v1.10.0

Tink is a multi-language, cross-platform library that provides simple and misuse-proof APIs for common cryptographic tasks.

This is Tink Python 1.10.0

What's new

This is the first release from https://github.com/tink-crypto/tink-py.

The complete list of changes since 1.9.0 can be found here.

• Added support:
  • Python 3.12
  • MS Windows (MSVC >= 2019)
  • HashiCorp Vault; added a KMS extension providing a hcvault.new_aead API to create an AEAD that interacts with a Vault server.
• The the unused keyset_info metadata in encrypted keysets produced with tink.BinaryKeysetWriter and tink.proto_keyset_format.serialize_encrypted is not written anymore. This results in smaller keysets. tink.JsonKeysetWriter and tink.json_proto_keyset_format.serialize_encrypted are unchanged and still output keyset_info.
• Added/upgraded deps:
  • tink-cc => 2.1.3
  • Bazel => 6.4.0
  • pybind11_bazel => v2.11.1.bzl.1
  • hvac>=1.1.1 (when using the hcvault extras)
  • rules_python => 0.31.0
• PRF keys that don't use RAW output prefix type are now rejected.
• Disallow using pickle on KeysetHandle objects making __getstate__ and __setstate__ raise a TinkError; this intends to prevent unintentional serialization of keyset handles which may leak keys. To serialize the KeysetHandle, use tink.proto_keyset_format or tink.json_proto_keyset_format. If this breaks your code, please file an issue on https://github.com/tink-crypto/tink-python.
• Bazel build:
  • Updated tink_py_deps() to include all direct dependencies
  • Added tink_py_testonly_deps() to include test-only dependencies

To see what we're working towards, check our project roadmap.

Get started

To get started using Tink, see the setup guide.

Pip

# Core Tink.
pip3 install tink==1.10.0
# Core Tink + Google Cloud KMS extension.
pip3 install tink[gcpkms]==1.10.0
# Core Tink + AWS KMS extension.
pip3 install tink[awskms]==1.10.0
# Core Tink + HashiCorp Vault KMS extension.
pip3 install tink[hcvault]==1.10.0
# Core Tink + all the KMS extensions.
pip3 install tink[all]==1.10.0

Bazel

Tink Python can be used in a Bazel project as a pip dependency using rules_python’s pip_parse macro

Alternatively, tink-py can be added as a Bazel build dependency to your WORKSPACE file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "tink_py",
    urls = ["https://github.com/tink-crypto/tink-py/releases/download/v1.10.0/tink-py-1.10.0.zip"],
    strip_prefix = "tink-py-1.10.0",
    sha256 = "767453aae4aad6de4fbb4162992184aa427b7b27864fe9912c270b24c673e1cc",
)

load("@tink_py//:tink_py_deps.bzl", "tink_py_deps")
tink_py_deps()

// New
load("@rules_python//python:repositories.bzl", "py_repositories")
// New
py_repositories()

load("@tink_py//:tink_py_deps_init.bzl", "tink_py_deps_init")
tink_py_deps_init("tink_py")

Tink Python 1.9.0

Tink is a multi-language, cross-platform library that provides simple and misuse-proof APIs for common cryptographic tasks.

This is Tink Python 1.9.0

What's new

This is the first release from https://github.com/tink-crypto/tink-py.

The complete list of changes since 1.8.0 can be found here.

• Made KMS client registration API register_kms_client public
• Add json_proto_keyset_format and proto_keyset_format APIs to
  serialize/deserialize keysets
• Made dependencies for KMS extensions optional (6f0cf98, #14)
• Fixed type annotations of expected_*() functions in tink.jwt.JwtValidator.
• Dropped support for Python 3.7 (1ec991e).
• Upgraded dependencies:
  • bazel@6.0.0 => bazel@6.4.0
  • bazel_skylib@1.4.2 => bazel_skylib@1.5.0
  • protobuf@21.9 => protobuf@25.1
  • tink-cc@2.0.0 => tink-cc@2.1.0

To see what we're working towards, check our project roadmap.

Get started

To get started using Tink, see the setup guide.

Pip

# Core Tink.
pip3 install tink==1.9.0
# Core Tink + Google Cloud KMS extension.
pip3 install tink[gcpkms]==1.9.0
# Core Tink + AWS KMS extension.
pip3 install tink[awskms]==1.9.0
# Core Tink + all the KMS extensions.
pip3 install tink[all]==1.9.0

Bazel

Tink Python can be used in a Bazel project as a pip dependency using rules_python’s pip_parse macro, or tink-py can be added as a Bazel build dependency to your WORKSPACE file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "tink_py",
    urls = ["https://github.com/tink-crypto/tink-py/releases/download/v1.9.0/tink-py-1.9.0.zip"],
    strip_prefix = "tink-py-1.9.0",
    sha256 = "c5f9a7b58b79ef0e1b957154672f766489ea0ac956ad187941f950f2dc262e71",
)

load("@tink_py//:tink_py_deps.bzl", "tink_py_deps")

tink_py_deps()

load("@tink_py//:tink_py_deps_init.bzl", "tink_py_deps_init")

tink_py_deps_init("tink_py")

# ...

Tink Python 1.8.0

Tink is a multi-language, cross-platform library that provides simple and misuse-proof APIs for common cryptographic tasks.

This is Tink Python 1.8.0

What's new

This is the first release from https://github.com/tink-crypto/tink-py.

The complete list of changes since 1.7.0 can be found here.

• Added support for Python 3.11
• Publish binary wheels for Linux AArch64 (issue)
• Tink now Rejects JWTs with duplicate map-keys in JSON objects (commit)
• Upgraded to protobuf >= 4.21.9
• Upgraded to Bazel 6.0.0
• Removed dependency on Tink C++ AWS KMS (commits: #1, #2)
• Removed dependency on Tink C++ GCP KMS (commits: #1, #2)
• Restricted KMS envelope AEAD to only use Tink AEAD key types as DEK (commit)
• Use ranges for requirements and exclude known vulnerable protobuf version (commits: #1, #2; issues: #1, #2)
• Support AWS key aliases (commit)
• Implemented minor internal fixes and refactorings
• Added test scripts for internal CI

To see what we're working towards, check our project roadmap.

Get started

To get started using Tink, see the setup guide.

Pip

pip3 install tink==1.8.0

Bazel

Tink Python can be used in a Bazel project as a pip dependency using rules_python’s pip_parse macro, or tink-py can be added as a Bazel build dependency to your WORKSPACE file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "tink_py",
    urls = ["https://github.com/tink-crypto/tink-py/releases/download/v1.8.0/tink-py-1.8.0.tar.gz"],
    strip_prefix = "tink-py-1.8.0",
    sha256 = "1309f1d5d14062cd3ab623957e74bb17e98b49643d2799f33c441da06c3a61f7",
)

load("@tink_py//:tink_py_deps.bzl", "tink_py_deps")

tink_py_deps()

load("@tink_py//:tink_py_deps_init.bzl", "tink_py_deps_init")

tink_py_deps_init("tink_py")

# ...