chore: add PQC conformance tests (#9299)

Author: Hectorhammett

.github/workflows/conformance-tests-gax-showcase.yaml

@@ -10,7 +10,7 @@ jobs:
     gapic-showcase:
         runs-on: ubuntu-latest
         env:
-            GAPIC_SHOWCASE_VERSION: 0.36.2
+            GAPIC_SHOWCASE_VERSION: 0.42.0
             OS: linux
             ARCH: amd64
         name: GAPIC Showcase Conformance Tests
@@ -21,18 +21,18 @@ jobs:
         - name: Setup PHP
           uses: shivammathur/setup-php@v2
           with:
-            php-version: '8.1'
-            extensions: grpc
+            php-version: '8.2'
+            extensions: grpc-1.83.0
 
         - name: Install and run GAPIC Showcase
           run: |
             curl -L https://github.com/googleapis/gapic-showcase/releases/download/v${GAPIC_SHOWCASE_VERSION}/gapic-showcase-${GAPIC_SHOWCASE_VERSION}-${OS}-${ARCH}.tar.gz | tar -zx
-            ./gapic-showcase run &
+            ./gapic-showcase run --port :7469 --tls --ca-cert-output-file Gax/tests/Conformance/showcase.pem &
+            sleep 2
 
         - name: Install dependencies
           run: |
             composer update --prefer-dist --no-interaction --no-suggest -d Gax/
 
         - name: Run PHPUnit
           run: Gax/vendor/bin/phpunit -c Gax/phpunit-conformance.xml.dist
-

Gax/.gitignore

@@ -20,3 +20,5 @@ src/Jison/Parser.js
 
 # VS Code
 .vscode
+
+*.pem

Gax/README.md

@@ -88,6 +88,7 @@ be found for Mac or Windows.
     > phpstan -c phpstan.neon.dist
     ```
 
+
 ## License
 
 BSD - See [LICENSE][] for more information.

Gax/tests/Conformance/README.md

@@ -27,15 +27,15 @@ Options:
 
 ## Running Conformance Tests
 
-1. Install and launch the matching `gapic-showcase` mock server in the background:
+1. Install and launch the matching `gapic-showcase` mock server (with Auto-TLS enabled for PQC tests):
    ```sh
    # Option 1 (curl)
-   curl -L https://github.com/googleapis/gapic-showcase/releases/download/v0.41.1/gapic-showcase-0.41.1-linux-amd64.tar.gz | tar -zx
-   ./gapic-showcase run &
+   curl -L https://github.com/googleapis/gapic-showcase/releases/download/v0.42.0/gapic-showcase-0.42.0-linux-amd64.tar.gz | tar -zx
+   ./gapic-showcase run --port :7469 --tls --ca-cert-output-file Gax/tests/Conformance/showcase.pem &
 
    # Option 2 (go install)
    go install github.com/googleapis/gapic-showcase/cmd/gapic-showcase@latest
-   gapic-showcase run &
+   gapic-showcase run --port :7469 --tls --ca-cert-output-file Gax/tests/Conformance/showcase.pem &
    ```
 
 2. Run the PHPUnit conformance test suite:

Gax/tests/Conformance/ShowcaseTest.php

@@ -23,29 +23,51 @@
 use Google\ApiCore\KnownTypes;
 use Google\ApiCore\InsecureCredentialsWrapper;
 use Google\ApiCore\InsecureRequestBuilder;
+use Google\ApiCore\RequestBuilder;
 use Google\ApiCore\Transport\GrpcTransport;
 use Google\ApiCore\Transport\TransportInterface;
 use Google\ApiCore\Transport\RestTransport;
 use Google\Auth\HttpHandler\HttpHandlerFactory;
 use Google\Protobuf\Internal\Message;
 use Google\Showcase\V1beta1\Client\EchoClient;
+use Google\Showcase\V1beta1\EchoRequest;
 use Google\Showcase\V1beta1\FailEchoWithDetailsRequest;
 use Grpc\ChannelCredentials;
+use GuzzleHttp\Client;
 
 final class ShowcaseTest extends TestCase
 {
+    private const TLS_GROUP = 'x-showcase-tls-group';
+    private const PEM_PATH = __DIR__ . '/showcase.pem';
+
     public function provideTransport()
     {
+        $host = 'localhost:7469';
+        $restConfigPath = __DIR__ . '/src/V1beta1/resources/echo_rest_client_config.php';
+
+        if (file_exists(self::PEM_PATH)) {
+            $pemContents = file_get_contents(self::PEM_PATH);
+            $grpcCredentials = ChannelCredentials::createSsl($pemContents);
+            $requestBuilder = new RequestBuilder($host, $restConfigPath);
+            $guzzleClient = new Client(['verify' => self::PEM_PATH]);
+        } else {
+            $grpcCredentials = ChannelCredentials::createInsecure();
+            $requestBuilder = new InsecureRequestBuilder($host, $restConfigPath);
+            $guzzleClient = null;
+        }
+
         // build gRPC transport
         $grpc = GrpcTransport::build(
-            'localhost:7469',
-            ['stubOpts' => ['credentials' => ChannelCredentials::createInsecure()]]
+            $host,
+            [
+                'stubOpts' => [
+                    'credentials' => $grpcCredentials
+                ]
+            ]
         );
 
         // build REST transport
-        $restConfigPath = __DIR__ . '/src/V1beta1/resources/echo_rest_client_config.php';
-        $requestBuilder = new InsecureRequestBuilder('localhost:7469', $restConfigPath);
-        $httpHandler = HttpHandlerFactory::build();
+        $httpHandler = HttpHandlerFactory::build($guzzleClient);
         $rest = new RestTransport($requestBuilder, [$httpHandler, 'async']);
 
         return [[$grpc], [$rest]];
@@ -71,4 +93,48 @@ public function testFailWithDetails(TransportInterface $transport): void
             $this->assertInstanceOf(Message::class, $detail);
         }
     }
+
+    /** @dataProvider provideTransport */
+    public function testPqc(TransportInterface $transport): void
+    {
+        if (!file_exists(self::PEM_PATH)) {
+            $this->markTestSkipped(
+                'You need to run the showcase server with --tls ' .
+                    '--ca-cert-output-file tests/Conformance/showcase.pem to run PQC tests'
+            );
+        }
+
+        $expected = 'This is a test';
+        $expectedGroup = 'X25519MLKEM768';
+        $responseHeaders = null;
+        $metadataCallback = function (array $metadata) use (&$responseHeaders) {
+            $responseHeaders = $metadata;
+        };
+
+        $echoClient = new EchoClient([
+            'credentials' => new InsecureCredentialsWrapper(),
+            'transport' => $transport
+        ]);
+
+        $echoRequest = new EchoRequest();
+        $echoRequest->setContent($expected);
+        $response = $echoClient->echo($echoRequest, [
+            'metadataCallback' => $metadataCallback
+        ]);
+
+        $this->assertEquals($expected, $response->getContent());
+        $this->assertNotNull($responseHeaders);
+
+        /** @var array<string, array<int, string>> $responseHeaders */
+        $responseHeaders = array_change_key_case($responseHeaders, CASE_LOWER);
+        $negotiatedGroup = $responseHeaders[self::TLS_GROUP][0];
+
+        if ($transport instanceof GrpcTransport) {
+            // gRPC must ALWAYS negotiate PQC
+            $this->assertEquals($expectedGroup, $negotiatedGroup);
+        } else {
+            // REST uses host system OpenSSL (X25519MLKEM768 when PQC is available, or X25519 fallback)
+            $this->assertContains($negotiatedGroup, [$expectedGroup, 'X25519']);
+        }
+    }
 }