feat(security): add tink package to pypi

[vgrozdanic]

Adds tink package that will be used in a first iteration of EncryptedField in Sentry

Closes TET-582: Add tink package to sentry pypi

[asottile-sentry]

as before, I really don't want us to use tink it is a huge maintenance liability and is significantly different from how most of the python community does things. #1375 (comment)

for example it alone would have delayed our python 3.13 upgrade by six months

[vgrozdanic]

as before, I really don't want us to use tink it is a huge maintenance liability and is significantly different from how most of the python community does things. #1375 (comment)

for example it alone would have delayed our python 3.13 upgrade by six months

I agree with you, but tink will be used only in the first iteration so that we can start working on this, cause there is bunch of other things to figure out around this. There is a plan to add support for tink primitives in cryptography library in parallel with this work, so that we can replace tink as soon as it lands into the cryptography library. That would be drop-in replacement for tink. This should be replaced with cryptography way before next Python release.

The other option would be to use custom library/wrapper around Fernet (written by us), which is less secure than tink, and we might not be aware of some problems with the way tink does serialization of data (i am not expecting any problems here, but it's hard to tell) and the way we handle the data across the system and in backups.

We can even delay GA of this, until we have a functioning version without tink as a dependency, in case this is still not present in cryptography by the time we want to upgrade Python, we can just rip tink off and do a Python upgrade

[asottile-sentry]

I'd rather we never introduce it at all. once it's available it's going to be nearly impossible to prevent / rip out.

[vgrozdanic]

Understandable, closing this then. We can start the work with other libraries, and switch to a newer version of cryptography once it is ready