diff --git a/BUILD.gn b/BUILD.gn
new file mode 100644
index 0000000..ef94f82
--- /dev/null
+++ b/BUILD.gn
@@ -0,0 +1,23 @@
+# Copyright 2018 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+config("tink_config") {
+  cflags = [
+    "-Wno-ignored-qualifiers",
+
+    # The tink library uses absl headers containing deprecated API usage.
+    "-Wno-deprecated-declarations",
+
+    # The tink library uses absl headers with implicit copy constructors.
+    "-Wno-deprecated-copy",
+
+    # The tink library does not restrict extra semicolon.
+    "-Wno-extra-semi",
+  ]
+
+  include_dirs = [
+    "$root_gen_dir/third_party/tink/cc",
+    "//third_party/tink",
+  ]
+}
diff --git a/OWNERS b/OWNERS
new file mode 100644
index 0000000..528b11e
--- /dev/null
+++ b/OWNERS
@@ -0,0 +1,5 @@
+# AUTOGENERATED FROM DEPENDENT BUILD TARGETS.
+# TO MAKE CHANGES HERE, UPDATE //third_party/owners.toml.
+# DOCS: https://fuchsia.dev/reference/tools/fx/cmd/update-3p-owners
+
+include /third_party/cobalt/OWNERS
diff --git a/README.fuchsia b/README.fuchsia
new file mode 100644
index 0000000..b598eaf
--- /dev/null
+++ b/README.fuchsia
@@ -0,0 +1,4 @@
+Name: Tink
+URL: https://github.com/google/tink
+LICENSE: Apache 2.0 license
+License File: LICENSE
diff --git a/cc/BUILD.gn b/cc/BUILD.gn
new file mode 100644
index 0000000..e13bee0
--- /dev/null
+++ b/cc/BUILD.gn
@@ -0,0 +1,537 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : input_stream
+source_set("input_stream") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "input_stream.h" ]
+  public_deps = [
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aead
+source_set("aead") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "aead.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : deterministic_aead
+source_set("deterministic_aead") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "deterministic_aead.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : chunked_mac
+source_set("chunked_mac") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "chunked_mac.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hybrid_decrypt
+source_set("hybrid_decrypt") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "hybrid_decrypt.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hybrid_encrypt
+source_set("hybrid_encrypt") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "hybrid_encrypt.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : mac
+source_set("mac") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "mac.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : public_key_sign
+source_set("public_key_sign") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "public_key_sign.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : public_key_verify
+source_set("public_key_verify") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "public_key_verify.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/util:status",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : keyset_reader
+source_set("keyset_reader") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "keyset_reader.h" ]
+  public_deps = [
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : keyset_writer
+source_set("keyset_writer") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "keyset_writer.h" ]
+  public_deps = [
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : binary_keyset_reader
+source_set("binary_keyset_reader") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "binary_keyset_reader.h",
+    "core/binary_keyset_reader.cc",
+  ]
+  public_deps = [
+    ":keyset_reader",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : binary_keyset_writer
+source_set("binary_keyset_writer") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "binary_keyset_writer.h",
+    "core/binary_keyset_writer.cc",
+  ]
+  public_deps = [
+    ":keyset_writer",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : crypto_format
+source_set("crypto_format") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "core/crypto_format.cc",
+    "crypto_format.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : primitive_set
+source_set("primitive_set") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "primitive_set.h",
+    "primitive_set.h",
+  ]
+  public_deps = [
+    ":crypto_format",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/container:flat_hash_map",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/synchronization:synchronization",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : primitive_wrapper
+source_set("primitive_wrapper") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "primitive_wrapper.h" ]
+  public_deps = [
+    ":primitive_set",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : registry
+source_set("registry") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "registry.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/internal:registry_impl",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : keyset_handle
+source_set("keyset_handle") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "core/keyset_handle.cc",
+    "keyset_handle.h",
+  ]
+  public_deps = [
+    ":aead",
+    ":configuration",
+    ":insecure_secret_key_access",
+    ":key",
+    ":key_gen_configuration",
+    ":key_manager",
+    ":key_status",
+    ":keyset_reader",
+    ":keyset_writer",
+    ":primitive_set",
+    ":registry",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/container:flat_hash_map",
+    "//third_party/abseil-cpp/absl/log:check",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:optional",
+    "//third_party/tink/cc/internal:configuration_impl",
+    "//third_party/tink/cc/internal:key_gen_configuration_impl",
+    "//third_party/tink/cc/internal:key_info",
+    "//third_party/tink/cc/internal:key_status_util",
+    "//third_party/tink/cc/internal:mutable_serialization_registry",
+    "//third_party/tink/cc/internal:proto_key_serialization",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:keyset_util",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : cleartext_keyset_handle
+source_set("cleartext_keyset_handle") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "cleartext_keyset_handle.h",
+    "core/cleartext_keyset_handle.cc",
+  ]
+  public_deps = [
+    ":keyset_handle",
+    ":keyset_reader",
+    "//third_party/abseil-cpp/absl/container:flat_hash_map",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : key_manager
+source_set("key_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "core/key_manager.cc",
+    "key_manager.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : kms_client
+source_set("kms_client") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "kms_client.h" ]
+  public_deps = [
+    ":aead",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : kms_clients
+source_set("kms_clients") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "core/kms_clients.cc",
+    "kms_clients.h",
+  ]
+  public_deps = [
+    ":kms_client",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/synchronization:synchronization",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : core/template_util
+source_set("core/template_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "core/template_util.h" ]
+  public_deps = [ "//third_party/abseil-cpp/absl/meta:type_traits" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : core/key_type_manager
+source_set("core/key_type_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "core/key_type_manager.h" ]
+  public_deps = [
+    ":core/template_util",
+    ":input_stream",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : core/key_manager_impl
+source_set("core/key_manager_impl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "core/key_manager_impl.h" ]
+  public_deps = [
+    ":core/key_type_manager",
+    ":key_manager",
+    "//third_party/abseil-cpp/absl/base:base",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:constants",
+    "//third_party/tink/cc/util:status",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : core/private_key_type_manager
+source_set("core/private_key_type_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "core/private_key_type_manager.h" ]
+  public_deps = [
+    ":core/key_type_manager",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : core/private_key_manager_impl
+source_set("core/private_key_manager_impl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "core/private_key_manager_impl.h" ]
+  public_deps = [
+    ":core/key_manager_impl",
+    ":core/private_key_type_manager",
+    ":key_manager",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : parameters
+source_set("parameters") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "parameters.h" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : key
+source_set("key") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "key.h" ]
+  public_deps = [
+    ":parameters",
+    "//third_party/abseil-cpp/absl/types:optional",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : partial_key_access_token
+source_set("partial_key_access_token") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "partial_key_access_token.h" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : partial_key_access
+source_set("partial_key_access") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "partial_key_access.h" ]
+  public_deps = [ ":partial_key_access_token" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : secret_key_access_token
+source_set("secret_key_access_token") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "secret_key_access_token.h" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : insecure_secret_key_access
+source_set("insecure_secret_key_access") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "insecure_secret_key_access.h" ]
+  public_deps = [ ":secret_key_access_token" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : restricted_data
+source_set("restricted_data") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "core/restricted_data.cc",
+    "restricted_data.h",
+  ]
+  public_deps = [
+    ":secret_key_access_token",
+    "//third_party/abseil-cpp/absl/log:check",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/util:secret_data",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : key_status
+source_set("key_status") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "key_status.h" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : configuration
+source_set("configuration") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "configuration.h" ]
+  public_deps = [
+    "//third_party/tink/cc/internal:key_type_info_store",
+    "//third_party/tink/cc/internal:keyset_wrapper_store",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : key_gen_configuration
+source_set("key_gen_configuration") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "key_gen_configuration.h" ]
+  public_deps = [ "//third_party/tink/cc/internal:key_type_info_store" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/aead/BUILD.gn b/cc/aead/BUILD.gn
new file mode 100644
index 0000000..6eae32e
--- /dev/null
+++ b/cc/aead/BUILD.gn
@@ -0,0 +1,317 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : aead_wrapper
+source_set("aead_wrapper") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aead_wrapper.cc",
+    "aead_wrapper.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:primitive_wrapper",
+    "//third_party/tink/cc/internal:monitoring_util",
+    "//third_party/tink/cc/internal:registry_impl",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/monitoring:monitoring",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : cord_aead
+source_set("cord_aead") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "cord_aead.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:cord",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aead_config
+source_set("aead_config") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aead_config.cc",
+    "aead_config.h",
+  ]
+  public_deps = [
+    ":aead_wrapper",
+    ":aes_ctr_hmac_aead_key_manager",
+    ":aes_eax_key_manager",
+    ":aes_gcm_key_manager",
+    ":aes_gcm_siv_key_manager",
+    ":kms_aead_key_manager",
+    ":kms_envelope_aead_key_manager",
+    ":xchacha20_poly1305_key_manager",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/config:tink_fips",
+    "//third_party/tink/cc/mac:mac_config",
+    "//third_party/tink/cc/proto:config_proto",
+    "//third_party/tink/cc/util:status",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aead_key_templates
+source_set("aead_key_templates") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aead_key_templates.cc",
+    "aead_key_templates.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/proto:aes_ctr_hmac_aead_proto",
+    "//third_party/tink/cc/proto:aes_ctr_proto",
+    "//third_party/tink/cc/proto:aes_eax_proto",
+    "//third_party/tink/cc/proto:aes_gcm_proto",
+    "//third_party/tink/cc/proto:aes_gcm_siv_proto",
+    "//third_party/tink/cc/proto:common_proto",
+    "//third_party/tink/cc/proto:hmac_proto",
+    "//third_party/tink/cc/proto:kms_envelope_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_eax_key_manager
+source_set("aes_eax_key_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "aes_eax_key_manager.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:core/template_util",
+    "//third_party/tink/cc/proto:aes_eax_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/subtle:aes_eax_boringssl",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/util:constants",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_gcm_key_manager
+source_set("aes_gcm_key_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "aes_gcm_key_manager.h" ]
+  public_deps = [
+    ":cord_aead",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:core/template_util",
+    "//third_party/tink/cc:input_stream",
+    "//third_party/tink/cc/aead/internal:cord_aes_gcm_boringssl",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/proto:aes_gcm_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/subtle:aes_gcm_boringssl",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/util:constants",
+    "//third_party/tink/cc/util:input_stream_util",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_gcm_siv_key_manager
+source_set("aes_gcm_siv_key_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "aes_gcm_siv_key_manager.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:core/template_util",
+    "//third_party/tink/cc/proto:aes_gcm_siv_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/subtle:aes_gcm_siv_boringssl",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/util:constants",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_ctr_hmac_aead_key_manager
+source_set("aes_ctr_hmac_aead_key_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aes_ctr_hmac_aead_key_manager.cc",
+    "aes_ctr_hmac_aead_key_manager.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/status:statusor",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:core/template_util",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/mac:hmac_key_manager",
+    "//third_party/tink/cc/proto:aes_ctr_hmac_aead_proto",
+    "//third_party/tink/cc/proto:aes_ctr_proto",
+    "//third_party/tink/cc/proto:common_proto",
+    "//third_party/tink/cc/proto:hmac_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/subtle:aes_ctr_boringssl",
+    "//third_party/tink/cc/subtle:encrypt_then_authenticate",
+    "//third_party/tink/cc/subtle:ind_cpa_cipher",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/util:constants",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:input_stream_util",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : xchacha20_poly1305_key_manager
+source_set("xchacha20_poly1305_key_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "xchacha20_poly1305_key_manager.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:core/template_util",
+    "//third_party/tink/cc:input_stream",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/proto:xchacha20_poly1305_proto",
+    "//third_party/tink/cc/subtle:subtle",
+    "//third_party/tink/cc/subtle:xchacha20_poly1305_boringssl",
+    "//third_party/tink/cc/util:constants",
+    "//third_party/tink/cc/util:input_stream_util",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : kms_aead_key_manager
+source_set("kms_aead_key_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "kms_aead_key_manager.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:core/template_util",
+    "//third_party/tink/cc:kms_client",
+    "//third_party/tink/cc:kms_clients",
+    "//third_party/tink/cc/proto:kms_aead_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:constants",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : kms_envelope_aead
+source_set("kms_envelope_aead") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "kms_envelope_aead.cc",
+    "kms_envelope_aead.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/base:endian",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/aead/internal:aead_util",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : kms_envelope_aead_key_manager
+source_set("kms_envelope_aead_key_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "kms_envelope_aead_key_manager.cc",
+    "kms_envelope_aead_key_manager.h",
+  ]
+  public_deps = [
+    ":kms_envelope_aead",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:core/template_util",
+    "//third_party/tink/cc:kms_client",
+    "//third_party/tink/cc:kms_clients",
+    "//third_party/tink/cc/aead/internal:aead_util",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/proto:kms_envelope_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:constants",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/aead/internal/BUILD.gn b/cc/aead/internal/BUILD.gn
new file mode 100644
index 0000000..1202a08
--- /dev/null
+++ b/cc/aead/internal/BUILD.gn
@@ -0,0 +1,132 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : aead_util
+source_set("aead_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aead_util.cc",
+    "aead_util.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/container:flat_hash_set",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : ssl_aead
+source_set("ssl_aead") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "ssl_aead.cc",
+    "ssl_aead.h",
+  ]
+  public_deps = [
+    ":aead_util",
+    "//third_party/abseil-cpp/absl/cleanup:cleanup",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:span",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/internal:err_util",
+    "//third_party/tink/cc/internal:ssl_unique_ptr",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : cord_aes_gcm_boringssl
+source_set("cord_aes_gcm_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "cord_aes_gcm_boringssl.cc",
+    "cord_aes_gcm_boringssl.h",
+  ]
+  public_deps = [
+    ":aead_util",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:cord",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/aead:cord_aead",
+    "//third_party/tink/cc/internal:ssl_unique_ptr",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/subtle:subtle_util",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : zero_copy_aead
+source_set("zero_copy_aead") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "zero_copy_aead.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aead_from_zero_copy
+source_set("aead_from_zero_copy") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aead_from_zero_copy.cc",
+    "aead_from_zero_copy.h",
+  ]
+  public_deps = [
+    ":zero_copy_aead",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc/subtle:subtle_util",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : zero_copy_aes_gcm_boringssl
+source_set("zero_copy_aes_gcm_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "zero_copy_aes_gcm_boringssl.cc",
+    "zero_copy_aes_gcm_boringssl.h",
+  ]
+  public_deps = [
+    ":aead_util",
+    ":ssl_aead",
+    ":zero_copy_aead",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/subtle:subtle_util",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/config/BUILD.gn b/cc/config/BUILD.gn
new file mode 100644
index 0000000..153acaf
--- /dev/null
+++ b/cc/config/BUILD.gn
@@ -0,0 +1,36 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : config_util
+source_set("config_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "config_util.cc",
+    "config_util.h",
+  ]
+  public_deps = [ "//third_party/tink/cc/proto:config_proto" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : tink_fips
+source_set("tink_fips") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "tink_fips.cc",
+    "tink_fips.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/internal:registry_impl",
+    "//third_party/tink/cc/util:status",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/daead/BUILD.gn b/cc/daead/BUILD.gn
new file mode 100644
index 0000000..60caac3
--- /dev/null
+++ b/cc/daead/BUILD.gn
@@ -0,0 +1,22 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : deterministic_aead_key_templates
+source_set("deterministic_aead_key_templates") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "deterministic_aead_key_templates.cc",
+    "deterministic_aead_key_templates.h",
+  ]
+  public_deps = [
+    "//third_party/tink/cc/proto:aes_siv_proto",
+    "//third_party/tink/cc/proto:common_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/daead/subtle/BUILD.gn b/cc/daead/subtle/BUILD.gn
new file mode 100644
index 0000000..f46dcb5
--- /dev/null
+++ b/cc/daead/subtle/BUILD.gn
@@ -0,0 +1,23 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : aead_or_daead
+source_set("aead_or_daead") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aead_or_daead.cc",
+    "aead_or_daead.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/functional:bind_front",
+    "//third_party/abseil-cpp/absl/types:variant",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:deterministic_aead",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/hybrid/BUILD.gn b/cc/hybrid/BUILD.gn
new file mode 100644
index 0000000..9a507bc
--- /dev/null
+++ b/cc/hybrid/BUILD.gn
@@ -0,0 +1,312 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : hybrid_config
+source_set("hybrid_config") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hybrid_config.cc",
+    "hybrid_config.h",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_private_key_manager",
+    ":ecies_aead_hkdf_public_key_manager",
+    ":hybrid_decrypt_wrapper",
+    ":hybrid_encrypt_wrapper",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/aead:aead_config",
+    "//third_party/tink/cc/config:config_util",
+    "//third_party/tink/cc/config:tink_fips",
+    "//third_party/tink/cc/proto:config_proto",
+    "//third_party/tink/cc/util:status",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hpke_config
+source_set("hpke_config") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hpke_config.cc",
+    "hpke_config.h",
+  ]
+  public_deps = [
+    ":hybrid_decrypt_wrapper",
+    ":hybrid_encrypt_wrapper",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/aead:aead_config",
+    "//third_party/tink/cc/config:tink_fips",
+    "//third_party/tink/cc/hybrid/internal:hpke_private_key_manager",
+    "//third_party/tink/cc/hybrid/internal:hpke_public_key_manager",
+    "//third_party/tink/cc/util:status",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hybrid_decrypt_wrapper
+source_set("hybrid_decrypt_wrapper") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hybrid_decrypt_wrapper.cc",
+    "hybrid_decrypt_wrapper.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:primitive_wrapper",
+    "//third_party/tink/cc/internal:monitoring_util",
+    "//third_party/tink/cc/internal:registry_impl",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/monitoring:monitoring",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hybrid_encrypt_wrapper
+source_set("hybrid_encrypt_wrapper") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hybrid_encrypt_wrapper.cc",
+    "hybrid_encrypt_wrapper.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:primitive_wrapper",
+    "//third_party/tink/cc/internal:monitoring_util",
+    "//third_party/tink/cc/internal:registry_impl",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/monitoring:monitoring",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hybrid_decrypt_factory
+source_set("hybrid_decrypt_factory") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hybrid_decrypt_factory.cc",
+    "hybrid_decrypt_factory.h",
+  ]
+  public_deps = [
+    ":hybrid_decrypt_wrapper",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hybrid_encrypt_factory
+source_set("hybrid_encrypt_factory") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hybrid_encrypt_factory.cc",
+    "hybrid_encrypt_factory.h",
+  ]
+  public_deps = [
+    ":hybrid_encrypt_wrapper",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:keyset_handle",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hybrid_key_templates
+source_set("hybrid_key_templates") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hybrid_key_templates.cc",
+    "hybrid_key_templates.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/aead:aead_key_templates",
+    "//third_party/tink/cc/daead:deterministic_aead_key_templates",
+    "//third_party/tink/cc/proto:common_proto",
+    "//third_party/tink/cc/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/cc/proto:hpke_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : ecies_aead_hkdf_dem_helper
+source_set("ecies_aead_hkdf_dem_helper") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "ecies_aead_hkdf_dem_helper.cc",
+    "ecies_aead_hkdf_dem_helper.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/status:statusor",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:deterministic_aead",
+    "//third_party/tink/cc/aead:aes_ctr_hmac_aead_key_manager",
+    "//third_party/tink/cc/daead/subtle:aead_or_daead",
+    "//third_party/tink/cc/proto:aes_ctr_hmac_aead_proto",
+    "//third_party/tink/cc/proto:aes_ctr_proto",
+    "//third_party/tink/cc/proto:aes_gcm_proto",
+    "//third_party/tink/cc/proto:aes_siv_proto",
+    "//third_party/tink/cc/proto:common_proto",
+    "//third_party/tink/cc/proto:hmac_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/proto:xchacha20_poly1305_proto",
+    "//third_party/tink/cc/subtle:aes_gcm_boringssl",
+    "//third_party/tink/cc/subtle:aes_siv_boringssl",
+    "//third_party/tink/cc/subtle:xchacha20_poly1305_boringssl",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : ecies_aead_hkdf_hybrid_decrypt
+source_set("ecies_aead_hkdf_hybrid_decrypt") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "ecies_aead_hkdf_hybrid_decrypt.cc",
+    "ecies_aead_hkdf_hybrid_decrypt.h",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_dem_helper",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc/internal:ec_util",
+    "//third_party/tink/cc/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/cc/subtle:ecies_hkdf_recipient_kem_boringssl",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : ecies_aead_hkdf_hybrid_encrypt
+source_set("ecies_aead_hkdf_hybrid_encrypt") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "ecies_aead_hkdf_hybrid_encrypt.cc",
+    "ecies_aead_hkdf_hybrid_encrypt.h",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_dem_helper",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/cc/subtle:ecies_hkdf_sender_kem_boringssl",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : ecies_aead_hkdf_private_key_manager
+source_set("ecies_aead_hkdf_private_key_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "ecies_aead_hkdf_private_key_manager.cc",
+    "ecies_aead_hkdf_private_key_manager.h",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_hybrid_decrypt",
+    ":ecies_aead_hkdf_public_key_manager",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:core/private_key_type_manager",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc/internal:ec_util",
+    "//third_party/tink/cc/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:constants",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : ecies_aead_hkdf_public_key_manager
+source_set("ecies_aead_hkdf_public_key_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "ecies_aead_hkdf_public_key_manager.cc",
+    "ecies_aead_hkdf_public_key_manager.h",
+  ]
+  public_deps = [
+    ":ecies_aead_hkdf_hybrid_encrypt",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc/proto:common_proto",
+    "//third_party/tink/cc/proto:ecies_aead_hkdf_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:constants",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/hybrid/internal/BUILD.gn b/cc/hybrid/internal/BUILD.gn
new file mode 100644
index 0000000..6f1bb40
--- /dev/null
+++ b/cc/hybrid/internal/BUILD.gn
@@ -0,0 +1,198 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : hpke_context
+source_set("hpke_context") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hpke_context.cc",
+    "hpke_context.h",
+  ]
+  public_deps = [
+    ":hpke_context_boringssl",
+    ":hpke_util",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hpke_context_boringssl
+source_set("hpke_context_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hpke_context_boringssl.cc",
+    "hpke_context_boringssl.h",
+  ]
+  public_deps = [
+    ":hpke_util",
+    ":hpke_util_boringssl",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/internal:ssl_unique_ptr",
+    "//third_party/tink/cc/subtle:subtle_util",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hpke_decrypt
+source_set("hpke_decrypt") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hpke_decrypt.cc",
+    "hpke_decrypt.h",
+  ]
+  public_deps = [
+    ":hpke_context",
+    ":hpke_util",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc/proto:hpke_proto",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hpke_encrypt
+source_set("hpke_encrypt") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hpke_encrypt.cc",
+    "hpke_encrypt.h",
+  ]
+  public_deps = [
+    ":hpke_context",
+    ":hpke_util",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc/proto:hpke_proto",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hpke_key_manager_util
+source_set("hpke_key_manager_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hpke_key_manager_util.cc",
+    "hpke_key_manager_util.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/tink/cc/proto:hpke_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hpke_private_key_manager
+source_set("hpke_private_key_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hpke_private_key_manager.cc",
+    "hpke_private_key_manager.h",
+  ]
+  public_deps = [
+    ":hpke_decrypt",
+    ":hpke_key_manager_util",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:core/private_key_type_manager",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc/internal:ec_util",
+    "//third_party/tink/cc/proto:hpke_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:constants",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hpke_public_key_manager
+source_set("hpke_public_key_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hpke_public_key_manager.cc",
+    "hpke_public_key_manager.h",
+  ]
+  public_deps = [
+    ":hpke_encrypt",
+    ":hpke_key_manager_util",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc/proto:hpke_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:constants",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hpke_util
+source_set("hpke_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hpke_util.cc",
+    "hpke_util.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/internal:ec_util",
+    "//third_party/tink/cc/proto:hpke_proto",
+    "//third_party/tink/cc/subtle:common_enums",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hpke_util_boringssl
+source_set("hpke_util_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hpke_util_boringssl.cc",
+    "hpke_util_boringssl.h",
+  ]
+  public_deps = [
+    ":hpke_util",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/proto:hpke_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/hybrid/internal/hpke_context.cc b/cc/hybrid/internal/hpke_context.cc
index e0d5675..282db5c 100644
--- a/cc/hybrid/internal/hpke_context.cc
+++ b/cc/hybrid/internal/hpke_context.cc
@@ -21,6 +21,7 @@
 #include <utility>
 
 #include "absl/status/status.h"
+#include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 #include "tink/hybrid/internal/hpke_context_boringssl.h"
 #include "tink/util/secret_data.h"
diff --git a/cc/internal/BUILD.gn b/cc/internal/BUILD.gn
new file mode 100644
index 0000000..affe66f
--- /dev/null
+++ b/cc/internal/BUILD.gn
@@ -0,0 +1,567 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : keyset_wrapper
+source_set("keyset_wrapper") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "keyset_wrapper.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/container:flat_hash_map",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : util
+source_set("util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "util.cc",
+    "util.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/log:log",
+    "//third_party/abseil-cpp/absl/strings:strings",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : keyset_wrapper_impl
+source_set("keyset_wrapper_impl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "keyset_wrapper_impl.h" ]
+  public_deps = [
+    ":key_info",
+    ":keyset_wrapper",
+    "//third_party/abseil-cpp/absl/container:flat_hash_map",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:primitive_wrapper",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : ssl_unique_ptr
+source_set("ssl_unique_ptr") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "ssl_unique_ptr.h" ]
+  public_deps = [ "//third_party/boringssl:crypto" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : key_info
+source_set("key_info") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "key_info.cc",
+    "key_info.h",
+  ]
+  public_deps = [ "//third_party/tink/cc/proto:tink_proto" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : registry_impl
+source_set("registry_impl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "registry_impl.cc",
+    "registry_impl.h",
+  ]
+  public_deps = [
+    ":fips_utils",
+    ":key_type_info_store",
+    ":keyset_wrapper",
+    ":keyset_wrapper_store",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/container:flat_hash_map",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/synchronization:synchronization",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:core/private_key_type_manager",
+    "//third_party/tink/cc:input_stream",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:primitive_wrapper",
+    "//third_party/tink/cc/monitoring:monitoring",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : fips_utils
+source_set("fips_utils") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "fips_utils.cc",
+    "fips_utils.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/util:status",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : err_util
+source_set("err_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "err_util.cc",
+    "err_util.h",
+  ]
+  public_deps = [ "//third_party/boringssl:crypto" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : bn_util
+source_set("bn_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "bn_util.cc",
+    "bn_util.h",
+  ]
+  public_deps = [
+    ":ssl_unique_ptr",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:span",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/subtle:subtle_util",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : ec_util
+source_set("ec_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "ec_util.cc",
+    "ec_util.h",
+  ]
+  public_deps = [
+    ":bn_util",
+    ":err_util",
+    ":fips_utils",
+    ":ssl_unique_ptr",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:span",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/subtle:common_enums",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/subtle:subtle_util",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : md_util
+source_set("md_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "md_util.cc",
+    "md_util.h",
+  ]
+  public_deps = [
+    ":err_util",
+    ":util",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/subtle:common_enums",
+    "//third_party/tink/cc/subtle:subtle_util",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_util
+source_set("aes_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aes_util.cc",
+    "aes_util.h",
+  ]
+  public_deps = [
+    ":util",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:span",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : monitoring_util
+source_set("monitoring_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "monitoring_util.h" ]
+  public_deps = [
+    ":key_status_util",
+    "//third_party/abseil-cpp/absl/container:flat_hash_map",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:key_status",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc/monitoring:monitoring",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : serialization
+source_set("serialization") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "serialization.h" ]
+  public_deps = [ "//third_party/abseil-cpp/absl/strings:strings" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : proto_parameters_serialization
+source_set("proto_parameters_serialization") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "proto_parameters_serialization.cc",
+    "proto_parameters_serialization.h",
+  ]
+  public_deps = [
+    ":serialization",
+    ":util",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : proto_key_serialization
+source_set("proto_key_serialization") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "proto_key_serialization.cc",
+    "proto_key_serialization.h",
+  ]
+  public_deps = [
+    ":serialization",
+    ":util",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:optional",
+    "//third_party/tink/cc:restricted_data",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : legacy_proto_key
+source_set("legacy_proto_key") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "legacy_proto_key.cc",
+    "legacy_proto_key.h",
+  ]
+  public_deps = [
+    ":proto_key_serialization",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:optional",
+    "//third_party/tink/cc:key",
+    "//third_party/tink/cc:parameters",
+    "//third_party/tink/cc:secret_key_access_token",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : parser_index
+source_set("parser_index") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "parser_index.h" ]
+  public_deps = [
+    ":serialization",
+    "//third_party/abseil-cpp/absl/strings:strings",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : serializer_index
+source_set("serializer_index") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "serializer_index.h" ]
+  public_deps = [
+    ":serialization",
+    "//third_party/tink/cc:key",
+    "//third_party/tink/cc:parameters",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : parameters_parser
+source_set("parameters_parser") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "parameters_parser.h" ]
+  public_deps = [
+    ":parser_index",
+    ":serialization",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:parameters",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : parameters_serializer
+source_set("parameters_serializer") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "parameters_serializer.h" ]
+  public_deps = [
+    ":serialization",
+    ":serializer_index",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:parameters",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : key_parser
+source_set("key_parser") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "key_parser.h" ]
+  public_deps = [
+    ":parser_index",
+    ":serialization",
+    "//third_party/abseil-cpp/absl/functional:function_ref",
+    "//third_party/abseil-cpp/absl/log:log",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:optional",
+    "//third_party/tink/cc:key",
+    "//third_party/tink/cc:secret_key_access_token",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : key_serializer
+source_set("key_serializer") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "key_serializer.h" ]
+  public_deps = [
+    ":serialization",
+    ":serializer_index",
+    "//third_party/abseil-cpp/absl/functional:function_ref",
+    "//third_party/abseil-cpp/absl/log:log",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/types:optional",
+    "//third_party/tink/cc:key",
+    "//third_party/tink/cc:secret_key_access_token",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : key_status_util
+source_set("key_status_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "key_status_util.cc",
+    "key_status_util.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/tink/cc:key_status",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : serialization_registry
+source_set("serialization_registry") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "serialization_registry.cc",
+    "serialization_registry.h",
+  ]
+  public_deps = [
+    ":key_parser",
+    ":key_serializer",
+    ":parameters_parser",
+    ":parameters_serializer",
+    ":parser_index",
+    ":serialization",
+    ":serializer_index",
+    "//third_party/abseil-cpp/absl/container:flat_hash_map",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:str_format",
+    "//third_party/abseil-cpp/absl/types:optional",
+    "//third_party/tink/cc:key",
+    "//third_party/tink/cc:parameters",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : mutable_serialization_registry
+source_set("mutable_serialization_registry") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "mutable_serialization_registry.cc",
+    "mutable_serialization_registry.h",
+  ]
+  public_deps = [
+    ":key_parser",
+    ":key_serializer",
+    ":legacy_proto_key",
+    ":parameters_parser",
+    ":parameters_serializer",
+    ":proto_key_serialization",
+    ":serialization",
+    ":serialization_registry",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/synchronization:synchronization",
+    "//third_party/abseil-cpp/absl/types:optional",
+    "//third_party/tink/cc:insecure_secret_key_access",
+    "//third_party/tink/cc:key",
+    "//third_party/tink/cc:parameters",
+    "//third_party/tink/cc:secret_key_access_token",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : configuration_impl
+source_set("configuration_impl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "configuration_impl.h" ]
+  public_deps = [
+    ":key_type_info_store",
+    ":keyset_wrapper_store",
+    "//third_party/tink/cc:configuration",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : key_type_info_store
+source_set("key_type_info_store") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "key_type_info_store.cc",
+    "key_type_info_store.h",
+  ]
+  public_deps = [
+    ":fips_utils",
+    "//third_party/abseil-cpp/absl/container:flat_hash_map",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:core/key_manager_impl",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:core/private_key_manager_impl",
+    "//third_party/tink/cc:core/private_key_type_manager",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : keyset_wrapper_store
+source_set("keyset_wrapper_store") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "keyset_wrapper_store.h" ]
+  public_deps = [
+    ":keyset_wrapper",
+    ":keyset_wrapper_impl",
+    "//third_party/tink/cc:primitive_wrapper",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : key_gen_configuration_impl
+source_set("key_gen_configuration_impl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "key_gen_configuration_impl.h" ]
+  public_deps = [
+    ":key_type_info_store",
+    "//third_party/tink/cc:key_gen_configuration",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/internal/monitoring_util.h b/cc/internal/monitoring_util.h
index 3e9a365..a2b2c13 100644
--- a/cc/internal/monitoring_util.h
+++ b/cc/internal/monitoring_util.h
@@ -21,6 +21,7 @@
 
 #include "absl/container/flat_hash_map.h"
 #include "absl/status/status.h"
+#include "absl/strings/str_cat.h"
 #include "absl/strings/strip.h"
 #include "tink/internal/key_status_util.h"
 #include "tink/key_status.h"
diff --git a/cc/mac/BUILD.gn b/cc/mac/BUILD.gn
new file mode 100644
index 0000000..601f2fc
--- /dev/null
+++ b/cc/mac/BUILD.gn
@@ -0,0 +1,293 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : mac_wrapper
+source_set("mac_wrapper") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "mac_wrapper.cc",
+    "mac_wrapper.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:primitive_wrapper",
+    "//third_party/tink/cc/internal:monitoring_util",
+    "//third_party/tink/cc/internal:registry_impl",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/monitoring:monitoring",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : mac_config
+source_set("mac_config") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "mac_config.cc",
+    "mac_config.h",
+  ]
+  public_deps = [
+    ":aes_cmac_key_manager",
+    ":aes_cmac_proto_serialization",
+    ":hmac_key_manager",
+    ":hmac_proto_serialization",
+    ":mac_wrapper",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/tink/cc:registry",
+    "//third_party/tink/cc/config:config_util",
+    "//third_party/tink/cc/config:tink_fips",
+    "//third_party/tink/cc/mac/internal:chunked_mac_wrapper",
+    "//third_party/tink/cc/proto:config_proto",
+    "//third_party/tink/cc/util:status",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_cmac_key_manager
+source_set("aes_cmac_key_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "aes_cmac_key_manager.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:chunked_mac",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:key_manager",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc/mac/internal:chunked_mac_impl",
+    "//third_party/tink/cc/proto:aes_cmac_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/subtle:aes_cmac_boringssl",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/util:constants",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hmac_key_manager
+source_set("hmac_key_manager") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hmac_key_manager.cc",
+    "hmac_key_manager.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:chunked_mac",
+    "//third_party/tink/cc:core/key_type_manager",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc/mac/internal:chunked_mac_impl",
+    "//third_party/tink/cc/proto:common_proto",
+    "//third_party/tink/cc/proto:hmac_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/subtle:hmac_boringssl",
+    "//third_party/tink/cc/subtle:random",
+    "//third_party/tink/cc/util:constants",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:input_stream_util",
+    "//third_party/tink/cc/util:protobuf_helper",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/cc/util:validation",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : mac_parameters
+source_set("mac_parameters") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "mac_parameters.h" ]
+  public_deps = [ "//third_party/tink/cc:parameters" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : mac_key
+source_set("mac_key") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "mac_key.h" ]
+  public_deps = [
+    ":mac_parameters",
+    "//third_party/tink/cc:key",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_cmac_parameters
+source_set("aes_cmac_parameters") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aes_cmac_parameters.cc",
+    "aes_cmac_parameters.h",
+  ]
+  public_deps = [
+    ":mac_parameters",
+    "//third_party/abseil-cpp/absl/log:log",
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_cmac_key
+source_set("aes_cmac_key") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aes_cmac_key.cc",
+    "aes_cmac_key.h",
+  ]
+  public_deps = [
+    ":aes_cmac_parameters",
+    ":mac_key",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/strings:str_format",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:optional",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc:partial_key_access_token",
+    "//third_party/tink/cc:restricted_data",
+    "//third_party/tink/cc/subtle:subtle_util",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_cmac_proto_serialization
+source_set("aes_cmac_proto_serialization") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aes_cmac_proto_serialization.cc",
+    "aes_cmac_proto_serialization.h",
+  ]
+  public_deps = [
+    ":aes_cmac_key",
+    ":aes_cmac_parameters",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/types:optional",
+    "//third_party/tink/cc:partial_key_access",
+    "//third_party/tink/cc:restricted_data",
+    "//third_party/tink/cc:secret_key_access_token",
+    "//third_party/tink/cc/internal:key_parser",
+    "//third_party/tink/cc/internal:key_serializer",
+    "//third_party/tink/cc/internal:mutable_serialization_registry",
+    "//third_party/tink/cc/internal:parameters_parser",
+    "//third_party/tink/cc/internal:parameters_serializer",
+    "//third_party/tink/cc/internal:proto_key_serialization",
+    "//third_party/tink/cc/internal:proto_parameters_serialization",
+    "//third_party/tink/cc/proto:aes_cmac_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hmac_parameters
+source_set("hmac_parameters") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hmac_parameters.cc",
+    "hmac_parameters.h",
+  ]
+  public_deps = [
+    ":mac_parameters",
+    "//third_party/abseil-cpp/absl/log:log",
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hmac_key
+source_set("hmac_key") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hmac_key.cc",
+    "hmac_key.h",
+  ]
+  public_deps = [
+    ":hmac_parameters",
+    ":mac_key",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/strings:str_format",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:optional",
+    "//third_party/tink/cc:partial_key_access_token",
+    "//third_party/tink/cc:restricted_data",
+    "//third_party/tink/cc/subtle:subtle_util",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hmac_proto_serialization
+source_set("hmac_proto_serialization") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hmac_proto_serialization.cc",
+    "hmac_proto_serialization.h",
+  ]
+  public_deps = [
+    ":hmac_key",
+    ":hmac_parameters",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/types:optional",
+    "//third_party/tink/cc:partial_key_access",
+    "//third_party/tink/cc:restricted_data",
+    "//third_party/tink/cc:secret_key_access_token",
+    "//third_party/tink/cc/internal:key_parser",
+    "//third_party/tink/cc/internal:key_serializer",
+    "//third_party/tink/cc/internal:mutable_serialization_registry",
+    "//third_party/tink/cc/internal:parameters_parser",
+    "//third_party/tink/cc/internal:parameters_serializer",
+    "//third_party/tink/cc/internal:proto_key_serialization",
+    "//third_party/tink/cc/internal:proto_parameters_serialization",
+    "//third_party/tink/cc/proto:common_proto",
+    "//third_party/tink/cc/proto:hmac_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/mac/aes_cmac_parameters.cc b/cc/mac/aes_cmac_parameters.cc
index f29b081..4064d2f 100644
--- a/cc/mac/aes_cmac_parameters.cc
+++ b/cc/mac/aes_cmac_parameters.cc
@@ -23,6 +23,7 @@
 #include <set>
 
 #include "absl/log/log.h"
+#include "absl/strings/str_cat.h"
 #include "tink/crypto_format.h"
 #include "tink/internal/util.h"
 #include "tink/util/status.h"
diff --git a/cc/mac/hmac_parameters.cc b/cc/mac/hmac_parameters.cc
index 1dab463..ad94b7b 100644
--- a/cc/mac/hmac_parameters.cc
+++ b/cc/mac/hmac_parameters.cc
@@ -24,6 +24,7 @@
 #include <set>
 
 #include "absl/log/log.h"
+#include "absl/strings/str_cat.h"
 #include "tink/crypto_format.h"
 #include "tink/internal/util.h"
 #include "tink/util/status.h"
diff --git a/cc/mac/internal/BUILD.gn b/cc/mac/internal/BUILD.gn
new file mode 100644
index 0000000..37ac86e
--- /dev/null
+++ b/cc/mac/internal/BUILD.gn
@@ -0,0 +1,54 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : chunked_mac_impl
+source_set("chunked_mac_impl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "chunked_mac_impl.cc",
+    "chunked_mac_impl.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc:chunked_mac",
+    "//third_party/tink/cc/proto:aes_cmac_proto",
+    "//third_party/tink/cc/proto:hmac_proto",
+    "//third_party/tink/cc/subtle:stateful_cmac_boringssl",
+    "//third_party/tink/cc/subtle:stateful_hmac_boringssl",
+    "//third_party/tink/cc/subtle/mac:stateful_mac",
+    "//third_party/tink/cc/util:enums",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : chunked_mac_wrapper
+source_set("chunked_mac_wrapper") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "chunked_mac_wrapper.cc",
+    "chunked_mac_wrapper.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:chunked_mac",
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:primitive_wrapper",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/monitoring/BUILD.gn b/cc/monitoring/BUILD.gn
new file mode 100644
index 0000000..eae3e72
--- /dev/null
+++ b/cc/monitoring/BUILD.gn
@@ -0,0 +1,20 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : monitoring
+source_set("monitoring") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "monitoring.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/container:flat_hash_map",
+    "//third_party/tink/cc:key_status",
+    "//third_party/tink/cc/internal:key_status_util",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/proto/BUILD.gn b/cc/proto/BUILD.gn
new file mode 100644
index 0000000..136faa2
--- /dev/null
+++ b/cc/proto/BUILD.gn
@@ -0,0 +1,155 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+import("//third_party/protobuf/proto_library.gni")
+
+# Proto Library : common_proto
+proto_library("common_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "common.proto" ]
+}
+
+# Proto Library : tink_proto
+proto_library("tink_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "tink.proto" ]
+}
+
+# Proto Library : config_proto
+proto_library("config_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "config.proto" ]
+}
+
+# Proto Library : aes_siv_proto
+proto_library("aes_siv_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "aes_siv.proto" ]
+}
+
+# Proto Library : ecdsa_proto
+proto_library("ecdsa_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "ecdsa.proto" ]
+  deps = [ ":common_proto" ]
+}
+
+# Proto Library : aes_cmac_proto
+proto_library("aes_cmac_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "aes_cmac.proto" ]
+}
+
+# Proto Library : hmac_proto
+proto_library("hmac_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "hmac.proto" ]
+  deps = [ ":common_proto" ]
+}
+
+# Proto Library : aes_ctr_proto
+proto_library("aes_ctr_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "aes_ctr.proto" ]
+}
+
+# Proto Library : aes_ctr_hmac_aead_proto
+proto_library("aes_ctr_hmac_aead_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "aes_ctr_hmac_aead.proto" ]
+  deps = [
+    ":aes_ctr_proto",
+    ":hmac_proto",
+  ]
+}
+
+# Proto Library : aes_gcm_proto
+proto_library("aes_gcm_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "aes_gcm.proto" ]
+}
+
+# Proto Library : aes_gcm_siv_proto
+proto_library("aes_gcm_siv_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "aes_gcm_siv.proto" ]
+}
+
+# Proto Library : aes_eax_proto
+proto_library("aes_eax_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "aes_eax.proto" ]
+}
+
+# Proto Library : kms_aead_proto
+proto_library("kms_aead_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "kms_aead.proto" ]
+}
+
+# Proto Library : kms_envelope_proto
+proto_library("kms_envelope_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "kms_envelope.proto" ]
+  deps = [ ":tink_proto" ]
+}
+
+# Proto Library : ecies_aead_hkdf_proto
+proto_library("ecies_aead_hkdf_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "ecies_aead_hkdf.proto" ]
+  deps = [
+    ":common_proto",
+    ":tink_proto",
+  ]
+}
+
+# Proto Library : xchacha20_poly1305_proto
+proto_library("xchacha20_poly1305_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "xchacha20_poly1305.proto" ]
+}
+
+# Proto Library : hpke_proto
+proto_library("hpke_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink/cc"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "hpke.proto" ]
+}
diff --git a/cc/signature/BUILD.gn b/cc/signature/BUILD.gn
new file mode 100644
index 0000000..94da1be
--- /dev/null
+++ b/cc/signature/BUILD.gn
@@ -0,0 +1,47 @@
+# Copyright 2019 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# CC Library : public_key_verify_wrapper
+source_set("public_key_verify_wrapper") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "public_key_verify_wrapper.cc",
+    "public_key_verify_wrapper.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:primitive_wrapper",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:tink_proto",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : public_key_sign_wrapper
+source_set("public_key_sign_wrapper") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "public_key_sign_wrapper.cc",
+    "public_key_sign_wrapper.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:crypto_format",
+    "//third_party/tink/cc:primitive_set",
+    "//third_party/tink/cc:primitive_wrapper",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc/subtle:subtle_util_boringssl",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+    "//third_party/tink/proto:tink_proto",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/subtle/BUILD.gn b/cc/subtle/BUILD.gn
new file mode 100644
index 0000000..f1d93fb
--- /dev/null
+++ b/cc/subtle/BUILD.gn
@@ -0,0 +1,460 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : subtle
+source_set("subtle") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aes_gcm_boringssl.h",
+    "aes_siv_boringssl.h",
+    "common_enums.h",
+    "encrypt_then_authenticate.h",
+    "hkdf.h",
+    "hmac_boringssl.h",
+    "ind_cpa_cipher.h",
+    "random.h",
+  ]
+  public_deps = [
+    ":aes_gcm_boringssl",
+    ":aes_siv_boringssl",
+    ":common_enums",
+    ":encrypt_then_authenticate",
+    ":hkdf",
+    ":hmac_boringssl",
+    ":random",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:span",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:deterministic_aead",
+    "//third_party/tink/cc:hybrid_decrypt",
+    "//third_party/tink/cc:hybrid_encrypt",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc:public_key_sign",
+    "//third_party/tink/cc:public_key_verify",
+    "//third_party/tink/cc/aead/internal:aead_from_zero_copy",
+    "//third_party/tink/cc/aead/internal:zero_copy_aead",
+    "//third_party/tink/cc/internal:aes_util",
+    "//third_party/tink/cc/internal:ssl_unique_ptr",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : ind_cpa_cipher
+source_set("ind_cpa_cipher") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "ind_cpa_cipher.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : ecies_hkdf_recipient_kem_boringssl
+source_set("ecies_hkdf_recipient_kem_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "ecies_hkdf_recipient_kem_boringssl.cc",
+    "ecies_hkdf_recipient_kem_boringssl.h",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":hkdf",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/internal:ec_util",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/internal:ssl_unique_ptr",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : ecies_hkdf_sender_kem_boringssl
+source_set("ecies_hkdf_sender_kem_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "ecies_hkdf_sender_kem_boringssl.cc",
+    "ecies_hkdf_sender_kem_boringssl.h",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":hkdf",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/internal:ec_util",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/internal:ssl_unique_ptr",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hkdf
+source_set("hkdf") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hkdf.cc",
+    "hkdf.h",
+  ]
+  public_deps = [
+    ":common_enums",
+    ":subtle_util",
+    "//third_party/abseil-cpp/absl/algorithm:container",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:span",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/internal:md_util",
+    "//third_party/tink/cc/internal:ssl_unique_ptr",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_cmac_boringssl
+source_set("aes_cmac_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aes_cmac_boringssl.cc",
+    "aes_cmac_boringssl.h",
+  ]
+  public_deps = [
+    ":subtle_util",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc/internal:aes_util",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/internal:ssl_unique_ptr",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : hmac_boringssl
+source_set("hmac_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "hmac_boringssl.cc",
+    "hmac_boringssl.h",
+  ]
+  public_deps = [
+    ":common_enums",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/internal:md_util",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_gcm_boringssl
+source_set("aes_gcm_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aes_gcm_boringssl.cc",
+    "aes_gcm_boringssl.h",
+  ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc/aead/internal:aead_from_zero_copy",
+    "//third_party/tink/cc/aead/internal:zero_copy_aead",
+    "//third_party/tink/cc/aead/internal:zero_copy_aes_gcm_boringssl",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_eax_boringssl
+source_set("aes_eax_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aes_eax_boringssl.cc",
+    "aes_eax_boringssl.h",
+  ]
+  public_deps = [
+    ":random",
+    ":subtle_util",
+    "//third_party/abseil-cpp/absl/algorithm:container",
+    "//third_party/abseil-cpp/absl/base:config",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:span",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc/internal:aes_util",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : encrypt_then_authenticate
+source_set("encrypt_then_authenticate") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "encrypt_then_authenticate.cc",
+    "encrypt_then_authenticate.h",
+  ]
+  public_deps = [
+    ":ind_cpa_cipher",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc:mac",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_ctr_boringssl
+source_set("aes_ctr_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aes_ctr_boringssl.cc",
+    "aes_ctr_boringssl.h",
+  ]
+  public_deps = [
+    ":ind_cpa_cipher",
+    ":random",
+    ":subtle_util",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/internal:aes_util",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/internal:ssl_unique_ptr",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : random
+source_set("random") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "random.cc",
+    "random.h",
+  ]
+  public_deps = [
+    ":subtle_util",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:span",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : xchacha20_poly1305_boringssl
+source_set("xchacha20_poly1305_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "xchacha20_poly1305_boringssl.cc",
+    "xchacha20_poly1305_boringssl.h",
+  ]
+  public_deps = [
+    ":random",
+    ":subtle_util",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:span",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc/aead/internal:ssl_aead",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_siv_boringssl
+source_set("aes_siv_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aes_siv_boringssl.cc",
+    "aes_siv_boringssl.h",
+  ]
+  public_deps = [
+    ":subtle_util",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:span",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc:deterministic_aead",
+    "//third_party/tink/cc/aead/internal:aead_util",
+    "//third_party/tink/cc/internal:aes_util",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/internal:ssl_unique_ptr",
+    "//third_party/tink/cc/util:errors",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : aes_gcm_siv_boringssl
+source_set("aes_gcm_siv_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "aes_gcm_siv_boringssl.cc",
+    "aes_gcm_siv_boringssl.h",
+  ]
+  public_deps = [
+    ":random",
+    ":subtle_util",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:span",
+    "//third_party/tink/cc:aead",
+    "//third_party/tink/cc/aead/internal:ssl_aead",
+    "//third_party/tink/cc/internal:fips_utils",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : common_enums
+source_set("common_enums") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "common_enums.cc",
+    "common_enums.h",
+  ]
+  public_deps = [ "//third_party/abseil-cpp/absl/strings:strings" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : subtle_util
+source_set("subtle_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "subtle_util.cc",
+    "subtle_util.h",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : stateful_hmac_boringssl
+source_set("stateful_hmac_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "stateful_hmac_boringssl.cc",
+    "stateful_hmac_boringssl.h",
+  ]
+  public_deps = [
+    ":common_enums",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/internal:md_util",
+    "//third_party/tink/cc/internal:ssl_unique_ptr",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/subtle/mac:stateful_mac",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : stateful_cmac_boringssl
+source_set("stateful_cmac_boringssl") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "stateful_cmac_boringssl.cc",
+    "stateful_cmac_boringssl.h",
+  ]
+  public_deps = [
+    ":common_enums",
+    "//third_party/abseil-cpp/absl/memory:memory",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/boringssl:crypto",
+    "//third_party/tink/cc/internal:aes_util",
+    "//third_party/tink/cc/internal:ssl_unique_ptr",
+    "//third_party/tink/cc/internal:util",
+    "//third_party/tink/cc/subtle/mac:stateful_mac",
+    "//third_party/tink/cc/util:secret_data",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/subtle/mac/BUILD.gn b/cc/subtle/mac/BUILD.gn
new file mode 100644
index 0000000..017a480
--- /dev/null
+++ b/cc/subtle/mac/BUILD.gn
@@ -0,0 +1,19 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : stateful_mac
+source_set("stateful_mac") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "stateful_mac.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/util:status",
+    "//third_party/tink/cc/util:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/cc/util/BUILD.gn b/cc/util/BUILD.gn
new file mode 100644
index 0000000..5bedeca
--- /dev/null
+++ b/cc/util/BUILD.gn
@@ -0,0 +1,154 @@
+# Copyright 2024 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+# CC Library : constants
+source_set("constants") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "constants.cc",
+    "constants.h",
+  ]
+  public_deps = [ "//third_party/abseil-cpp/absl/base:core_headers" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : secret_data_internal
+source_set("secret_data_internal") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "secret_data_internal.h" ]
+  public_deps = [
+    "//third_party/abseil-cpp/absl/base:config",
+    "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/boringssl:crypto",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : secret_data
+source_set("secret_data") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "secret_data.h" ]
+  public_deps = [
+    ":secret_data_internal",
+    "//third_party/abseil-cpp/absl/strings:strings",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : errors
+source_set("errors") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "errors.h" ]
+  public_deps = [
+    ":status",
+    "//third_party/abseil-cpp/absl/strings:str_format",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : enums
+source_set("enums") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "enums.cc",
+    "enums.h",
+  ]
+  public_deps = [
+    ":status",
+    ":statusor",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/tink/cc/proto:common_proto",
+    "//third_party/tink/cc/proto:ecdsa_proto",
+    "//third_party/tink/cc/proto:tink_proto",
+    "//third_party/tink/cc/subtle:common_enums",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : status
+source_set("status") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "status.h" ]
+  public_deps = [ "//third_party/abseil-cpp/absl/status:status" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : statusor
+source_set("statusor") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "statusor.h" ]
+  public_deps = [
+    ":status",
+    "//third_party/abseil-cpp/absl/status:statusor",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : validation
+source_set("validation") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "validation.cc",
+    "validation.h",
+  ]
+  public_deps = [
+    ":errors",
+    ":status",
+    "//third_party/abseil-cpp/absl/status:status",
+    "//third_party/tink/cc/proto:tink_proto",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : protobuf_helper
+source_set("protobuf_helper") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [ "protobuf_helper.h" ]
+  public_deps = [ "//third_party/protobuf:protobuf_lite" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : input_stream_util
+source_set("input_stream_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "input_stream_util.cc",
+    "input_stream_util.h",
+  ]
+  public_deps = [
+    ":secret_data",
+    ":statusor",
+    "//third_party/abseil-cpp/absl/algorithm:container",
+    "//third_party/abseil-cpp/absl/strings:strings",
+    "//third_party/abseil-cpp/absl/types:span",
+    "//third_party/tink/cc:input_stream",
+  ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
+
+# CC Library : keyset_util
+source_set("keyset_util") {
+  configs += [ "//build/config:no_rtti" ]
+  configs -= [ "//build/config:no_rtti" ]
+  sources = [
+    "keyset_util.cc",
+    "keyset_util.h",
+  ]
+  public_deps = [ "//third_party/tink/cc/proto:tink_proto" ]
+  public_configs = [ "//third_party/tink:tink_config" ]
+}
diff --git a/proto/BUILD.gn b/proto/BUILD.gn
new file mode 100644
index 0000000..eb32467
--- /dev/null
+++ b/proto/BUILD.gn
@@ -0,0 +1,147 @@
+# Copyright 2023 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# WARNING: This file is automatically generated by convert_for_cobalt.
+# Do not edit manually.
+
+import("//third_party/protobuf/proto_library.gni")
+
+# Proto Library : common_proto
+proto_library("common_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "common.proto" ]
+}
+
+# Proto Library : tink_proto
+proto_library("tink_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "tink.proto" ]
+}
+
+# Proto Library : config_proto
+proto_library("config_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "config.proto" ]
+}
+
+# Proto Library : aes_siv_proto
+proto_library("aes_siv_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "aes_siv.proto" ]
+}
+
+# Proto Library : ecdsa_proto
+proto_library("ecdsa_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "ecdsa.proto" ]
+  deps = [ ":common_proto" ]
+}
+
+# Proto Library : aes_cmac_proto
+proto_library("aes_cmac_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "aes_cmac.proto" ]
+}
+
+# Proto Library : hmac_proto
+proto_library("hmac_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "hmac.proto" ]
+  deps = [ ":common_proto" ]
+}
+
+# Proto Library : aes_ctr_proto
+proto_library("aes_ctr_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "aes_ctr.proto" ]
+}
+
+# Proto Library : aes_ctr_hmac_aead_proto
+proto_library("aes_ctr_hmac_aead_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "aes_ctr_hmac_aead.proto" ]
+  deps = [
+    ":aes_ctr_proto",
+    ":hmac_proto",
+  ]
+}
+
+# Proto Library : aes_gcm_proto
+proto_library("aes_gcm_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "aes_gcm.proto" ]
+}
+
+# Proto Library : aes_gcm_siv_proto
+proto_library("aes_gcm_siv_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "aes_gcm_siv.proto" ]
+}
+
+# Proto Library : aes_eax_proto
+proto_library("aes_eax_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "aes_eax.proto" ]
+}
+
+# Proto Library : kms_aead_proto
+proto_library("kms_aead_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "kms_aead.proto" ]
+}
+
+# Proto Library : kms_envelope_proto
+proto_library("kms_envelope_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "kms_envelope.proto" ]
+  deps = [ ":tink_proto" ]
+}
+
+# Proto Library : ecies_aead_hkdf_proto
+proto_library("ecies_aead_hkdf_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "ecies_aead_hkdf.proto" ]
+  deps = [
+    ":common_proto",
+    ":tink_proto",
+  ]
+}
+
+# Proto Library : xchacha20_poly1305_proto
+proto_library("xchacha20_poly1305_proto") {
+  cc_generator_options = "lite"
+  proto_in_dir = "//third_party/tink"
+  extra_configs = [ "//third_party/tink:tink_config" ]
+  sources = [ "xchacha20_poly1305.proto" ]
+}
diff --git a/tink b/tink
new file mode 120000
index 0000000..2652f5f
--- /dev/null
+++ b/tink
@@ -0,0 +1 @@
+cc
\ No newline at end of file
diff --git a/tools/convert_for_cobalt b/tools/convert_for_cobalt
new file mode 100755
index 0000000..5d82e99
--- /dev/null
+++ b/tools/convert_for_cobalt
@@ -0,0 +1,817 @@
+#! /usr/bin/env python3
+
+# Copyright 2019 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import os.path
+import sys
+import datetime
+import collections
+
+
+class GnVariables(collections.OrderedDict):
+
+  def __setitem__(self, key, value):
+    if isinstance(value, list):
+      value = SetGnListValue(value)
+    super().__setitem__(key, value)
+    super().move_to_end(key)
+
+
+class GnListValue(object):
+
+  def __init__(self, items):
+    assert (isinstance(items, list))
+    self._items = items
+
+  def __getitem__(self, idx):
+    return self._items[idx]
+
+  def __len__(self):
+    return len(self._items)
+
+  def __iter__(self):
+    yield from self._items
+
+
+class RemoveGnListValue(GnListValue):
+  pass
+
+
+class SetGnListValue(GnListValue):
+  pass
+
+
+def IsSubdir(parent, child):
+  if parent == child:
+    return False
+  return (os.path.commonpath([parent, child]) == parent)
+
+
+class BazelGlobals(object):
+  IGNORABLES = frozenset([
+      'load',
+      'package',
+      'licenses',
+      'exports_files',
+      'select',
+  ])
+
+  def __init__(self, build_graph, dirpath):
+    self._build_graph = build_graph
+    self._dirpath = dirpath
+    self._set_objects = {}
+
+  def __getitem__(self, key):
+    if key in self._set_objects:
+      return self._set_objects[key]
+
+    if key == '__builtins__':
+      raise KeyError(key)
+
+    if key in self.IGNORABLES:
+      return lambda *args, **kwargs: None
+
+    return self._build_graph.GetTargetAdder(self._dirpath, key)
+
+  def __setitem__(self, key, value):
+    self._set_objects[key] = value
+
+  def __contains__(self, key):
+    if key == '__builtins__':
+      raise KeyError(key)
+
+    return True
+
+  def __len__(self):
+    return 1
+
+
+class BuildGraph(object):
+
+  def __init__(self, root_path, ignored_targets):
+    self._targets = {}
+    if not os.path.isabs(root_path):
+      raise Exception('{} is not an absolute path.'.format(root_path))
+    self._root_path = root_path
+    self._ignored_targets = ignored_targets
+
+    # These are specs that will be remapped.
+    self._spec_map_old_to_new = {}
+
+  def AddTarget(self, target_cls, dirpath, name, deps=None, **kwargs):
+    if deps:
+      deps = [MakeTargetRef(dep, dirpath) for dep in deps]
+      deps = [dep for dep in deps if dep.spec() not in self._ignored_targets]
+      for i in range(len(deps)):
+        if deps[i].spec() not in self._spec_map_old_to_new:
+          continue
+        deps[i] = MakeTargetRef(self._spec_map_old_to_new[deps[i].spec()],
+                                dirpath)
+
+    target = target_cls(
+        dirpath=dirpath,
+        name=name,
+        sort_id=len(self._targets),
+        deps=deps,
+        **kwargs)
+    assert (isinstance(target, Target))
+    self._targets[target.spec()] = target
+
+  def GetTargetAdder(self, absdirpath, target_type):
+    if not IsSubdir(self._root_path, absdirpath):
+      Exception(
+          'GetTargetAdder expected a path under {} which {} is not.'.format(
+              self._root_path, absdirpath))
+    dirpath = os.path.relpath(absdirpath, self._root_path)
+    if target_type == 'proto_library':
+      return self.GetProtoLibraryAdder(dirpath)
+    elif target_type == 'cc_library':
+      return self.GetCcLibraryAdder(dirpath)
+    elif target_type == 'cc_proto_library':
+      return self.GetCcProtoLibraryAdder(dirpath)
+    return self.GetUnknownTargetAdder(dirpath, target_type)
+
+  def GetUnknownTargetAdder(self, dirpath, target_type):
+
+    def Add(*args, **kwargs):
+      if 'name' not in kwargs or args:
+        raise Exception(
+            '"{}" is not a target type. Please add to IGNORABLES.'.format(
+                target_type))
+      name = kwargs['name']
+      deps = kwargs.get('deps', [])
+      self.AddTarget(
+          UnknownTarget, dirpath, name, deps=deps, target_type=target_type)
+
+    return Add
+
+  def GetCcProtoLibraryAdder(self, dirpath):
+
+    def Add(name, deps=None, **kwargs):
+      self.AddTarget(CcProtoLibTarget, dirpath, name, deps=deps)
+
+    return Add
+
+  def GetProtoLibraryAdder(self, dirpath):
+
+    def Add(name, srcs, deps=None, **kwargs):
+      self.AddTarget(ProtoLibTarget, dirpath, name, srcs=srcs, deps=deps)
+
+    return Add
+
+  def GetCcLibraryAdder(self, dirpath):
+
+    def Add(name, srcs=None, hdrs=None, deps=None, **kwargs):
+      self.AddTarget(
+          CcLibTarget, dirpath, name, hdrs=hdrs, srcs=srcs, deps=deps)
+
+    return Add
+
+  def AddToGraph(self, dirpath):
+    filepath = os.path.join(dirpath, 'BUILD.bazel')
+    fp = open(filepath, 'r')
+    content = fp.read()
+    gs = BazelGlobals(self, dirpath)
+    exec(content, {}, gs)
+
+  def GetTarget(self, target_spec):
+    target_spec = self._spec_map_old_to_new.get(target_spec, target_spec)
+    if target_spec in self._ignored_targets:
+      raise Exception('{} is being ignored'.format(target_spec))
+    ref = MakeTargetRef(target_spec, '')
+    if not ref.InTree():
+      raise Exception('{} is not in the tree.'.format(target_spec))
+    if target_spec not in self._targets:
+      dirpath, _ = ParseTargetSpec(target_spec)
+      absdirpath = os.path.join(self._root_path, dirpath)
+      self.AddToGraph(absdirpath)
+      if target_spec not in self._targets:
+        print(self._targets.keys())
+        raise Exception('{} could not be found in {}'.format(
+            target_spec, absdirpath))
+
+    return self._targets[target_spec]
+
+
+##############################################################
+# The Targets themselves.
+##############################################################
+class Target(object):
+
+  def __init__(self, dirpath, name, sort_id, deps):
+    assert (isinstance(sort_id, int))
+    self._sort_id = sort_id
+    assert (isinstance(name, str))
+    self._name = name
+    assert (isinstance(dirpath, str))
+    self._dirpath = dirpath
+    self._deps = deps or []
+    assert (all(isinstance(dep, TargetRef) for dep in self._deps))
+
+  def __repr__(self):
+    raise NotImplementedError
+
+  def name(self):
+    return self._name
+
+  def spec(self):
+    # When target is added to graph, the relative dirpath is computed by
+    # os.path.relpath(absdirpath, root_path). The function returns '.' as
+    # dirpath for the targets lives in root dir.
+    #
+    # Skip dirpath '.' to avoid returning spec like '//.:target'.
+    dirpath = self._dirpath if self._dirpath != '.' else ''
+    return '//{}:{}'.format(dirpath, self._name)
+
+  def deps(self):
+    return self._deps
+
+  def dirpath(self):
+    return self._dirpath
+
+  def sort_id(self):
+    return self._sort_id
+
+  def target_type(self):
+    raise NotImplementedError
+
+  def IsUnknown(self):
+    return False
+
+  def IsProto(self):
+    return False
+
+  def RemapDep(self, old, new):
+    for i in range(len(self._deps)):
+      if self._deps[i].spec() == old:
+        self._deps[i] = MakeTargetRef(new, self._dirpath)
+
+
+class UnknownTarget(Target):
+
+  def __init__(self, dirpath, name, sort_id, target_type, deps):
+    super().__init__(dirpath, name, sort_id, deps=deps)
+    assert (isinstance(target_type, str))
+    self._target_type = target_type
+
+  def __repr__(self):
+    return 'UnknownTarget<{}: {}>'.format(self._target_type, self.spec())
+
+  def IsUnknown(self):
+    return True
+
+
+class LibTarget(Target):
+
+  def __init__(self, dirpath, name, sort_id, deps, srcs=None):
+    super().__init__(dirpath, name, sort_id, deps)
+    self.srcs = srcs or []
+
+  def __repr__(self):
+    return 'LibTarget<{}>'.format(self.spec())
+
+
+class ProtoLibTarget(LibTarget):
+
+  def IsProto(self):
+    return True
+
+  def __repr__(self):
+    return 'ProtoLibTarget<{}>'.format(self.spec())
+
+  def target_type(self):
+    return 'Proto Library'
+
+
+class CcProtoLibTarget(Target):
+
+  def IsProto(self):
+    return True
+
+  def __repr__(self):
+    return 'CcProtoLibTarget<{}>'.format(self.spec())
+
+  def target_type(self):
+    return 'CC Proto Library'
+
+
+class CcLibTarget(LibTarget):
+
+  def __init__(self, dirpath, name, sort_id, deps, srcs=None, hdrs=None):
+    super().__init__(dirpath, name, sort_id, srcs=srcs, deps=deps)
+    self.hdrs = hdrs or []
+
+  def __repr__(self):
+    return 'CcLibTarget<{}>'.format(self.spec())
+
+  def target_type(self):
+    return 'CC Library'
+
+
+##############################################################
+# Target references. (Used mostly for dependencies)
+##############################################################
+def ParseTargetSpec(dep):
+  parts = dep.split(':')
+  dirpath = parts[0][2:]
+  if len(parts) == 1:
+    name = os.path.basename(dep)
+  elif len(parts) == 2:
+    name = parts[1]
+  else:
+    raise Exception('I do not know how to deal with this dep: "{}"'.format(dep))
+
+  return dirpath, name
+
+
+def MakeTargetRef(dep, dirpath):
+  if dep[0] == ':':
+    return InTreeTargetRef(dirpath, dep[1:])
+  if dep[:2] == '//':
+    dirpath, name = ParseTargetSpec(dep)
+    return InTreeTargetRef(dirpath, name)
+
+  tink_base_prefix = '@tink_base'
+  if dep.startswith(tink_base_prefix):
+    dep = dep[len(tink_base_prefix):]
+    dirpath, name = ParseTargetSpec(dep)
+    return TinkBaseTargetRef(dirpath, name)
+
+  absl_prefix = '@com_google_absl'
+  if dep.startswith(absl_prefix):
+    dep = dep[len(absl_prefix):]
+    dirpath, name = ParseTargetSpec(dep)
+    return AbslTargetRef(dirpath, name)
+
+  if dep == '@com_google_protobuf//:protobuf_lite':
+    return ProtobufLiteTargetRef()
+
+  if dep == '@com_google_protobuf//:protobuf':
+    return ProtobufLiteTargetRef()
+
+  if dep == '@rapidjson':
+    return RapidJsonTargetRef()
+
+  googletest_prefix = '@com_google_googletest'
+  if dep.startswith(googletest_prefix):
+    dep = dep[len(googletest_prefix):]
+    dirpath, name = ParseTargetSpec(dep)
+    return GoogleTestTargetRef(dirpath, name)
+
+  boringssl_prefix = '@boringssl'
+  if dep.startswith(boringssl_prefix):
+    dep = dep[len(boringssl_prefix):]
+    dirpath, name = ParseTargetSpec(dep)
+    return BoringSslTargetRef(dirpath, name)
+
+  return UnknownTargetRef(dirpath, dep)
+
+
+class TargetRef(object):
+
+  def InTree(self):
+    return False
+
+  def IsUnknown(self):
+    return False
+
+
+class UnknownTargetRef(TargetRef):
+  def __init__(self, dirpath, dep):
+    self._dirpath = dirpath
+    self._dep = dep
+
+  def IsUnknown(self):
+    return True
+
+  def spec(self):
+    return '<{} in {}'.format(self._dep, self._dirpath)
+
+
+class PathTargetRef(TargetRef):
+
+  def __init__(self, dirpath, name):
+    self._dirpath = dirpath
+    self._name = name
+
+  def name(self):
+    return self._name
+
+  def spec(self):
+    # When target is added to graph, the relative dirpath is computed by
+    # os.path.relpath(absdirpath, root_path). The function returns '.' as
+    # dirpath for the targets lives in root dir. The relative dirpath is
+    # also used to make TargetRefs for the target's dependencies.
+    #
+    # Skip dirpath '.' to avoid returning spec like '//.:target'.
+    dirpath = self._dirpath if self._dirpath != '.' else ''
+    return '//{}:{}'.format(dirpath, self._name)
+
+  def dirpath(self):
+    return self._dirpath
+
+  def __repr__(self):
+    return '{}<{}>'.format(type(self).__name__, self.spec())
+
+
+class TinkBaseTargetRef(PathTargetRef):
+
+  def GetGnDep(self):
+    spec = self.spec()
+    prefix = '//'
+    if not spec.startswith(prefix):
+      raise Exception(
+          'I do not know how to deal with Tink base dependency {}'.format(spec))
+    return '//third_party/tink/' + spec[len(prefix):]
+
+
+class InTreeTargetRef(PathTargetRef):
+
+  def InTree(self):
+    return True
+
+
+class AbslTargetRef(PathTargetRef):
+
+  def GetGnDep(self):
+    spec = self.spec()
+    prefix = '//'
+    if not spec.startswith(prefix):
+      raise Exception(
+          'I do not know how to deal with Absl dependency {}'.format(spec))
+    return '//third_party/abseil-cpp/' + spec[len(prefix):]
+
+
+class GoogleTestTargetRef(PathTargetRef):
+  pass
+
+
+class ProtobufLiteTargetRef(TargetRef):
+
+  def GetGnDep(self):
+    return '//third_party/protobuf:protobuf_lite'
+
+  def spec(self):
+    return '@protobuf_lite'
+
+
+class RapidJsonTargetRef(TargetRef):
+
+  def spec(self):
+    return '@rapidjson'
+
+
+class BoringSslTargetRef(PathTargetRef):
+
+  def GetGnDep(self):
+    if self._dirpath:
+      raise Exception(
+          'BoringSSL dep {} has dirpath {}. I do not know how to deal with that.'
+          .format(self.spec(), self._dirpath))
+    return '//third_party/boringssl:' + self._name
+
+
+##############################################################
+# TargetFetcher grabs all the targets we need.
+##############################################################
+class TargetFetcher(object):
+
+  def __init__(self, build_graph, initial_targets, error_on_unknown):
+    # _to_fetch is a list of target specs.
+    self._to_fetch = initial_targets
+    self._targets = []
+    self._fetched = set()
+    self._build_graph = build_graph
+    self._error_on_unknown = error_on_unknown
+
+  def FetchAll(self):
+    while self._to_fetch:
+      self.FetchNext()
+    return self._targets
+
+  def FetchNext(self):
+    spec = self._to_fetch.pop(0)
+    if spec in self._fetched:
+      return
+    target = self._build_graph.GetTarget(spec)
+    if target.IsUnknown() and self._error_on_unknown:
+      raise Exception('Found unknown target: {}'.format(target))
+    self._targets.append(target)
+
+    # We add both the actual spec and the spec we tried to fetch just in
+    # case there was a remapping.
+    self._fetched.add(target.spec())
+    self._fetched.add(spec)
+    for dep in target.deps():
+      if dep.IsUnknown():
+        raise Exception('Found unknown dep: {} for {}'.format(dep.spec(), target.spec()))
+      if not dep.InTree():
+        continue
+      if dep.spec() not in self._fetched:
+        self._to_fetch.append(dep.spec())
+
+##############################################################
+# BuildFile holds the information necessary to create a build file.
+##############################################################
+class BuildFile(object):
+
+  def __init__(self, dirpath, targets, subdirs):
+    self.dirpath = dirpath
+    # Directory mapping spec to target.
+    self.targets = targets
+    self.subdirs = sorted(subdirs)
+
+  def HasProto(self):
+    return any(t.IsProto() for t in self.targets.values())
+
+  def HasCcLib(self):
+    return any(isinstance(t, CcLibTarget) for t in self.targets.values())
+
+  def __contains__(self, target_or_spec):
+    spec = target_or_spec
+    if hasattr(target_or_spec, 'spec'):
+      spec = target_or_spec.spec()
+    if not isinstance(spec, str):
+      raise Exception(
+          '{} should be a spec string or have a spec method.'.format(
+              target_or_spec))
+
+    return spec in self.targets
+
+
+def CreateBuildFiles(targets):
+  build_file_targets = {}
+  for t in targets:
+    if t.dirpath() not in build_file_targets:
+      build_file_targets[t.dirpath()] = {}
+    build_file_targets[t.dirpath()][t.spec()] = t
+
+  dirpaths = [k for k in build_file_targets.keys()]
+  build_files = []
+
+  for dirpath, targets in build_file_targets.items():
+    subdirs = []
+    for d in dirpaths:
+      # If d is an immediate subdirectory of dirpath, add it to subdirs
+      if not IsSubdir(dirpath, d):
+        continue
+      rel = os.path.relpath(d, dirpath)
+      if os.path.basename(rel) == rel:
+        subdirs.append(rel)
+
+    build_files.append(BuildFile(dirpath, targets, subdirs))
+
+  return build_files
+
+
+class BuildFileWriter(object):
+
+  def __init__(self, rootdir, build_graph, max_line):
+    self._rootdir = rootdir
+    self._max_line = max_line
+    self._build_graph = build_graph
+
+  def GetTargetForInTreeDep(self, dep):
+    assert (isinstance(dep, InTreeTargetRef))
+    target = self._build_graph.GetTarget(dep.spec())
+
+    # We don't generate CcProtoLibTargets, so we try to dereference them to
+    # find the ProtoLibTarget that they refer to.
+    if isinstance(target, CcProtoLibTarget):
+      assert (len(target.deps()) == 1)
+      target = self._build_graph.GetTarget(target.deps()[0].spec())
+      assert (isinstance(target, ProtoLibTarget))
+
+    return target
+
+  def GetBuildFilePath(self, dirpath):
+    raise NotImplementedError
+
+  def WriteBuildFile(self, build_file):
+    self._indent = 0
+    self._filepath = self.GetBuildFilePath(build_file)
+    self._fp = open(self._filepath, 'w+')
+    self._build_file = build_file
+    self._nl = False
+
+    print('Writing to {},'.format(self._filepath))
+    self.WriteHeader()
+    # We generate a stable sort order to stabilize the .gn files.
+    targets = sorted(
+        build_file.targets.values(), key=lambda target: target.sort_id())
+
+    for target in targets:
+      self.WriteTarget(target)
+
+    assert (self._indent == 0)
+
+  def WriteHeader(self):
+    year = datetime.datetime.today().year
+    self.emitlines([
+        '# Copyright {} The Fuchsia Authors. All rights reserved.'.format(year),
+        '# Use of this source code is governed by a BSD-style license that can be',
+        '# found in the LICENSE file.',
+        '#',
+        '# WARNING: This file is automatically generated by convert_for_cobalt.',
+        '# Do not edit manually.'
+    ])
+
+  def WriteTarget(self, target):
+    self.emitnl('# {} : {}'.format(target.target_type(), target.name()))
+
+  def emit(self, s):
+    if self._nl:
+      self._fp.write('  ' * self._indent)
+      self._nl = False
+    if not isinstance(s, str):
+      raise Exception('emit expected a string, not {}'.format(s))
+    self._fp.write(s)
+
+  def emitnl(self, s):
+    self.emit(s)
+    self.nl()
+
+  def emitlines(self, lines):
+    for line in lines:
+      self.emitnl(line)
+
+  def nl(self):
+    self._fp.write('\n')
+    self._nl = True
+
+  def indent(self):
+    self._indent += 1
+
+  def deindent(self):
+    self._indent -= 1
+
+
+class GnWriter(BuildFileWriter):
+
+  def __init__(self, rootdir, deps_prefix, build_graph, max_line):
+    super().__init__(
+        rootdir=rootdir, build_graph=build_graph, max_line=max_line)
+    assert (deps_prefix.startswith('//'))
+    assert (not deps_prefix.endswith('/'))
+    self._deps_prefix = deps_prefix
+
+  def GetBuildFilePath(self, build_file):
+    return os.path.join(self._rootdir, build_file.dirpath, 'BUILD.gn')
+
+  def WriteHeader(self):
+    super().WriteHeader()
+    if self._build_file.HasProto():
+      self.nl()
+      self.emitnl('import("//third_party/protobuf/proto_library.gni")')
+    self.nl()
+
+  def WriteTarget(self, target):
+    # Skip cc_proto_lib targets.
+    if isinstance(target, CcProtoLibTarget):
+      return
+    super().WriteTarget(target)
+
+    if isinstance(target, CcLibTarget):
+      self.WriteCcLibTarget(target)
+    elif isinstance(target, ProtoLibTarget):
+      self.WriteProtoLibTarget(target)
+    else:
+      raise NotImplementedError('I do not know how to write {}'.format(
+          str(target)))
+
+    self.nl()
+
+  def GnDep(self, dep):
+    if not dep.InTree():
+      return dep.GetGnDep()
+
+    target = self.GetTargetForInTreeDep(dep)
+
+    if target in self._build_file:
+      return ':{}'.format(target.name())
+    if target.spec().startswith('//:'):
+      return '{}:{}'.format(self._deps_prefix, target.spec()[3:])
+    return '{}/{}'.format(self._deps_prefix, target.spec()[2:])
+
+  def FormatValue(self, value):
+    if isinstance(value, str):
+      return '"{}"'.format(value)
+
+    if isinstance(value, TargetRef):
+      return '"{}"'.format(self.GnDep(value))
+
+    raise Exception('I do not know how to write the {} value'.format(
+        repr(value)))
+
+  def WriteGnVariable(self, name, value):
+    if isinstance(value, SetGnListValue):
+      self.WriteGnSetListVariable(name, value)
+      return
+    if isinstance(value, RemoveGnListValue):
+      self.WriteGnRemoveListVariable(name, value)
+      return
+    self.emitnl('{} = {}'.format(name, self.FormatValue(value)))
+
+  def WriteGnListVariable(self, name, value, op):
+    if len(value) == 0:
+      return
+
+    if len(value) == 1:
+      single_line = '{} {} [ {} ]'.format(name, op, self.FormatValue(value[0]))
+      if len(single_line) <= self._max_line:
+        self.emitnl(single_line)
+        return
+
+    self.emitnl('{} {} ['.format(name, op))
+    self.indent()
+
+    for item in value:
+      self.emitnl('{},'.format(self.FormatValue(item)))
+
+    self.deindent()
+    self.emitnl(']')
+
+  def WriteGnSetListVariable(self, name, value):
+    self.WriteGnListVariable(name, value, "=")
+
+  def WriteGnRemoveListVariable(self, name, value):
+    # Add and then remove the variable in case the var wasn't already added
+    self.WriteGnListVariable(name, value, "+=")
+    self.WriteGnListVariable(name, value, "-=")
+
+  def WriteGnTarget(self, target_type, name, variables):
+    self.emitnl('{}("{}") {{'.format(target_type, name))
+    self.indent()
+    for var, value in variables.items():
+      self.WriteGnVariable(var, value)
+    self.deindent()
+    self.emitnl('}')
+    pass
+
+  def WriteProtoLibTarget(self, target):
+    variables = GnVariables()
+    variables['cc_generator_options'] = 'lite'
+    variables['proto_in_dir'] = '//third_party/tink/cc'
+    variables['extra_configs'] = ['//third_party/tink:tink_config']
+    variables['sources'] = sorted(target.srcs)
+    variables['deps'] = target.deps()
+
+    self.WriteGnTarget('proto_library', target.name(), variables)
+
+  def WriteCcLibTarget(self, target):
+    variables = GnVariables()
+    variables['configs'] = RemoveGnListValue(['//build/config:no_rtti'])
+    variables['sources'] = sorted(target.srcs + target.hdrs)
+    variables['public_deps'] = target.deps()
+    variables['public_configs'] = ['//third_party/tink:tink_config']
+
+    self.WriteGnTarget('source_set', target.name(), variables)
+
+def FetchTargets(targets, root_path, ignored_targets):
+  graph = BuildGraph(root_path, ignored_targets)
+  fetcher = TargetFetcher(graph, targets, error_on_unknown=True)
+  targets = fetcher.FetchAll()
+  print('Found {} targets.'.format(len(targets)))
+  return targets, graph
+
+def WriteTargetsToGn(targets, graph, root_path, deps_prefix):
+  build_files = CreateBuildFiles(targets)
+  gn_writer = GnWriter(
+      rootdir=root_path,
+      build_graph=graph,
+      max_line=80,
+      deps_prefix=deps_prefix)
+  for f in build_files:
+    gn_writer.WriteBuildFile(f)
+
+def main(args):
+  script_path = os.path.abspath(args[0])
+  tools_path = os.path.dirname(script_path)
+  tink_path = os.path.dirname(tools_path)
+  cc_path = os.path.join(tink_path, 'cc')
+
+  # Targets listed here will be ignored.
+  ignored_targets = frozenset([])
+
+  # Targets listed her are the start of the fetch. Put all the targets you plan
+  # on directly depending upon here.
+  targets = [
+      '//hybrid:hybrid_config',
+      '//hybrid:hpke_config',
+      '//hybrid:hybrid_decrypt_factory',
+      '//hybrid:hybrid_encrypt_factory',
+      '//hybrid:hybrid_key_templates',
+      '//:binary_keyset_reader',
+      '//:binary_keyset_writer',
+      '//:cleartext_keyset_handle',
+      '//:hybrid_decrypt',
+      '//:hybrid_encrypt',
+      '//:keyset_handle',
+  ]
+  targets, graph = FetchTargets(targets, cc_path, ignored_targets)
+  WriteTargetsToGn(targets, graph, cc_path, '//third_party/tink/cc')
+
+if __name__ == '__main__':
+  sys.exit(main(sys.argv))