chore: PQC GAPIC POC#13606
Draft
lqiu96 wants to merge 71 commits into
Draft
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces Post-Quantum Cryptography (PQC) support and verification tools, including a new integration test suite (ITPqc.java) for the GAPIC Showcase server and a standalone BigQuery tracing sample (BqPqcTest.java). Feedback on these changes highlights three critical issues: Conscrypt must be explicitly registered as a security provider in both ITPqc.java and BqPqcTest.java to prevent handshake failures and NoSuchProviderException errors, and the ManagedChannel initialization in ITPqc.java should be wrapped in a try-finally block to prevent resource leaks in case of setup failures.
Comment on lines
+81
to
+87
| @BeforeAll | ||
| static void setUp() { | ||
| caCertPath = "target/showcase-ca.pem"; | ||
| File certFile = new File(caCertPath); | ||
| assertThat(certFile.exists()).isTrue(); | ||
| assertThat(certFile.isFile()).isTrue(); | ||
| } |
Contributor
There was a problem hiding this comment.
Conscrypt must be registered as a security provider in order to negotiate the hybrid post-quantum key exchange (X25519MLKEM768). Without explicit registration, the tests will fall back to the default JDK provider (SunJSSE) and fail to negotiate the expected PQC group.
Suggested change
| @BeforeAll | |
| static void setUp() { | |
| caCertPath = "target/showcase-ca.pem"; | |
| File certFile = new File(caCertPath); | |
| assertThat(certFile.exists()).isTrue(); | |
| assertThat(certFile.isFile()).isTrue(); | |
| } | |
| @BeforeAll | |
| static void setUp() { | |
| Security.insertProviderAt(Conscrypt.newProvider(), 1); | |
| caCertPath = "target/showcase-ca.pem"; | |
| File certFile = new File(caCertPath); | |
| assertThat(certFile.exists()).isTrue(); | |
| assertThat(certFile.isFile()).isTrue(); | |
| } |
Comment on lines
+45
to
+53
| public static void main(String[] args) throws Exception { | ||
| System.out.println("[DEBUG] Java Version: " + System.getProperty("java.version")); | ||
| System.out.println("[DEBUG] Java Runtime: " + System.getProperty("java.runtime.version")); | ||
| System.out.println("[DEBUG] Java VM : " + System.getProperty("java.vm.name") + " (" + System.getProperty("java.vm.version") + ")"); | ||
| try { | ||
| System.out.println("[DEBUG] Conscrypt Version: " + Conscrypt.version()); | ||
| } catch (Throwable t) { | ||
| System.out.println("[DEBUG] Failed to get Conscrypt version: " + t.getMessage()); | ||
| } |
Contributor
There was a problem hiding this comment.
Conscrypt is not registered as a security provider in this standalone verification tool. This will cause SSLContext.getInstance("TLS", "Conscrypt") to throw a NoSuchProviderException when executed. Registering Conscrypt at the start of the main method ensures the provider is available and matches the expected output described in the README.
Suggested change
| public static void main(String[] args) throws Exception { | |
| System.out.println("[DEBUG] Java Version: " + System.getProperty("java.version")); | |
| System.out.println("[DEBUG] Java Runtime: " + System.getProperty("java.runtime.version")); | |
| System.out.println("[DEBUG] Java VM : " + System.getProperty("java.vm.name") + " (" + System.getProperty("java.vm.version") + ")"); | |
| try { | |
| System.out.println("[DEBUG] Conscrypt Version: " + Conscrypt.version()); | |
| } catch (Throwable t) { | |
| System.out.println("[DEBUG] Failed to get Conscrypt version: " + t.getMessage()); | |
| } | |
| public static void main(String[] args) throws Exception { | |
| System.out.println("[DEBUG] Java Version: " + System.getProperty("java.version")); | |
| System.out.println("[DEBUG] Java Runtime: " + System.getProperty("java.runtime.version")); | |
| System.out.println("[DEBUG] Java VM : " + System.getProperty("java.vm.name") + " (" + System.getProperty("java.vm.version") + ")"); | |
| try { | |
| System.out.println("[DEBUG] Conscrypt Version: " + Conscrypt.version()); | |
| Security.insertProviderAt(Conscrypt.newProvider(), 1); | |
| System.out.println("Registered Conscrypt provider at position 1."); | |
| } catch (Throwable t) { | |
| System.out.println("[DEBUG] Failed to register or get Conscrypt version: " + t.getMessage()); | |
| } |
lqiu96
force-pushed
the
pqc-gapic-support-plan
branch
11 times, most recently
from
July 7, 2026 21:09
c38cdac to
77226d4
Compare
lqiu96
force-pushed
the
pqc-gapic-support-plan
branch
2 times, most recently
from
July 9, 2026 21:11
4512bf7 to
38288d3
Compare
lqiu96
force-pushed
the
pqc-gapic-support-plan
branch
from
July 21, 2026 18:01
c745cdd to
83b041c
Compare
|
|
TAG=agy CONV=385b9ab5-874c-4c9a-b331-66dab51fef61
…ttpTransport integration. Upgraded Conscrypt to 2.6-alpha5 to run tests. TAG=agy CONV=385b9ab5-874c-4c9a-b331-66dab51fef61
…os and run tests TAG=agy CONV=385b9ab5-874c-4c9a-b331-66dab51fef61
TAG=agy CONV=385b9ab5-874c-4c9a-b331-66dab51fef61
…ttpJson PQC and use doNotValidateCertificate TAG=agy CONV=385b9ab5-874c-4c9a-b331-66dab51fef61
…ence, and reuse TestClientInitializer constants TAG=agy CONV=385b9ab5-874c-4c9a-b331-66dab51fef61
…lient options and programmatic properties TAG=agy CONV=385b9ab5-874c-4c9a-b331-66dab51fef61
…e and drop TLS version assertions TAG=agy CONV=385b9ab5-874c-4c9a-b331-66dab51fef61
TAG=agy CONV=385b9ab5-874c-4c9a-b331-66dab51fef61
…version declarations
…showcase server processes in workflow
…streamline Conscrypt try-fallback
…rator in try block and remove draft Javadoc
…h blocks in GAX and Core HTTP
…pt is unavailable
…annelProviderTest
…n GAX and Core HTTP
…lProviderTest and HttpTransportOptionsTest
…t exception and restore HttpTransportOptionsTest to main
…ryptPqcConfiguratorHelper
…t classical non-PQC test case
…socket configurator
…Conscrypt log level to WARNING
…scrypt PQC fallback
…rHolder and comment catch block
…tProviderHolder Javadoc
…tcp readiness polling loop
lqiu96
force-pushed
the
pqc-gapic-support-plan
branch
from
July 21, 2026 21:54
495f0e4 to
d1e85cc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[DRAFT]
Branch that showcases the basic PQC support for GAPICs using gRPC and HttpJson. Adds a repro simply to showcase BigQuery using HttpJson with PQC support.
Added README and helper scripts to help with local testing.