migration yet still has the account in the ``docker`` group,
+and refusing to manage its containers would break Node-RED and the TLS panel
+for no gain. Once the helper is present it is always preferred, and once
 the account leaves the ``docker`` group the fallback stops working on its own.
 
 Nothing here is a security boundary. The boundary is the helper, which refuses
@@ -466,9 +465,9 @@ def set_project_env(name: str, value: str) -> bool:
     the compose file, which is how the panel's own port reaches Caddy. The
     application may write this file: the directory belongs to it. It may not
     write the compose file beside it, which is root-owned because
-    ``docker compose up`` executes it — that distinction is F-04, and it holds
-    here because interpolation substitutes into scalar values after the YAML is
-    parsed, so nothing passed this way can introduce a volume or an entrypoint.
+    ``docker compose up`` executes it. Writing ``.env`` does not undo that:
+    interpolation substitutes into scalar values after the YAML is parsed, so
+    nothing passed this way can introduce a volume or an entrypoint.
 
     Read-modify-write rather than truncate: an operator may have put their own
     variables here, and a port change is no reason to lose them. Comments and

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/core/manager/inputs.py

@@ -624,6 +624,20 @@ class InputManager:
         # Global listeners will receive these events for all inputs (including new ones)
         self._broadcast_all_input_states()
 
+    def resend_binary_sensor_states(self) -> None:
+        """Publish the pin state of every GPIO binary sensor, MQTT only.
+
+        Called on each MQTT connect. The topics are retained, and nothing else
+        corrects the broker's copy when an input changed while boneIO was off.
+        Actions do not run: these are ``publish_only`` events.
+        """
+        for input_ in self._inputs.values():
+            if isinstance(input_, GpioInputBinarySensor):
+                try:
+                    input_.send_current_state_when_ready()
+                except Exception as e:
+                    _LOGGER.debug("Error resending binary sensor state %s: %s", input_.id, e)
+
     def _broadcast_all_input_states(self) -> None:
         """Broadcast current state of all inputs via WebSocket.
 
@@ -766,9 +780,14 @@ class InputManager:
         elif input_type == INPUT_SENSOR:
             payload = str(click_type)  # "pressed" or "released"
 
+            # Retained: a float switch can hold one position for weeks, and
+            # without the broker's copy HA shows `unknown` after every restart
+            # until the input moves. Events above stay unretained — a click
+            # replayed on subscribe would be a click that never happened.
             self._manager.send_message(
                 topic=topic,
                 payload=payload,
+                retain=True,
             )
             _LOGGER.debug("Published binary sensor state to MQTT: topic=%s, payload=%s", topic, payload)
 

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/core/manager/manager.py

@@ -618,6 +618,7 @@ class Manager:
                         self.send_message(
                             topic=f"{topic_prefix}/input/{input_id}",
                             payload=state,
+                            retain=True,
                         )
                 except Exception as e:
                     _LOGGER.debug(
@@ -2005,6 +2006,11 @@ class Manager:
         # trusts, and a reinstalled broker comes back with no retained set.
         await self.virtual_switches.republish_states()
 
+        # Binary sensors are retained, so the broker would otherwise keep
+        # serving whatever they were before this boot, however long ago that
+        # was. Read the pins and publish what is true now.
+        self.inputs.resend_binary_sensor_states()
+
         _LOGGER.info(
             "Resent states: %d outputs, %d covers.",
             len([o for o in self.outputs.get_all_outputs().values() if o.output_type not in ("cover", "none")]),

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/core/manager/remote_input_registrar.py

@@ -117,7 +117,7 @@ class RemoteInputRegistrar:
         for remote_input in self._mqtt_inputs:
             try:
                 await self._manager.message_bus.subscribe_and_listen(
-                    remote_input.topic, remote_input.on_mqtt_message
+                    remote_input.topic, remote_input.on_mqtt_message, retain_aware=True
                 )
                 _LOGGER.debug(
                     "Remote input '%s' listening on %s",

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/core/messaging/basic.py

@@ -55,8 +55,22 @@ class MessageBus(ABC):
         pass
 
     @abstractmethod
-    async def subscribe_and_listen(self, topic: str, callback: Callable[[str, str], Awaitable[None]]) -> None:
-        """Subscribe to a topic and listen for messages."""
+    async def subscribe_and_listen(
+        self,
+        topic: str,
+        callback: Callable[..., Awaitable[None]],
+        *,
+        retain_aware: bool = False,
+    ) -> None:
+        """Subscribe to a topic and listen for messages.
+
+        Args:
+            topic: Topic to subscribe to.
+            callback: Called as ``callback(topic, payload)``.
+            retain_aware: Also pass ``retained=`` — True when the broker is
+                replaying a stored message on subscribe rather than forwarding
+                a live one. Buses without retained messages always pass False.
+        """
         pass
 
     @abstractmethod

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/core/messaging/composite.py

@@ -82,10 +82,16 @@ class CompositeMessageBus(MessageBus):
         if tasks:
             await asyncio.gather(*tasks, return_exceptions=True)
 
-    async def subscribe_and_listen(self, topic: str, callback: Callable[[str, str], Awaitable[None]]) -> None:
+    async def subscribe_and_listen(
+        self,
+        topic: str,
+        callback: Callable[..., Awaitable[None]],
+        *,
+        retain_aware: bool = False,
+    ) -> None:
         """Subscribe to a topic and listen for messages on all buses."""
         for bus in self._buses:
-            await bus.subscribe_and_listen(topic, callback)
+            await bus.subscribe_and_listen(topic, callback, retain_aware=retain_aware)
 
     async def unsubscribe_and_stop_listen(self, topic: str) -> None:
         """Unsubscribe from a topic and stop listening on all buses."""

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/core/messaging/local.py

@@ -80,8 +80,18 @@ class LocalMessageBus(MessageBus):
         """Announce that the device is offline."""
         pass
 
-    async def subscribe_and_listen(self, topic: str, callback: Callable[[str, str], None]) -> None:
-        """Subscribe to a topic and listen for messages."""
+    async def subscribe_and_listen(
+        self,
+        topic: str,
+        callback: Callable[..., Any],
+        *,
+        retain_aware: bool = False,
+    ) -> None:
+        """Subscribe to a topic and listen for messages.
+
+        ``retain_aware`` is accepted for the interface and ignored: the callback
+        is called with two arguments, so ``retained`` keeps its default.
+        """
         await self.subscribe(topic, callback)
 
     async def unsubscribe_and_stop_listen(self, topic: str) -> None:

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/core/messaging/lox.py

@@ -388,8 +388,14 @@ class LoxUDPClient(MessageBus):
         if self._transport:
             self._transport.sendto(b"boneio=offline", (self.host, self.send_port))
 
-    async def subscribe_and_listen(self, topic: str, callback: Callable[[str, str], Coroutine[Any, Any, None]]) -> None:
-        """Register a listener for a topic pattern."""
+    async def subscribe_and_listen(
+        self,
+        topic: str,
+        callback: Callable[..., Coroutine[Any, Any, None]],
+        *,
+        retain_aware: bool = False,
+    ) -> None:
+        """Register a listener for a topic pattern. Lox has no retained messages."""
         self._listeners[topic] = callback
 
     async def unsubscribe_and_stop_listen(self, topic: str) -> None:

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/core/messaging/mqtt.py

@@ -56,7 +56,9 @@ class MQTTClient(MessageBus):
         self.reconnect_interval = 1
         self._connection_established = False
         self.publish_queue: UniqueQueue = UniqueQueue()
-        self._mqtt_energy_listeners: dict[str, Callable[[str, str], Awaitable[None]]] = {}
+        self._mqtt_energy_listeners: dict[str, Callable[..., Awaitable[None]]] = {}
+        # Listeners that are told whether a message is a retained replay.
+        self._retain_aware_listeners: set[str] = set()
         self._discovery_topics = (
             [
                 f"{self._config_helper.ha_discovery_prefix}/{ha_type}/{self._config_helper.serial_number}/#"
@@ -144,8 +146,18 @@ class MQTTClient(MessageBus):
         )
 
     @override
-    async def subscribe_and_listen(self, topic: str, callback: Callable[[str, str], Awaitable[None]]) -> None:
+    async def subscribe_and_listen(
+        self,
+        topic: str,
+        callback: Callable[..., Awaitable[None]],
+        *,
+        retain_aware: bool = False,
+    ) -> None:
         self._mqtt_energy_listeners[topic] = callback
+        if retain_aware:
+            self._retain_aware_listeners.add(topic)
+        else:
+            self._retain_aware_listeners.discard(topic)
         # Subscribe immediately if already connected
         if self._connection_established:
             await self.subscribe(topics=[topic])
@@ -154,6 +166,7 @@ class MQTTClient(MessageBus):
     async def unsubscribe_and_stop_listen(self, topic: str) -> None:
         await self.unsubscribe([topic])
         del self._mqtt_energy_listeners[topic]
+        self._retain_aware_listeners.discard(topic)
 
     async def unsubscribe(
         self,
@@ -439,7 +452,14 @@ class MQTTClient(MessageBus):
                 if message.topic.matches(topic):
                     callback_start = False
                     try:
-                        await listener_callback(str(message.topic), payload)
+                        if topic in self._retain_aware_listeners:
+                            # v3.1.1: the broker sets retain only when replaying
+                            # its stored copy on subscribe, never on live ones.
+                            await listener_callback(
+                                str(message.topic), payload, retained=bool(message.retain)
+                            )
+                        else:
+                            await listener_callback(str(message.topic), payload)
                     except Exception as exc:
                         _LOGGER.error(
                             "Error in MQTT listener callback for topic %s: %s",

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/core/net/discovery_guard.py

@@ -1,11 +1,10 @@
-"""Bound where device discovery is allowed to connect (F-15).
+"""Bound where device discovery is allowed to connect.
 
-``discover-wled`` and ``discover-esphome`` took a host and a port and connected
-to them. That made the controller three things it should not be: a port scanner
-for its own loopback interface, a way to reach anything on the network from the
-controller's address, and — because the upstream error was handed back verbatim
-— a banner grabber. The report's proof reads an SSH version string out of an
-HTTP error.
+``discover-wled`` and ``discover-esphome`` take a host and a port and connect to
+them. Unbounded, that makes the controller three things it should not be: a
+port scanner for its own loopback interface, a way to reach anything on the
+network from the controller's address, and — if the upstream error is handed
+back verbatim — a banner grabber.
 
 The guard is shaped by what the feature is actually for. A WLED or ESPHome node
 lives on the local network, so private addresses stay allowed; blocking them
@@ -13,8 +12,8 @@ would leave nothing to discover. Everything with no legitimate reason to be a
 discovery target is refused:
 
 ``loopback``
-    The controller's own services. This is the port-scanning oracle from the
-    report, and the only thing it can find is boneIO itself.
+    The controller's own services. Discovery here would only be a port scan
+    of boneIO itself.
 ``link-local``
     Includes 169.254.169.254, the cloud metadata address — an SSRF target
     worth closing even on hardware that will never run in a cloud.

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/core/security/posture.py

@@ -389,16 +389,21 @@ def evaluate(
                 if not ssh_known
                 else "The SSH login does not use the shipped password."
             ),
-            # Not a button in the panel, on purpose: an operation that set this
-            # account's password from the panel whenever asked would be a way
-            # from the account to root. The first-run wizard sets it once; after
-            # that it is passwd, which asks for the current one.
+            # The panel's change is passwd: it wants the current password, so
+            # it is offered only where there is one to give — the shipped one,
+            # which is public. With no password at all there is nothing to
+            # check, and a panel operation that set it anyway would be a way
+            # from the account to root; that stays passwd over SSH.
             remedy=(
-                "Log in over SSH as boneio and run passwd."
+                "Change it under Accounts, with the shipped password as the "
+                "current one, or log in over SSH as boneio and run passwd."
+                if service_password == "shipped"
+                else "Log in over SSH as boneio and run passwd."
                 if ssh_exposed
                 else ""
             ),
-            settings_section=None,
+            settings_section="accounts" if service_password == "shipped" else None,
+            variant="empty" if service_password == "empty" else "",
         )
     )
 

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/core/system_ops.py

@@ -222,6 +222,25 @@ def service_password_init(password: str, timeout: int = 60) -> Result:
     return run("service-password-init", timeout=timeout, stdin=f"{password}\n")
 
 
+def service_password_change(current: str, new: str, timeout: int = 60) -> Result:
+    """Change the boneio login password, given the current one.
+
+    ``passwd`` as root, for the fixed account: the helper checks *current*
+    against /etc/shadow and counts wrong ones where this process cannot reset
+    the count. Both go over stdin, one per line. The outcome is JSON on stdout
+    — see ``service-password-change`` in the helper.
+
+    Args:
+        current: The SSH password the account has now.
+        new: The one it should have.
+        timeout: Seconds to allow; a wrong password costs the helper two.
+
+    Returns:
+        The outcome.
+    """
+    return run("service-password-change", timeout=timeout, stdin=f"{current}\n{new}\n")
+
+
 def mqtt_reload(timeout: int = 30) -> Result:
     """Have the broker re-read its password file."""
     return run("mqtt-reload", timeout=timeout)

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/hardware/gpio/input/manager.py

@@ -523,8 +523,9 @@ class GpioManager:
                 callback()
             except Exception as e:
                 _LOGGER.error("Error in on-start callback: %s", e)
-        else:
-            # Queue for later execution
+        elif callback not in self._on_start_callbacks:
+            # Queue for later execution — once: MQTT connects queue the same
+            # state resend again and again while GPIO has not started.
             self._on_start_callbacks.append(callback)
 
     async def stop(self) -> None:

{boneio-1.6.0.dev23 → boneio-1.6.0.dev24}/boneio/migrations/assets/MANIFEST.sha256

@@ -13,7 +13,7 @@ bff00753c72fb17609a6f7b3a58ef78b7b394da12d19fd65b875f2889695e2b4  docker/nodered
 3f41bcf2311bef4042f8082b7ae769fe298f05f46739e47f14e661a3c47733b0  helpers/boneio-containers
 dff0cd02daad2cbd525a0535f8f3562bb742e7e737b24c69e5afa986415e67e4  helpers/boneio-helpers-heal
 7615397aa52a3cb34cda4b3831d1306121844e2cc0403c114e95d8731075dd3b  helpers/boneio-migrate-v2
-08614f7672b7c469c5b2d981284477586a911d1a947a06d2a70ccf0c4f1a444e  helpers/boneio-system
+a5692946c7f6cf58cb2422beeb559655f39e236279cfa70bdc9f0cea678b92dc  helpers/boneio-system
 f316c778b3125e4e992942c889c4082f8a12f578a6d68c4e7c79fa80e4cc94a1  issue.d/10-boneio.issue
 83260e860f5431f3240617e88dba456ba39c52dbe4625e832d00fd241bad7701  journald/boneio-console.conf
 e6013f4fbf11693f39123b1e6159c7d7224a7c832e994722120980f64039c17e  journald/journald.conf
@@ -22,7 +22,10 @@ d28f2e9336b881b102c42f4278ec9ddf046c83dab4469dc5be7326768e074cb6  kernel/postins
 16a97c875edb68e19655b953b4baa773cc1a4e57810543cda646a3e3e83c0c0e  migrations.pem
 75e3985aabe2170021dcdc70eb07ff4516ce9f7190e32ddfae3b0e9d963aac88  modules-load.d/onewire.conf
 3db75f83033d82ca229e2d3bcb7daf4a5584f65b298d834bd0ee12527ae06e22  mosquitto/boneio.conf
+99a9d81f833347563e8349599a248a641216d01d182e8a2723344b017d87f9f4  motd/20-boneio
 6289c9b3d6e7836fcd809b7a9dcd85f5a2acf85af09be279dd6e466b99a14209  sshd/10-boneio-hardening.conf
+27adb0eb71d07b1f0e3fbd5098795325672a55f8d6bb6f5bb505300152dd5256  sshd/20-boneio-banner.conf
+00e4fb7961045f99f2559ebc76472c9d001f8e128182e48762f7a2b177896d11  sshd/boneio-banner
 6c994908ea9d8d0cb85501480b7a6236a31310012deebe6ee3d034da2dc2d4e9  sudoers/boneio
 74e8c1209b80519dc6e3db6c6d8e7ca02f01f8f618cee6f741e8400270d3b05a  sudoers/boneio-helpers
 2573e2abb1e0e8bb13d2df435ecd75d9766b3d8257104fcd876837ee260d0f76  sudoers/boneio-timedatectl