> + (base32		:url "https://gitlab.com/fledermaus/totp.el"
> +  :ignored-files ("totp-auth*.el" "Makefile" "*.md" "*.html" "tests" "README")
> +  :version-map   (("0.2" "1.0" "v1.0")))

Question about this one:

    (defun base32-lsh (v c)
      "Shift integer V by C bits to the left.
    Shift rightwards if C is negative.
    Any bits shifted in are 0.
    Suppress opinionated (and in our case wrong) warning about ’lsh’."
      (with-suppressed-warnings ((suspicious lsh))
        (lsh v c)))

I replace the above with

    (define-obsolete-function-alias 'base32-lsh #'ash "2024")

and the tests still go through just fine.  Also tracing `base32-lsh`
suggests it's never called with a negative argument, which would explain
why `ash` works just as well.

Could point out where you rely on the unusual behavior of `lsh`, the one
described in the docstring as:

    In this case, if VALUE is a negative fixnum treat it as unsigned,
    i.e., subtract 2 * ‘most-negative-fixnum’ from VALUE before shifting it.

?


>   (bash-completion	:url "https://github.com/szermatt/emacs-bash-completion"
>    :readme "README.md")
>  
> @@ -760,6 +764,10 @@
>   (toc-org		:url "https://github.com/snosov1/toc-org.git"
>    :ignored-files ("COPYING" ".travis.yml" "toc-org-test.el"))
>  
> + (totp-auth		:url "https://gitlab.com/fledermaus/totp.el"
> +  :ignored-files ("base32.el" "Makefile" "*.md" "*.html" "tests")
> +  :version-map   (("0.4" "1.0" "v1.0")))

It would be better to put the shared ignored files (i.e. `*.html`,
`Makefile`, and `tests`) in `.elpaignore`, I think.
Also, I'm curious about the reason why you prefer keeping `README` over
`README.md`?  If I were you, I'd get rid of `README`,

One more thing: AFAICT, you have signed the copyright paperwork and
you're the sole author of this code, so we could add it to GNU ELPA
instead of NonGNU ELPA.  Is that indeed the case?
Would you be OK with that?

In any case, I pushed your patch, thanks.
See below a ptch with suggested changes (and a few FIXME questions).


        Stefan