test(showcase): verify PQC transport with TLS in http and grpc - #6455
test(showcase): verify PQC transport with TLS in http and grpc#6455suzmue wants to merge 5 commits into
Conversation
Add an integration test target for gapic-showcase running with Auto-TLS and restricted key exchange groups (--tls-groups 0x11ec). This verifies that the HTTP (reqwest) and gRPC (tonic) transports in google-cloud-rust successfully perform post-quantum hybrid key exchange using X25519MLKEM768.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces Post-Quantum Cryptography (PQC) transport verification tests to ensure that the SDK's transports support and negotiate hybrid key exchange algorithms (specifically X25519MLKEM768) over TLS 1.3. Feedback on the changes highlights several improvements: failing early if the showcase server fails to start, avoiding unwrap() on path conversions, appending the process ID to the temporary CA certificate filename to prevent race conditions, and addressing the concurrency risks of calling std::env::set_var to set SSL_CERT_FILE globally.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #6455 +/- ##
=======================================
Coverage 96.10% 96.10%
=======================================
Files 289 289
Lines 77597 77597
=======================================
Hits 74578 74578
Misses 3019 3019 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Update the PQC integration test to: - Use a unique CA certificate filename including the process ID to prevent temp file collisions across test runs. - Avoid unwrap() on path to string conversions by safely propagating errors. - Fail fast and return an explicit error immediately if the server fails readiness checks.
suzmue
changed the title
1 participant
Add an integration test target for gapic-showcase running with Auto-TLS and restricted key exchange groups (--tls-groups 0x11ec). This verifies that the HTTP (reqwest) and gRPC (tonic) transports in google-cloud-rust successfully perform post-quantum hybrid key exchange using X25519MLKEM768.