Tink is a multi-language, cross-platform library that provides simple and misuse-proof APIs for common cryptographic tasks.

This is Tink Python 1.12

The complete list of changes since 1.11.0 can be found here.

What's new

Bug Fixes

• Validate output returned by ciphertext_destination in streamingaead. This prevents segmentation faults if the underlying stream reports back too many bytes written. See #43.

Features

• Added support for Python 3.13.
• Added support for passing robot credentials in the GcpKmsClient.

Dependency updates

• New dependencies:
  • bazel-runfiles (=> 1.3.0), only needed for tests.
• Updated deps:
  • protobuf (=> 6.30.2)
• Dependency changes when building with Bazel:
  • Bazel (=> 8.2.1)
  • Added platforms (0.0.11)
  • Updated pybind11_bazel (=> 2.13.6)
  • Updated rules_python (=> 1.4.0)
• Dropped support for Python 3.8.
• Added support for Python 3.13.
• Renamed the file "VERSION" to "TINK_VERSION.txt" in order to avoid build problems on Windows.
• When building Tink Python with Bazel we now use bzlmod. Since pip install for the sdist (source distribution) uses Bazel, this impacts how Tink is built for people using sdist.

Get started

To get started using Tink, see the setup guide.

Pip

# Core Tink.
pip3 install tink==<VERSION>
# Core Tink + Google Cloud KMS extension.
pip3 install tink[gcpkms]==<VERSION>
# Core Tink + AWS KMS extension.
pip3 install tink[awskms]==<VERSION>
# Core Tink + HashiCorp Vault KMS extension.
pip3 install tink[hcvault]==<VERSION>
# Core Tink + all the KMS extensions.
pip3 install tink[all]==<VERSION>

Bazel

Tink Python can be used in a Bazel project as a pip dependency using rules_python’s pip_parse macro.