gnu: Add goxel.
[jackhill/guix/guix.git] / gnu / packages / python-crypto.scm
index af51ae0..22b1a1e 100644 (file)
@@ -1,19 +1,19 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2015 Eric Dvorsak <eric@dvorsak.fr>
-;;; Copyright © 2015, 2016, 2017, 2018, 2019 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2015, 2016, 2017, 2019 Leo Famulari <leo@famulari.name>
-;;; Copyright © 2016, 2017 Marius Bakke <mbakke@fastmail.com>
+;;; Copyright © 2016, 2017, 2020 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2017 Ben Sturmfels <ben@sturm.com.au>
 ;;; Copyright © 2016 Sou Bunnbu <iyzsong@gmail.com>
 ;;; Copyright © 2015 Cyril Roelandt <tipecaml@gmail.com>
 ;;; Copyright © 2014, 2017 Eric Bavier <bavier@member.fsf.org>
 ;;; Copyright © 2015, 2016 David Thompson <davet@gnu.org>
-;;; Copyright © 2016, 2017, 2018, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
-;;; Copyright © 2016, 2017 ng0 <ng0@n0.is>
+;;; Copyright © 2016, 2017, 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2016, 2017 Nikita <nikita@n0.is>
 ;;; Copyright © 2014, 2015 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015, 2016, 2017, 2019 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2016 Danny Milosavljevic <dannym+a@scratchpost.org>
-;;; Copyright © 2016, 2017 Arun Isaac <arunisaac@systemreboot.net>
+;;; Copyright © 2016, 2017, 2020 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2017 Carlo Zancanaro <carlo@zancanaro.id.au>
 ;;; Copyright © 2018 Tomáš Čech <sleep_walker@gnu.org>
 ;;; Copyright © 2018 Nicolas Goaziou <mail@nicolasgoaziou.fr>
@@ -21,6 +21,9 @@
 ;;; Copyright © 2018 Nam Nguyen <namn@berkeley.edu>
 ;;; Copyright © 2019 Guillaume Le Vaillant <glv@posteo.net>
 ;;; Copyright © 2019 Clément Lassieur <clement@lassieur.org>
+;;; Copyright © 2020 Alexandros Theodotou <alex@zrythm.org>
+;;; Copyright © 2020 Justus Winter <justus@sequoia-pgp.org>
+;;; Copyright © 2020 Vinicius Monego <monego@posteo.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
   #:use-module (gnu packages)
   #:use-module (gnu packages check)
   #:use-module (gnu packages crypto)
+  #:use-module (gnu packages kerberos)
   #:use-module (gnu packages libffi)
   #:use-module (gnu packages multiprecision)
+  #:use-module (gnu packages password-utils)
   #:use-module (gnu packages protobuf)
   #:use-module (gnu packages python)
+  #:use-module (gnu packages python-check)
+  #:use-module (gnu packages python-compression)
   #:use-module (gnu packages python-web)
   #:use-module (gnu packages python-xyz)
+  #:use-module (gnu packages swig)
   #:use-module (gnu packages time)
   #:use-module (gnu packages tls)
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (srfi srfi-1))
 
+(define-public python-potr
+  (package
+    (name "python-potr")
+    (version "1.0.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri
+        (git-reference
+         (url "https://github.com/python-otr/pure-python-otr.git")
+         (commit version)))
+       (file-name
+        (git-file-name name version))
+       (sha256
+        (base32 "1hzw6h01fm216nmipyylgz0zybd80w1xsk12m7djycnhqrnrvvv1"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-pycrypto" ,python-pycrypto)))
+    (synopsis "Python OTR Implementation")
+    (description "Python OTR is an Off-The-Record Protocol Implementation in
+Python.  It does not bind to libotr.")
+    (home-page "https://github.com/python-otr/pure-python-otr")
+    (license license:lgpl3+)))
+
 (define-public python-base58
   (package
     (name "python-base58")
@@ -201,14 +233,13 @@ This package provides a Python interface for BLAKE2.")
 (define-public python-paramiko
   (package
     (name "python-paramiko")
-    (version "2.4.2")
+    (version "2.7.2")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "paramiko" version))
        (sha256
-        (base32
-         "1jqgj2gl1pz7bi2aab1r2xq0ml0gskmm9p235cg9y32nydymm5x8"))))
+        (base32 "0dahwq623jnna7gsr9j0mkwr9k2n1pvkapjryhcx508d5jxg8dkz"))))
     (build-system python-build-system)
     (arguments
      `(;; FIXME: Tests require many unpackaged libraries, see dev-requirements.txt.
@@ -232,16 +263,24 @@ Python interface around SSH networking concepts.")
 (define-public python-ecdsa
   (package
     (name "python-ecdsa")
-    (version "0.13.3")
+    (version "0.14.1")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "ecdsa" version))
        (sha256
-        (base32 "0k9xxklf865g6x43gkfarwb25ffrkmpvkzkh71rylqx7cjq80g0n"))))
+        (base32 "13nx5cbfxc0gnax5zwdmp9xc40qd1llk62mv85jyrvqkbw017ik4"))))
     (build-system python-build-system)
-    (inputs
-     `(("openssl" ,openssl)))
+    (arguments
+     '(#:phases
+       (modify-phases %standard-phases
+         (replace 'check
+           (lambda _ (invoke "pytest"))))))
+    (propagated-inputs
+     `(("python-six" ,python-six)))
+    (native-inputs
+     `(("openssl" ,openssl)
+       ("python-pytest" ,python-pytest)))
     (home-page "https://github.com/warner/python-ecdsa")
     (synopsis "ECDSA cryptographic signature library (pure python)")
     (description
@@ -268,7 +307,8 @@ making them easy to handle and incorporate into other protocols.")
      (origin
       (method url-fetch)
       (uri (pypi-uri "pycrypto" version))
-      (patches (search-patches "python-pycrypto-CVE-2013-7459.patch"))
+      (patches (search-patches "python-pycrypto-CVE-2013-7459.patch"
+                               "python-pycrypto-time-clock.patch"))
       (sha256
        (base32
         "0g0ayql5b9mkjam8hym6zyg6bv77lbh66rv1fyvgqb17kfc1xkpj"))))
@@ -282,7 +322,7 @@ making them easy to handle and incorporate into other protocols.")
          (add-before 'build 'set-build-env
            ;; pycrypto runs an autoconf configure script behind the scenes
            (lambda _ (setenv "CONFIG_SHELL" (which "bash")) #t)))))
-    (home-page "http://www.pycrypto.org/")
+    (home-page "https://www.dlitz.net/software/pycrypto/")
     (synopsis "Cryptographic modules for Python")
     (description
      "Pycrypto is a collection of both secure hash functions (such as SHA256
@@ -299,24 +339,67 @@ etc.).  The package is structured to make adding new modules easy.")
             "python"
             (package-inputs pycrypto)))))))
 
+(define-public python-kerberos
+  (package
+    (name "python-kerberos")
+    (version "1.3.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "kerberos" version))
+       (sha256
+        (base32
+         "19663qxmma0i8bfbjc2iwy5hgq0g4pfb75r023v5dps68zfvffgh"))))
+    (build-system python-build-system)
+    (inputs
+     `(("mit-krb5" ,mit-krb5)))
+    (home-page "https://github.com/apple/ccs-pykerberos")
+    (synopsis
+     "Python Kerberos library used by CalendarServer")
+    (description
+     "This Python package is a high-level wrapper for Kerberos (GSSAPI)
+operations.  The goal is to avoid having to build a module that wraps the
+entire Kerberos.framework, and instead offer a limited set of functions that
+do what is needed for client/server Kerberos authentication based on
+<http://www.ietf.org/rfc/rfc4559.txt>.")
+    (license license:asl2.0)))
+
 (define-public python-keyring
   (package
     (name "python-keyring")
-    (version "8.7")
+    (version "21.0.0")
     (source
      (origin
       (method url-fetch)
       (uri (pypi-uri "keyring" version))
       (sha256
        (base32
-        "0482rmi2x6p78wl2kz8qzyq21xz1sbbfwnv5x7dggar4vkwxhzfx"))))
+        "1k0w3yh3fz0qp0cvkxdiinq9jzbrnc6bd88qpjz34x3cgcr94psz"))
+      (modules '((guix build utils)))
+      (snippet
+        ;; https://github.com/jaraco/keyring/issues/414
+       '(begin (substitute* "tests/test_packaging.py"
+                 (("ep, =") "(ep,) =")) #t))))
     (build-system python-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (replace 'check
+           (lambda _
+             ;; Not clear why this test fails.
+             (delete-file "tests/test_packaging.py")
+             (substitute* "pytest.ini"
+               (("--black ") ""))
+             (invoke "pytest"))))))
     (native-inputs
      `(("python-pytest" ,python-pytest)
-       ("python-pytest-runner" ,python-pytest-runner)
+       ("python-pytest-checkdocs" ,python-pytest-checkdocs)
+       ("python-pytest-cov" ,python-pytest-cov)
+       ("python-pytest-flake8" ,python-pytest-flake8)
        ("python-setuptools-scm" ,python-setuptools-scm)))
     (propagated-inputs
-     `(("python-pycrypto" ,python-pycrypto)))
+     `(("python-importlib-metadata" ,python-importlib-metadata)
+       ("python-secretstorage" ,python-secretstorage)))
     (home-page "https://github.com/jaraco/keyring")
     (synopsis "Store and access your passwords safely")
     (description
@@ -324,22 +407,83 @@ etc.).  The package is structured to make adding new modules easy.")
 service from python.  It can be used in any application that needs safe
 password storage.")
     ;; "MIT" and PSF dual license
+    (properties `((python2-variant . ,(delay python2-keyring))))
     (license license:x11)))
 
 (define-public python2-keyring
-  (package-with-python2 python-keyring))
+  (let ((keyring (package-with-python2
+                   (strip-python2-variant python-keyring))))
+    (package
+      (inherit keyring)
+      (name "python2-keyring")
+      (version "8.7")
+      (source
+        (origin
+          (method url-fetch)
+          (uri (pypi-uri "keyring" version))
+          (sha256
+           (base32
+            "0482rmi2x6p78wl2kz8qzyq21xz1sbbfwnv5x7dggar4vkwxhzfx"))))
+      (arguments
+       `(#:python ,python-2))
+      (native-inputs
+       `(("python2-pytest" ,python2-pytest)
+         ("python2-pytest-runner" ,python2-pytest-runner)
+         ("python2-setuptools-scm" ,python2-setuptools-scm)))
+      (propagated-inputs
+       `(("python2-pycrypto" ,python2-pycrypto))))))
+
+(define-public python-keyrings.alt
+  (package
+    (name "python-keyrings.alt")
+    (version "3.4.0")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "keyrings.alt" version))
+        (sha256
+         (base32
+          "0gdjdqpq2hf770p6iwi891mil0vbsdhvy88x0v8b2w4y4b28lcli"))
+        (modules '((guix build utils)))
+        (snippet
+         '(begin
+            (delete-file "keyrings/alt/_win_crypto.py")
+            ;; Rely on python-keyring>20:
+            ;; https://github.com/jaraco/keyrings.alt/issues/33
+            (substitute* '("keyrings/alt/tests/test_Gnome.py"
+                           "keyrings/alt/tests/test_Google.py"
+                           "keyrings/alt/tests/test_Windows.py"
+                           "keyrings/alt/tests/test_file.py"
+                           "keyrings/alt/tests/test_pyfs.py")
+              (("keyring.tests.test_backend") "keyring.testing.backend")
+              (("keyring.tests.util") "keyring.testing.util"))
+            #t))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-keyring" ,python-keyring)
+       ("python-pytest" ,python-pytest)
+       ("python-setuptools-scm" ,python-setuptools-scm)))
+    (home-page "https://github.com/jaraco/keyrings.alt")
+    (synopsis "Alternate keyring implementations")
+    (description "Keyrings in this package may have security risks or other
+implications.  These backends were extracted from the main keyring project to
+make them available for those who wish to employ them, but are discouraged for
+general production use.  Include this module and use its backends at your own
+risk.")
+    (license license:expat)))
 
 (define-public python-certifi
   (package
     (name "python-certifi")
-    (version "2019.3.9")
+    (version "2020.4.5.1")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "certifi" version))
               (sha256
                (base32
-                "1bnpw7hrf9i1l9gfxjnzi45hkrvzz0pyn9ia8m4mw7sxhgb08qdj"))))
+                "06b5gfs7wmmipln8f3z928d2mmx2j4b3x7pnqmj6cvmyfh8v7z2i"))))
     (build-system python-build-system)
+    (arguments '(#:tests? #f))          ;no tests
     (home-page "https://certifi.io/")
     (synopsis "Python CA certificate bundle")
     (description
@@ -353,14 +497,14 @@ is used by the Requests library to verify HTTPS requests.")
 (define-public python-cryptography-vectors
   (package
     (name "python-cryptography-vectors")
-    (version "2.7")
+    (version "2.9.2")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "cryptography_vectors" version))
        (sha256
         (base32
-         "1g38zw90510azyfrj6mxbslx2gp9yrnv5dac0w2819k9ssdznbgi"))))
+         "1d4iykcv7cn9j399hczlxm5pzxmqy6d80h3j16dkjwlmv3293b4r"))))
     (build-system python-build-system)
     (home-page "https://github.com/pyca/cryptography")
     (synopsis "Test vectors for the cryptography package")
@@ -375,14 +519,14 @@ is used by the Requests library to verify HTTPS requests.")
 (define-public python-cryptography
   (package
     (name "python-cryptography")
-    (version "2.7")
+    (version "2.9.2")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "cryptography" version))
        (sha256
         (base32
-         "1inlnr36kl36551c9rcad99jmhk81v33by3glkadwdcgmi17fd76"))))
+         "0af25w5mkd6vwns3r6ai1w5ip9xp0ms9s261zzssbpadzdr05hx0"))))
     (build-system python-build-system)
     (inputs
      `(("openssl" ,openssl)))
@@ -424,14 +568,14 @@ message digests and key derivation functions.")
 (define-public python-pyopenssl
   (package
     (name "python-pyopenssl")
-    (version "19.0.0")
+    (version "19.1.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pyOpenSSL" version))
        (sha256
         (base32
-         "007j40y7x3k8xj54dy2qnij9lldfp71k9mkflhd9vqbdiwrndjmf"))))
+         "01wmsq6w0frzbr3zps4ga9kmqjidp2h317jwpq1g9ah24r5lj94s"))))
     (build-system python-build-system)
     (arguments
      '(#:phases
@@ -440,7 +584,10 @@ message digests and key derivation functions.")
          (add-after 'install 'check
            (lambda* (#:key inputs outputs #:allow-other-keys)
              (add-installed-pythonpath inputs outputs)
-             (invoke "py.test" "-v" "-k"
+             ;; PyOpenSSL runs tests against a certificate with a fixed
+             ;; expiry time.  To ensure successful builds in the future,
+             ;; set the time to roughly the release date.
+             (invoke "faketime" "2019-01-01" "py.test" "-v" "-k"
                      (string-append
                       ;; This test tries to look up certificates from
                       ;; the compiled-in default path in OpenSSL, which
@@ -455,7 +602,8 @@ message digests and key derivation functions.")
     (inputs
      `(("openssl" ,openssl)))
     (native-inputs
-     `(("python-flaky" ,python-flaky)
+     `(("libfaketime" ,libfaketime)
+       ("python-flaky" ,python-flaky)
        ("python-pretend" ,python-pretend)
        ("python-pytest" ,python-pytest)))
     (home-page "https://github.com/pyca/pyopenssl")
@@ -491,22 +639,15 @@ library.")
 (define-public python-axolotl-curve25519
   (package
     (name "python-axolotl-curve25519")
-    (version "0.1")
+    (version "0.4.1.post2")
     (source
      (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/tgalal/python-axolotl-curve25519")
-             (commit "e4a9c4de0eae27223200579c58d1f8f6d20637e2")))
-       (file-name (string-append name "-" version "-checkout"))
+       (method url-fetch)
+       (uri (pypi-uri "python-axolotl-curve25519" version))
        (sha256
         (base32
-         "0agap5q0hmvf6cwzjqc05kw53pjgf6942pcivpazksmg1vk400ra"))))
+         "18v3rfyv7xi26fb97nw1xc0l6x8wi0i4xj8dlq4gblpbjxiac187"))))
     (build-system python-build-system)
-    (arguments
-     `(;; Prevent creation of the egg. This works around
-       ;; https://debbugs.gnu.org/cgi/bugreport.cgi?bug=20765
-       #:configure-flags '("--root=/")))
     (home-page "https://github.com/tgalal/python-axolotl-curve25519")
     (synopsis "Python wrapper for curve25519 library")
     (description "This is a python wrapper for the curve25519 library
@@ -522,17 +663,14 @@ python-axolotl.")
 (define-public python-axolotl
   (package
     (name "python-axolotl")
-    (version "0.1.39")
+    (version "0.2.3")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append
-             "https://github.com/tgalal/python-axolotl/archive/"
-             version ".tar.gz"))
-       (file-name (string-append name "-" version ".tar.gz"))
-       (patches (search-patches "python-axolotl-AES-fix.patch"))
+       (uri (pypi-uri "python-axolotl" version))
        (sha256
-        (base32 "0badsgkgz0ir3hqynxzsfjgacppi874syvvmgccc6j164053x6zm"))))
+        (base32
+         "1bwdp24fmriffwx91aigs9k162albb51iskp23nc939z893q23py"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
@@ -545,9 +683,8 @@ python-axolotl.")
              #t)))))
     (propagated-inputs
      `(("python-axolotl-curve25519" ,python-axolotl-curve25519)
-       ("python-dateutil" ,python-dateutil)
-       ("python-protobuf" ,python-protobuf)
-       ("python-pycrypto" ,python-pycrypto)))
+       ("python-cryptography" ,python-cryptography)
+       ("python-protobuf" ,python-protobuf)))
     (home-page "https://github.com/tgalal/python-axolotl")
     (synopsis "Python port of libaxolotl-android")
     (description "This is a python port of libaxolotl-android.  This
@@ -609,7 +746,7 @@ ECB and OFB).")
       (origin
        (method git-fetch)
        (uri (git-reference
-              (url "https://github.com/wbond/asn1crypto.git")
+              (url "https://github.com/wbond/asn1crypto")
               (commit version)))
         (file-name (git-file-name name version))
         (sha256
@@ -629,26 +766,44 @@ PKCS#8, PKCS#12, PKCS#5, X.509 and TSP.")
 (define-public python-pynacl
   (package
     (name "python-pynacl")
-    (version "1.3.0")
+    (version "1.4.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "PyNaCl" version))
        (modules '((guix build utils)))
-       ;; Remove bundled libsodium.
-       (snippet '(begin (delete-file-recursively "src/libsodium")
-                        #t))
+       (snippet
+        '(begin
+           ;; Remove spurious dependency on python-wheel, can be removed
+           ;; for 1.5.
+           (substitute* "setup.py"
+             (("\"wheel\"") ""))
+           ;; Remove bundled libsodium.
+           (delete-file-recursively "src/libsodium")
+           #t))
        (sha256
         (base32
-         "0330wyvggm19xhmwmz9rrr97lzbv3siwfy50gmax3vvgs7nh0q8c"))))
+         "01b56hxrbif3hx8l6rwz5kljrgvlbj7shmmd2rjh0hn7974a5sal"))))
     (build-system python-build-system)
     (arguments
-     `(#:phases
-       (modify-phases %standard-phases
+     `(#:modules (,@%python-build-system-modules
+                  (guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26))
+       #:phases
+       (modify-phases (@ (guix build python-build-system) %standard-phases)
          (add-before 'build 'use-system-sodium
            (lambda _
              (setenv "SODIUM_INSTALL" "system")
-             #t)))))
+             #t))
+         (replace 'check
+           (lambda _
+             (let ((build-directory
+                    (car (scandir "build" (cut string-prefix? "lib" <>)))))
+               (setenv "PYTHONPATH"
+                       (string-append "./build/" build-directory ":"
+                                      (getenv "PYTHONPATH")))
+               (invoke "pytest" "-vv")))))))
     (native-inputs
      `(("python-hypothesis" ,python-hypothesis)
        ("python-pytest" ,python-pytest)))
@@ -736,6 +891,40 @@ key), SSH public key, ASC-encoded OpenPGP key, APK Android application, LDIFF
 file, and more.")
     (license license:gpl3)))
 
+(define-public python-blurhash
+  (package
+    (name "python-blurhash")
+    (version "1.1.4")
+    (source
+      (origin
+        ;; Tests not included in pypi release and releases not tagged in git repo.
+        (method git-fetch)
+        (uri (git-reference
+               (url "https://github.com/halcy/blurhash-python")
+               (commit "22e081ef1c24da1bb5c5eaa2c1d6649724deaef8")))
+        (file-name (git-file-name name version))
+        (sha256
+         (base32
+          "1qq6mhydlp7q3na4kmaq3871h43wh3pyfyxr4b79bia73wjdylxf"))))
+    (build-system python-build-system)
+    (arguments
+     '(#:phases
+       (modify-phases %standard-phases
+         (replace 'check
+           (lambda _
+             (delete-file "setup.cfg")
+             (invoke "pytest"))))))
+    (native-inputs
+     `(("python-numpy" ,python-numpy)
+       ("python-pillow" ,python-pillow)
+       ("python-pytest" ,python-pytest)))
+    (home-page "https://github.com/halcy/blurhash-python")
+    (synopsis
+     "Pure-Python implementation of the blurhash algorithm")
+    (description
+     "Pure-Python implementation of the blurhash algorithm.")
+    (license license:expat)))
+
 (define-public python-ecpy
   (package
     (name "python-ecpy")
@@ -851,6 +1040,7 @@ in userspace)
         (base32 "09yirf3w77w6f49q6nxhrjm9c3a4y9s30s1k09chqrw8zdgx8sjc"))))
     (build-system python-build-system)
     (inputs `(("openssl" ,openssl)))
+    (native-inputs `(("swig" ,swig)))
     (home-page "https://gitlab.com/m2crypto/m2crypto")
     (synopsis "Python crypto and TLS toolkit")
     (description "@code{M2Crypto} is a complete Python wrapper for OpenSSL
@@ -957,7 +1147,7 @@ been constructed to maintain extensive documentation on how to use
     (build-system python-build-system)
     (inputs
      `(("openssl" ,openssl)))
-    (home-page "http://bitbucket.org/mhallin/py-scrypt")
+    (home-page "https://bitbucket.org/mhallin/py-scrypt")
     (synopsis "Bindings for the scrypt key derivation function library")
     (description "This is a set of Python bindings for the scrypt key
 derivation function.")
@@ -1053,7 +1243,6 @@ Password-Authenticated Key Exchange algorithm.")
      `(("python-automat" ,python-automat)
        ("python-idna" ,python-idna)
        ("python-incremental" ,python-incremental)
-       ("python-ipaddress" ,python-ipaddress)
        ("python-service-identity" ,python-service-identity)
        ("python-twisted" ,python-twisted)
        ("python-zope-interface" ,python-zope-interface)))
@@ -1127,3 +1316,278 @@ storing and retrieving sensitive information in your programs.")
 package provides a tool to securely sign firmware images for booting by
 MCUboot.")
     (license license:expat)))
+
+(define-public python-ntlm-auth
+  (package
+    (name "python-ntlm-auth")
+    (version "1.4.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "ntlm-auth" version))
+       (sha256
+        (base32
+         "16mavidki4ma5ip8srqalr19gz4f5yn3cnmmgps1fmgfr24j63rm"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-cryptography" ,python-cryptography)))
+    (home-page "https://github.com/jborean93/ntlm-auth")
+    (synopsis
+     "Calculates NTLM Authentication codes")
+    (description
+     "This library handles the low-level details of NTLM authentication for
+use in authenticating with a service that uses NTLM.  It will create and parse
+the 3 different message types in the order required and produce a base64
+encoded value that can be attached to the HTTP header.
+
+The goal of this library is to offer full NTLM support including signing and
+sealing of messages as well as supporting MIC for message integrity and the
+ability to customise and set limits on the messages sent.  Please see Features
+and Backlog for a list of what is and is not currently supported.")
+    (license license:expat)))
+
+(define-public python-secretstorage
+  (package
+    (name "python-secretstorage")
+    (version "3.1.2")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "SecretStorage" version))
+        (sha256
+         (base32
+          "1xmzr0j3066s220bss4nkgqbiwb5k4kkp2rkpqlqwjb5kfc8mnhm"))))
+    (build-system python-build-system)
+    (arguments
+     '(#:tests? #f)) ; Tests require a running dbus service.
+    (propagated-inputs
+     `(("python-cryptography" ,python-cryptography)
+       ("python-jeepney" ,python-jeepney)))
+    (home-page "https://github.com/mitya57/secretstorage")
+    (synopsis "Python bindings to FreeDesktop.org Secret Service API")
+    (description
+     "@code{python-secretstorage} provides a way for securely storing passwords
+and other secrets.  It uses D-Bus Secret Service API that is supported by GNOME
+Keyring (since version 2.30) and KSecretsService.  SecretStorage supports most
+of the functions provided by Secret Service, including creating and deleting
+items and collections, editing items, locking and unlocking collections
+(asynchronous unlocking is also supported).")
+    (license license:bsd-3)))
+
+(define-public python-trustme
+  (package
+    (name "python-trustme")
+    (version "0.6.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "trustme" version))
+       (sha256
+        (base32 "0v3vr5z6apnfmklf07m45kv5kaqvm6hxrkaqywch57bjd2siiywx"))))
+    (build-system python-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (replace 'check
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (add-installed-pythonpath inputs outputs)
+             (invoke "pytest" "-vv"))))))
+    (native-inputs
+     `(("python-more-itertools" ,python-more-itertools)
+       ("python-pyopenssl" ,python-pyopenssl)
+       ("python-pytest" ,python-pytest)
+       ("python-pytest-cov" ,python-pytest-cov)
+       ("python-service-identity" ,python-service-identity)
+       ("python-zipp" ,python-zipp)))
+    (propagated-inputs
+     `(("python-cryptography" ,python-cryptography)))
+    (home-page "https://github.com/python-trio/trustme")
+    (synopsis "Fake a certificate authority for tests")
+    (description
+     "@code{trustme} is a tiny Python package that does one thing: it gives you
+a fake certificate authority (CA) that you can use to generate fake TLS certs to
+use in your tests.")
+    ;; Either license applies.
+    (license (list license:expat license:asl2.0))))
+
+(define-public python-certipy
+  (package
+    (name "python-certipy")
+    (version "0.1.3")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "certipy" version))
+        (sha256
+         (base32
+          "0n980gqpzh0fm58h3i4mi2i10wgj606lscm1r5sk60vbf6vh8mv9"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-pyopenssl" ,python-pyopenssl)))
+    (native-inputs
+     `(("python-pytest" ,python-pytest)))
+    (home-page "https://github.com/LLNL/certipy")
+    (synopsis "Utility to create and sign CAs and certificates")
+    (description
+     "Certipy was made to simplify the certificate creation process.  To that
+end, certipy exposes methods for creating and managing certificate authorities,
+certificates, signing and building trust bundles.")
+    (license license:bsd-3)))
+
+(define-public python-jeepney
+  (package
+    (name "python-jeepney")
+    (version "0.4.3")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "jeepney" version))
+        (sha256
+         (base32 "0vp3p1lqhqk2kd3254q5sxr50znmm2hmysc8a7g0fr1brihvhy9l"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-testpath" ,python-testpath)
+       ("python-tornado" ,python-tornado)
+       ("python-pytest" ,python-pytest)))
+    (home-page "https://gitlab.com/takluyver/jeepney")
+    (synopsis "Low-level, pure Python DBus protocol wrapper")
+    (description
+     "This is a low-level, pure Python DBus protocol client.  It has an
+I/O-free core, and integration modules for different event loops.")
+    (license license:expat)))
+
+(define-public python-argon2-cffi
+  (package
+    (name "python-argon2-cffi")
+    (version "20.1.0")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "argon2-cffi" version))
+        (sha256
+         (base32
+          "0zgr4mnnm0p4i99023safb0qb8cgvl202nly1rvylk2b7qnrn0nq"))
+        (modules '((guix build utils)))
+        (snippet '(begin (delete-file-recursively "extras") #t))))
+    (build-system python-build-system)
+    (arguments
+     '(#:phases
+       (modify-phases %standard-phases
+         (replace 'build
+           (lambda _
+             (setenv "ARGON2_CFFI_USE_SYSTEM" "1")
+             (invoke "python" "setup.py" "build")))
+         (replace 'check
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (add-installed-pythonpath inputs outputs)
+             (invoke "pytest")
+             (invoke "python" "-m" "argon2" "--help")
+             ;; see tox.ini
+             (invoke "python" "-m" "argon2" "-n" "1" "-t" "1" "-m" "8" "-p" "1"))))))
+    (propagated-inputs
+     `(("python-cffi" ,python-cffi)
+       ("python-six" ,python-six)))
+    (inputs `(("argon2" ,argon2)))
+    (native-inputs
+     `(("python-hypothesis" ,python-hypothesis)
+       ("python-pytest" ,python-pytest)))
+    (home-page "https://argon2-cffi.readthedocs.io/")
+    (synopsis "Secure Password Hashes for Python")
+    (description
+     "Argon2 is a secure password hashing algorithm.  It is designed to have
+both a configurable runtime as well as memory consumption.  This means that you
+can decide how long it takes to hash a password and how much memory is required.")
+    (license license:expat)))
+
+(define-public python-privy
+  (package
+    (name "python-privy")
+    (version "6.0.0")
+    (source
+      (origin
+        (method git-fetch)
+        (uri (git-reference
+               ;; Releases are untagged
+               (url "https://github.com/ofek/privy")
+               (commit "2838db3df239797c71bddacc48a4c49a83f35747")))
+        (file-name (git-file-name name version))
+        (sha256
+         (base32
+          "1m32dh5fqc8cy7jyf1z5fs6zvmdkbq5fi98hr609gbl7s0l0y0i9"))))
+    (build-system python-build-system)
+    (arguments
+     '(#:phases
+       (modify-phases %standard-phases
+         (replace 'check
+           (lambda _
+             (invoke "python" "-m" "pytest"))))))
+    (native-inputs
+     `(("python-pytest" ,python-pytest)))
+    (propagated-inputs
+     `(("python-argon2-cffi" ,python-argon2-cffi)
+       ("python-cryptography" ,python-cryptography)))
+    (home-page "https://www.dropbox.com/developers")
+    (synopsis "Library to password-protect your data")
+    (description
+     "Privy is a small and fast utility for password-protecting secret
+data such as API keys, cryptocurrency wallets, or seeds for digital
+signatures.")
+    (license (list license:expat license:asl2.0)))) ; dual licensed
+
+(define-public python-pgpy
+  (package
+    (name "python-pgpy")
+    (version "0.5.2")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "PGPy" version))
+        (sha256
+         (base32
+          "0i4lqhzdwkjkim3wab0kqadx28z3r5ixlh6qxj4lif4gif56c0m7"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-cryptography" ,python-cryptography)
+       ("python-pyasn1" ,python-pyasn1)
+       ("python-singledispatch" ,python-singledispatch)
+       ("python-six" ,python-six)))
+    (home-page "https://github.com/SecurityInnovation/PGPy")
+    (synopsis "Python implementation of OpenPGP")
+    (description
+     "Currently, PGPy can load keys and signatures of all kinds in both ASCII
+armored and binary formats.
+
+It can create and verify RSA, DSA, and ECDSA signatures, at the moment.  It
+can also encrypt and decrypt messages using RSA and ECDH.")
+    (license license:bsd-3)))
+
+(define-public python-sop
+  (package
+    (name "python-sop")
+    (version "0.2.0")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "sop" version))
+        (sha256
+         (base32
+          "0gljyjsdn6hdmwlwwb5g5s0c031p6izamvfxp0d39x60af8k5jyf"))))
+    (build-system python-build-system)
+    (arguments
+     '(#:tests? #f)) ; There are no tests, and unittest throws an error trying
+                     ; to find some:
+                     ;     TypeError: don't know how to make test from: 0.2.0
+    (home-page "https://gitlab.com/dkg/python-sop")
+    (synopsis "Stateless OpenPGP Command-Line Interface")
+    (description
+     "The Stateless OpenPGP Command-Line Interface (or sop) is a
+specification that encourages OpenPGP implementors to provide a common,
+relatively simple command-line API for purposes of object security.
+
+This Python module helps implementers build such a CLI from any implementation
+accessible to the Python interpreter.
+
+It does not provide such an implementation itself -- this is just the
+scaffolding for the command line, which should make it relatively easy to
+supply a handful of python functions as methods to a class.")
+    (license license:expat))) ; MIT license