PyOTP 2.9.0__tar.gz → 2.11.1__tar.gz

pyotp-2.11.1/.github/FUNDING.yml

@@ -0,0 +1,3 @@
+# These are supported funding model platforms
+
+github: kislyuk

pyotp-2.11.1/.github/workflows/actions.lock

@@ -0,0 +1,64 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@v7'
+        - 'actions/setup-python@v7'
+        - 'astral-sh/ruff-action@v4.1.0'
+        - 'codecov/codecov-action@v7'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v4'
+        - 'actions/setup-python@v5'
+        - 'pypa/gh-action-pypi-publish@release/v1'
+dependencies:
+    'actions/checkout@v4':
+        ref: 'v4'
+        commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v7':
+        ref: 'v7'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd':
+        ref: 'v8.0.0'
+        commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405':
+        ref: 'v6.2.0'
+        commit: 'sha1-a309ff8b426b58ec0e2a45f0f869d46889d02405'
+        owner_id: 44036562
+        repo_id: 192625525
+    'actions/setup-python@v5':
+        ref: 'v5'
+        commit: 'sha1-a26af69be951a213d495a4c3e4e4022e16d87065'
+        owner_id: 44036562
+        repo_id: 192625525
+    'actions/setup-python@v7':
+        ref: 'v7'
+        commit: 'sha1-6d4fd22b20465ccc0f7354476588e8df7c9ca0e0'
+        owner_id: 44036562
+        repo_id: 192625525
+    'astral-sh/ruff-action@v4.1.0':
+        ref: 'v4.1.0'
+        commit: 'sha1-278981a28ce3188b1e39527901f38254bf3aac89'
+        owner_id: 115962839
+        repo_id: 865075538
+    'codecov/codecov-action@v7':
+        ref: 'v7'
+        commit: 'sha1-303a32d7a59b442fa8d48b6a1cc6825c09c847a5'
+        owner_id: 8226205
+        repo_id: 200299178
+        uses:
+            - 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd'
+    'pypa/gh-action-pypi-publish@release/v1':
+        ref: 'release/v1'
+        commit: 'sha1-7245906fb61fa33a13554f9d5fb856fe61758086'
+        owner_id: 647025
+        repo_id: 178055147
+        uses:
+            - 'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405'

pyotp-2.11.1/.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+name: Python package
+
+on: [push, pull_request]
+
+jobs:
+  build:
+    runs-on: ${{ matrix.os }}
+    env:
+      PIP_DISABLE_PIP_VERSION_CHECK: 1
+    strategy:
+      matrix:
+        os: [ubuntu-22.04, ubuntu-latest, macos-latest]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15"]
+    steps:
+    - uses: actions/checkout@v7
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v7
+      with:
+        python-version: ${{ matrix.python-version }}
+    - run: make install
+    - run: make lint
+    - run: make test
+    - uses: codecov/codecov-action@v7
+  ruff:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/ruff-action@v4.1.0
+      - uses: astral-sh/ruff-action@v4.1.0
+        with:
+          args: "format --check"

pyotp-2.11.1/.github/workflows/release.yml

@@ -0,0 +1,21 @@
+name: Publish release to PyPI
+
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+
+jobs:
+  pypi-publish:
+    name: Build and upload release to PyPI
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+      - run: pip install build
+      - run: python -m build
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

pyotp-2.11.1/.gitignore

@@ -0,0 +1,42 @@
+# Reminder:
+# - A leading slash means the pattern is anchored at the root.
+# - No leading slash means the pattern matches at any depth.
+
+# Python files
+*.pyc
+__pycache__/
+.tox/
+*.egg-info/
+/build/
+/dist/
+/.eggs/
+
+# Sphinx documentation
+/docs/_build/
+
+# IDE project files
+/.pydevproject
+
+# vim python-mode plugin
+/.ropeproject
+
+# IntelliJ IDEA / PyCharm project files
+/.idea
+/*.iml
+
+# JS/node/npm/web dev files
+node_modules
+npm-debug.log
+
+# OS X metadata files
+.DS_Store
+
+# Python coverage
+.coverage
+htmlcov
+
+# Virtual environments
+venv
+
+# Type checking
+.mypy_cache

pyotp-2.11.1/Changes.rst

@@ -0,0 +1,203 @@
+Changes for v2.11.1 (2026-11-14)
+================================
+
+-  Fix PyPI README markup and validate distributions before release
+   (#200)
+
+Changes for v2.11.0 (2026-11-14)
+================================
+
+-  Fix DST rollbacks and normalize TOTP timestamp inputs (#197)
+
+-  Respect initial_count=0 in HOTP.provisioning_uri() (#190)
+
+-  Implement verify_and_get_timecode, a method for TOTP that verifies
+   and returns the matching timecode (#191)
+
+Changes for v2.10.0 (2026-06-13)
+================================
+
+- Fix parse_uri mis-parsing of encoded colon in issuer/account name
+  (#187)
+
+- Simplified and improved generate_otp() performance in Steam class
+  (#179)
+
+- Check digest function to prevent error on OTP Generation (#170)
+
+- Ignore non-standard otpauth parameters
+
+- use strings as immutable default arguments (#162)
+
+Changes for v2.9.0 (2023-07-27)
+===============================
+
+-  Add ``parse_uri()`` support for Steam TOTP (#153)
+
+-  Test and documentation improvements
+
+Changes for v2.8.0 (2022-12-13)
+===============================
+
+-  Modify OTP generation to run in constant time (#148)
+
+-  Documentation improvements
+
+-  Drop Python 3.6 support; introduce Python 3.11 support
+
+Changes for v2.7.0 (2022-09-11)
+===============================
+
+-  Support Steam TOTP (#142)
+
+-  Build, test, and documentation updates
+
+Changes for v2.6.0 (2021-02-04)
+===============================
+
+-  Raise default and minimum base32 secret length to 32, and hex secret
+   length to 40 (160 bits as recommended by the RFC) (#115).
+
+-  Fix issue where provisioning_uri would return invalid results after
+   calling verify() (#115).
+
+Changes for v2.5.1 (2021-01-29)
+===============================
+
+-  parse_uri accepts and ignores optional image parameter (#114)
+
+Changes for v2.5.0 (2021-01-29)
+===============================
+
+-  Add optional image parameter to provisioning_uri (#113)
+
+-  Support for 7-digit codes in ‘parse_uri’ (#111)
+
+-  Raise default and minimum base32 secret length to 26
+
+Changes for v2.4.1 (2020-10-16)
+===============================
+
+-  parse_uri: Fix handling of period, counter (#108)
+
+-  Add support for timezone aware datetime as argument to
+   ``TOTP.timecode()`` (#107)
+
+Changes for v2.4.0 (2020-07-29)
+===============================
+
+-  Fix data type for at(for_time) (#85)
+
+-  Add support for parsing provisioning URIs (#84)
+
+-  Raise error when trying to generate secret that is too short (The
+   secret must be at least 128 bits)
+
+-  Add random_hex function (#82)
+
+Changes for v2.3.0 (2019-07-26)
+===============================
+
+-  Fix comparison behavior on Python 2.7
+
+Changes for v2.2.8 (2019-07-26)
+===============================
+
+-  Fix comparison of unicode chars (#78)
+
+-  Minor documentation and test fixes
+
+Changes for v2.2.7 (2018-11-05)
+===============================
+
+-  Have random_base32() use ‘secrets’ as rand source (#66)
+
+-  Documentation: Add security considerations, minimal security
+   checklist, other improvements
+
+-  Update setup.py to reference correct license
+
+Changes for v2.2.6 (2017-06-10)
+===============================
+
+-  Fix tests wrt double-quoting in provisioning URIs
+
+Changes for v2.2.5 (2017-06-03)
+===============================
+
+-  Quote issuer QS parameter in provisioning\_uri. Fixes #47.
+
+-  Raise an exception if a negative integer is passed to at() (#41).
+
+-  Documentation and release infrastructure improvements.
+
+Changes for v2.2.4 (2017-01-04)
+===============================
+
+-  Restore Python 2.6 compatibility (however, Python 2.6 is not
+   supported)
+
+-  Documentation and test improvements
+
+-  Fix release infra script, part 2
+
+Changes for v2.2.3 (2017-01-04)
+===============================
+
+-  Restore Python 2.6 compatibility (however, Python 2.6 is not
+   supported)
+
+-  Documentation and test improvements
+
+-  Fix release infra script
+
+Changes for v2.2.2 (2017-01-04)
+===============================
+
+-  Restore Python 2.6 compatibility (however, Python 2.6 is not
+   supported)
+
+-  Documentation and test improvements
+
+Changes for v2.2.1 (2016-08-30)
+===============================
+
+-  Avoid using python-future; it has subdependencies that limit
+   compatibility (#34)
+-  Make test suite pass on 32-bit platforms (#30)
+-  Timing attack resistance fix: don't reveal string length to attacker.
+   Thanks to Eeo Jun (#28).
+-  Support algorithm, digits, period parameters in provisioning\_uri.
+   Thanks to Dionisio E Alonso (#33).
+-  Minor style and packaging infrastructure fixes.
+
+Changes for v2.2.0 (2016-08-30)
+===============================
+
+-  See v2.2.1
+
+Version 2.1.0 (2016-05-02)
+--------------------------
+- Add extended range support to TOTP.verify. Thanks to Zeev Rotshtein (PR #19).
+- Handle missing padding of encoded secret. Thanks to Kun Yan (#20).
+- Miscellaneous fixes.
+
+Version 2.0.1 (2015-09-28)
+--------------------------
+- Fix packaging issue in v2.0.0 that prevented installation with easy_install.
+
+Version 2.0.0 (2015-08-22)
+--------------------------
+- The ``pyotp.HOTP.at()``, ``pyotp.TOTP.at()``, and
+  ``pyotp.TOTP.now()`` methods now return strings instead of
+  integers. Thanks to Rohan Dhaimade (PR #16).
+
+Version 1.4.2 (2015-07-21)
+--------------------------
+- Begin tracking changes in change log.
+- Update documentation.
+- Introduce Travis CI integration.
+
+Version 1.3.1 (2012-02-29)
+--------------------------
+- Initial release.

pyotp-2.11.1/Makefile

@@ -0,0 +1,31 @@
+SHELL=/bin/bash
+
+test_deps:
+	python -m pip install .[test]
+
+lint:
+	ruff check src
+	mypy --install-types --non-interactive --check-untyped-defs src
+
+test:
+	coverage run --branch --include 'src/*' -m unittest discover -s test -v
+
+init_docs:
+	cd docs; sphinx-quickstart
+
+docs:
+	python -m pip install furo sphinx-copybutton sphinxext-opengraph
+	sphinx-build docs docs/html
+
+install: clean
+	python -m pip install build
+	python -m build
+	python -m pip install --upgrade $$(echo dist/*.whl)[test]
+
+clean:
+	-rm -rf build dist
+	-rm -rf *.egg-info
+
+.PHONY: test_deps lint test docs install clean
+
+include common.mk

{pyotp-2.9.0/src/pyotp.egg-info → pyotp-2.11.1}/PKG-INFO

@@ -1,32 +1,41 @@
-Metadata-Version: 2.1
-Name: pyotp
-Version: 2.9.0
+Metadata-Version: 2.5
+Name: PyOTP
+Version: 2.11.1
 Summary: Python One Time Password Library
-Home-page: https://github.com/pyotp/pyotp
-Author: PyOTP contributors
-Author-email: kislyuk@gmail.com
-License: MIT License
-Project-URL: Documentation, https://pyauth.github.io/pyotp
+Project-URL: Homepage, https://github.com/pyauth/pyotp
+Project-URL: Documentation, https://github.com/pyauth/pyotp
 Project-URL: Source Code, https://github.com/pyauth/pyotp
 Project-URL: Issue Tracker, https://github.com/pyauth/pyotp/issues
-Project-URL: Change Log, https://github.com/pyauth/pyotp/blob/master/Changes.rst
-Platform: MacOS X
-Platform: Posix
+Project-URL: Change Log, https://github.com/pyauth/pyotp/blob/main/Changes.rst
+Author: Andrey Kislyuk
+Author-email: kislyuk@gmail.com
+Maintainer: Andrey Kislyuk
+Maintainer-email: kislyuk@gmail.com
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Programming Language :: Python :: Implementation :: PyPy
+Classifier: Topic :: Software Development
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.7
+Requires-Python: >=3.8
 Provides-Extra: test
-License-File: LICENSE
+Requires-Dist: coverage; extra == 'test'
+Requires-Dist: mypy; extra == 'test'
+Requires-Dist: ruff; extra == 'test'
+Requires-Dist: wheel; extra == 'test'
+Description-Content-Type: text/x-rst
 
 PyOTP - The Python One-Time Password Library
 ============================================
@@ -54,11 +63,11 @@ minimum, application implementers should follow this checklist:
 - Throttle (rate limit) brute-force attacks against your application's login functionality (see RFC 4226, section 7.3)
 - When implementing a "greenfield" application, consider supporting
   `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
-  addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
-  MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a dedicated single-purpose
-  device, which strengthens your clients against client-side attacks. And by automating scoping of credentials to
-  relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation
-  of FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
+  addition to or instead of HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which
+  strengthens your MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a
+  dedicated single-purpose device, which strengthens your clients against client-side attacks. And by automating scoping
+  of credentials to relying party IDs (application origin/domain names), U2F adds protection against phishing attacks.
+  One implementation of FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
 
 We also recommend that implementers read the
 `OWASP Authentication Cheat Sheet
@@ -87,7 +96,7 @@ Usage
 
 Time-based OTPs
 ~~~~~~~~~~~~~~~
-::
+.. code:: python
 
     import pyotp
     import time
@@ -102,7 +111,7 @@ Time-based OTPs
 
 Counter-based OTPs
 ~~~~~~~~~~~~~~~~~~
-::
+.. code:: python
 
     import pyotp
     
@@ -118,11 +127,15 @@ Counter-based OTPs
 Generating a Secret Key
 ~~~~~~~~~~~~~~~~~~~~~~~
 A helper function is provided to generate a 32-character base32 secret, compatible with Google Authenticator and other
-OTP apps::
+OTP apps:
+
+.. code:: python
 
     pyotp.random_base32()
 
-Some applications want the secret key to be formatted as a hex-encoded string::
+Some applications want the secret key to be formatted as a hex-encoded string:
+
+.. code:: python
 
     pyotp.random_hex()  # returns a 40-character hex-encoded secret
 
@@ -130,7 +143,9 @@ Google Authenticator Compatible
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 PyOTP works with the Google Authenticator iPhone and Android app, as well as other OTP apps like Authy. PyOTP includes
-the ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps::
+the ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps:
+
+.. code:: python
 
     pyotp.totp.TOTP('JBSWY3DPEHPK3PXP').provisioning_uri(name='alice@google.com', issuer_name='Secure App')
 
@@ -143,7 +158,9 @@ the ability to generate provisioning URIs for use with the QR Code scanner built
 This URL can then be rendered as a QR Code (for example, using https://github.com/soldair/node-qrcode) which can then be
 scanned and added to the users list of OTP credentials.
 
-Parsing these URLs is also supported::
+Parsing these URLs is also supported:
+
+.. code:: python
 
     pyotp.parse_uri('otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App')
 
@@ -158,9 +175,11 @@ Working example
 
 Scan the following barcode with your phone's OTP app (e.g. Google Authenticator):
 
-.. image:: https://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
+.. image:: https://quickchart.io/qr?size=250&text=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
+
+Now run the following and compare the output:
 
-Now run the following and compare the output::
+.. code:: python
 
     import pyotp
     totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")

{pyotp-2.9.0 → pyotp-2.11.1}/README.rst

@@ -24,11 +24,11 @@ minimum, application implementers should follow this checklist:
 - Throttle (rate limit) brute-force attacks against your application's login functionality (see RFC 4226, section 7.3)
 - When implementing a "greenfield" application, consider supporting
   `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
-  addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
-  MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a dedicated single-purpose
-  device, which strengthens your clients against client-side attacks. And by automating scoping of credentials to
-  relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation
-  of FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
+  addition to or instead of HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which
+  strengthens your MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a
+  dedicated single-purpose device, which strengthens your clients against client-side attacks. And by automating scoping
+  of credentials to relying party IDs (application origin/domain names), U2F adds protection against phishing attacks.
+  One implementation of FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
 
 We also recommend that implementers read the
 `OWASP Authentication Cheat Sheet
@@ -57,7 +57,7 @@ Usage
 
 Time-based OTPs
 ~~~~~~~~~~~~~~~
-::
+.. code:: python
 
     import pyotp
     import time
@@ -72,7 +72,7 @@ Time-based OTPs
 
 Counter-based OTPs
 ~~~~~~~~~~~~~~~~~~
-::
+.. code:: python
 
     import pyotp
     
@@ -88,11 +88,15 @@ Counter-based OTPs
 Generating a Secret Key
 ~~~~~~~~~~~~~~~~~~~~~~~
 A helper function is provided to generate a 32-character base32 secret, compatible with Google Authenticator and other
-OTP apps::
+OTP apps:
+
+.. code:: python
 
     pyotp.random_base32()
 
-Some applications want the secret key to be formatted as a hex-encoded string::
+Some applications want the secret key to be formatted as a hex-encoded string:
+
+.. code:: python
 
     pyotp.random_hex()  # returns a 40-character hex-encoded secret
 
@@ -100,7 +104,9 @@ Google Authenticator Compatible
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 PyOTP works with the Google Authenticator iPhone and Android app, as well as other OTP apps like Authy. PyOTP includes
-the ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps::
+the ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps:
+
+.. code:: python
 
     pyotp.totp.TOTP('JBSWY3DPEHPK3PXP').provisioning_uri(name='alice@google.com', issuer_name='Secure App')
 
@@ -113,7 +119,9 @@ the ability to generate provisioning URIs for use with the QR Code scanner built
 This URL can then be rendered as a QR Code (for example, using https://github.com/soldair/node-qrcode) which can then be
 scanned and added to the users list of OTP credentials.
 
-Parsing these URLs is also supported::
+Parsing these URLs is also supported:
+
+.. code:: python
 
     pyotp.parse_uri('otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App')
 
@@ -128,9 +136,11 @@ Working example
 
 Scan the following barcode with your phone's OTP app (e.g. Google Authenticator):
 
-.. image:: https://chart.apis.google.com/chart?cht=qr&chs=250x250&chl=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
+.. image:: https://quickchart.io/qr?size=250&text=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
+
+Now run the following and compare the output:
 
-Now run the following and compare the output::
+.. code:: python
 
     import pyotp
     totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")

pyotp-2.11.1/SECURITY.md

@@ -0,0 +1,9 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you believe you have found a security vulnerability in this project, please report it to us by submitting a security advisory at https://github.com/pyauth/pyotp/security/advisories. You can expect an initial response within 14 days.
+
+## Supported Versions
+
+In general, the maintainers of this project provide security updates only for the most recent published release. If you need support for prior versions, please open an issue and describe your situation. Requests for updates to prior releases will be considered on a case-by-case basis, and will generally be accommodated only for the latest releases in prior major version release series.