astralix-tl
Telegram MTProto client library for astralix Userbot, based on HerokuTL and Telethon.
Repository: https://git.astralix.cc/lowsense-dev/astralix-tl (public). No project Telegram channels or chats.
Install from source
uv venv .venv
uv pip install --python .venv/bin/python .
The distribution is named astralix-tl; Python imports use astralixtl:
from astralixtl import TelegramClient
The build generates Telegram types from the included schemas. Build a wheel with uv build --wheel.
Security changes
This fork bounds packet lengths and gzip output, validates MTProto framing and DH responses with checks active under Python optimization, restricts web downloads to public HTTP(S) endpoints with TLS verification and size/time limits, hardens session-file permissions, and inspects renamed session uploads without optional dependencies.
These changes have regression tests in tests/test_security.py. They are a targeted review, not a guarantee that all vulnerabilities have been found. New DH primes and downloads above the configured limits require review. Live Telegram login has not been tested in this revision.
uv pip install --python .venv/bin/python aiohttp
.venv/bin/python -I -m unittest discover -s tests -v
.venv/bin/python -I -O -m unittest discover -s tests -v
License and origins
MIT; see LICENSE.md. Copyright notices for the upstream code and astralix modifications are retained. See NOTICE.md.
1 maintainer
Release files for astralix-tl 1.0.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| astralix_tl-1.0.0.tar.gz | 383.7 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| astralix_tl-1.0.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 1.2 MB
Release files / astralix_tl-1.0.0.tar.gz
| Download URL | astralix_tl-1.0.0.tar.gz |
|---|---|
| Size | 383.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
2aa9c6809be5e61daabde39fb7e93fc9e642976a42ccd21f24ad8ebe58468951
|
|
BLAKE2b-256 checksum How to use checksums |
a40b93b2ccd47b10551333be4167b852251590162713907f6238325edcc09db2
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 26, 2026.
Transparency logRelease files / astralix_tl-1.0.0-py3-none-any.whl
| Download URL | astralix_tl-1.0.0-py3-none-any.whl |
|---|---|
| Size | 835.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
928b378c75c5e12b8de8ca7dc7e07f0f5829a26b7545994498f3961bb17c7a4e
|
|
BLAKE2b-256 checksum How to use checksums |
0d35ec6076262c70a60bf8db604c9483251b3082b23a0f8614203f26940f442b
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 26, 2026.
Transparency log
