Tink Python v1.16.0

This is Tink Python v1.16.0

The complete list of changes since 1.15.0 can be found
here.

What's new

• Added several features to the GCP KMS integration:
  • MAC computation and verification.
  • Asymmetric signing and verification for the following algorithms:
    • RSA
    • ECDSA
    • ML-DSA (pure and external-mu)
    • SLH-DSA (pure and pre-hash)
  • new_client function to create a Tink KmsClient from
    an existing KeyManagementServiceClient.
• Added key templates for the ML-DSA and SLH-DSA post-quantum signing
  algorithms.
• Added hybrid key templates for HPKE with post-quantum parameters (based on
  X-Wing).
• Dropped support for Python 3.9 as it reached EOL
  https://devguide.python.org/versions/#status-of-python-versions.
• macOS binary wheels are now built with protobuf==5.29.5.
• Now rejects JWK Sets with duplicate JSON keys
• JWT validation is now stricter: JWTs with a non-string "typ" header are now
  always rejected.

Dependency Upgrades

• pip (26.1.2)
• requests (2.33.0)
• tink-cc (2.8.0)
• rules_python (2.2.0)
• rules_cc (0.2.22)
• abseil-cpp (20260526.0)
• pybind11_bazel (3.0.1)
• platforms (1.1.0)
• google-crc32c (1.8.0)
• google-cloud-kms (3.16.0)

Get started

To get started using Tink, see
the setup guide.

Pip

# Core Tink.
pip3 install tink==1.16.0
# Core Tink + Google Cloud KMS extension.
pip3 install tink[gcpkms]==1.16.0
# Core Tink + AWS KMS extension.
pip3 install tink[awskms]==1.16.0
# Core Tink + HashiCorp Vault KMS extension.
pip3 install tink[hcvault]==1.16.0
# Core Tink + all the KMS extensions.
pip3 install tink[all]==1.16.0

Bazel

Tink Python can be used in a Bazel project as a pip dependency using
rules_python's pip_parse macro.