This is a reimplementation of Matthew Garrett's tpmtotp software for TPM 2.0 using the tpm2-tss software stack.
Its purpose is to attest the trustworthiness of a device against a human using time-based one-time passwords (TOTP),
facilitating the Trusted Platform Module (TPM) to bind the TOTP secret to the known trustworthy system state.
In addition to the original tpmtotp, given the new capabilities of in-TPM HMAC calculation,
the tpm2-totp's secret HMAC keys do not have to be exported from the TPM to the CPU's RAM on boot anymore.
Another addition is the ability to rebind an old secret to the current PCRs in case a software component was changed on purpose,
using a user-defined password.
Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.
Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.