chore: PQC GAPIC POC

.github/workflows/showcase.yaml

@@ -40,6 +40,18 @@ jobs:
           java-version: 11
           distribution: temurin
           cache: maven
+      - name: Checkout google-http-java-client (pqc-support-conscrypt branch)
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          repository: googleapis/google-http-java-client
+          ref: pqc-support-conscrypt
+          path: google-http-java-client
+          persist-credentials: false
+      - name: Build and install local google-http-java-client snapshot
+        working-directory: google-http-java-client
+        run: |
+          mvn install -DskipTests -Dmaven.javadoc.skip=true -Dclirr.skip=true -B -ntp
+          cd .. && rm -rf google-http-java-client
       - name: Install all modules using Java 11
         shell: bash
         run: .kokoro/build.sh
@@ -62,6 +74,8 @@ jobs:
                 cd /usr/src/showcase/
                 tar -xf showcase-*
                 ./gapic-showcase run &
+                ./gapic-showcase run --port 7470 --tls --ca-cert-output-file /tmp/showcase-ca.pem &
+                sleep 2
                 cd -
       - name: Showcase integration tests
         working-directory: java-showcase
@@ -118,6 +132,18 @@ jobs:
           java-version: ${{ matrix.java }}
           distribution: temurin
       - run: mvn -version
+      - name: Checkout google-http-java-client (pqc-support-conscrypt branch)
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          repository: googleapis/google-http-java-client
+          ref: pqc-support-conscrypt
+          path: google-http-java-client
+          persist-credentials: false
+      - name: Build and install local google-http-java-client snapshot
+        working-directory: google-http-java-client
+        run: |
+          mvn install -DskipTests -Dmaven.javadoc.skip=true -Dclirr.skip=true -B -ntp
+          cd .. && rm -rf google-http-java-client
       - name: Install Maven modules
         shell: bash
         run: .kokoro/build.sh
@@ -167,6 +193,8 @@ jobs:
           cd /usr/src/showcase/
           tar -xf showcase-*
           ./gapic-showcase run &
+          ./gapic-showcase run --port 7470 --tls --ca-cert-output-file /tmp/showcase-ca.pem &
+          sleep 2
           cd -
       - name: Showcase integration tests
         working-directory: java-showcase
@@ -225,6 +253,18 @@ jobs:
           java-version: 17
           distribution: temurin
           cache: maven
+      - name: Checkout google-http-java-client (pqc-support-conscrypt branch)
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          repository: googleapis/google-http-java-client
+          ref: pqc-support-conscrypt
+          path: google-http-java-client
+          persist-credentials: false
+      - name: Build and install local google-http-java-client snapshot
+        working-directory: google-http-java-client
+        run: |
+          mvn install -DskipTests -Dmaven.javadoc.skip=true -Dclirr.skip=true -B -ntp
+          cd .. && rm -rf google-http-java-client
       - name: Install Maven modules
         shell: bash
         run: .kokoro/build.sh

.kokoro/build.sh

@@ -33,6 +33,8 @@ if [ -f "${KOKORO_GFILE_DIR}/secret_manager/java-bigqueryconnection-samples-secr
   source "${KOKORO_GFILE_DIR}/secret_manager/java-bigqueryconnection-samples-secrets"
 fi
 
+install_http_client_snapshot
+
 RETURN_CODE=0
 
 case ${JOB_TYPE} in

.kokoro/client-library-check-doclet.sh

@@ -75,6 +75,8 @@ scriptDir=$(realpath $(dirname "${BASH_SOURCE[0]}"))
 ## cd to the parent directory, i.e. the root of the git repo
 cd ${scriptDir}/..
 
+install_http_client_snapshot
+
 # Make artifacts available for 'mvn validate' at the bottom
 pushd java-shared-config
 mvn install -DskipTests=true -Dmaven.javadoc.skip=true -Dgcloud.download.skip=true -B -V -q --no-transfer-progress

.kokoro/client-library-check.sh

@@ -86,6 +86,8 @@ scriptDir=$(realpath $(dirname "${BASH_SOURCE[0]}"))
 ## cd to the parent directory, i.e. the root of the git repo
 cd ${scriptDir}/..
 
+install_http_client_snapshot
+
 # Make artifacts available for 'mvn validate' at the bottom
 pushd java-shared-config
 mvn install -DskipTests=true -Dmaven.javadoc.skip=true -Dgcloud.download.skip=true -B -V -q

.kokoro/common.sh

@@ -46,6 +46,20 @@ excluded_modules=(
   'java-iam'
 )
 
+function install_http_client_snapshot {
+  if [ -d "${HOME}/.m2/repository/com/google/http-client/google-http-client-bom/2.1.2-SNAPSHOT" ]; then
+    echo "google-http-client 2.1.2-SNAPSHOT already exists in local cache."
+    return 0
+  fi
+  echo "Installing local snapshot of google-http-java-client (pqc-support-conscrypt branch)..."
+  HTTP_CLIENT_TMP_DIR=$(mktemp -d)
+  git clone --depth 1 --branch pqc-support-conscrypt https://github.com/googleapis/google-http-java-client.git "${HTTP_CLIENT_TMP_DIR}"
+  pushd "${HTTP_CLIENT_TMP_DIR}"
+    mvn install -DskipTests -Dmaven.javadoc.skip=true -Dclirr.skip=true -B -ntp
+  popd
+  rm -rf "${HTTP_CLIENT_TMP_DIR}"
+}
+
 function retry_with_backoff {
   attempts_left=$1
   sleep_seconds=$2

.kokoro/dependencies.sh

@@ -48,6 +48,8 @@ function determineMavenOpts() {
 
 export MAVEN_OPTS=$(determineMavenOpts)
 
+install_http_client_snapshot
+
 if [[ -n "${BUILD_SUBDIR}" ]]
 then
   echo "Compiling and building all modules for ${BUILD_SUBDIR}"

.kokoro/presubmit/downstream-build.sh

@@ -31,6 +31,9 @@ scriptDir=$(realpath "$(dirname "${BASH_SOURCE[0]}")")
 ## cd to the parent directory, i.e. the root of the git repo
 cd "${scriptDir}/../.."
 
+source "${scriptDir}/../common.sh"
+install_http_client_snapshot
+
 # Build and install the entire monorepo to local cache (including the under-test java-shared-config)
 mvn -B -ntp install -Dcheckstyle.skip -Dfmt.skip -DskipTests
 

build-with-local-http-client.sh

@@ -0,0 +1,94 @@
+#!/bin/bash
+#
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+set -e
+
+# Find the directory of this script (root of google-cloud-java)
+MONOREPO_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+PARENT_DIR="$(cd "${MONOREPO_DIR}/.." && pwd)"
+
+# Path to the google-http-java-client repository
+HTTP_CLIENT_DIR="${HTTP_CLIENT_DIR:-${PARENT_DIR}/google-http-java-client}"
+HTTP_CLIENT_BRANCH="${HTTP_CLIENT_BRANCH:-pqc-support-conscrypt}"
+
+
+HTTP_CLIENT_VERSION="${HTTP_CLIENT_VERSION:-2.1.2-SNAPSHOT}"
+
+echo "========================================================================="
+echo "Building and installing google-http-java-client snapshot..."
+echo "Using path: ${HTTP_CLIENT_DIR}"
+echo "========================================================================="
+
+if [ ! -d "${HTTP_CLIENT_DIR}" ]; then
+  echo "Error: google-http-java-client directory not found at: ${HTTP_CLIENT_DIR}"
+  echo "You can specify its location by setting the HTTP_CLIENT_DIR environment variable."
+  exit 1
+fi
+
+# Check if the snapshot jar is already built in the local maven repository
+M2_JAR_PATH="${HOME}/.m2/repository/com/google/http-client/google-http-client/${HTTP_CLIENT_VERSION}/google-http-client-${HTTP_CLIENT_VERSION}.jar"
+
+if [ -f "${M2_JAR_PATH}" ] && [ "${FORCE_REBUILD}" != "true" ]; then
+  echo "Found existing google-http-client snapshot at ${M2_JAR_PATH}."
+  echo "Skipping build. (To force rebuild, run with FORCE_REBUILD=true)"
+else
+  # Store current directory and build http client
+  pushd "${HTTP_CLIENT_DIR}"
+    echo "Switching to branch ${HTTP_CLIENT_BRANCH} in google-http-java-client..."
+    git checkout "${HTTP_CLIENT_BRANCH}"
+
+    echo "Running maven install..."
+    mvn clean install -pl google-http-client -am -Dmaven.test.skip=true -Dmaven.javadoc.skip=true -Dclirr.skip=true
+  popd
+fi
+
+SHOWCASE_DIR="${SHOWCASE_DIR:-${PARENT_DIR}/gapic-showcase}"
+SHOWCASE_BIN="${SHOWCASE_DIR}/gapic-showcase"
+
+if [ -f "${SHOWCASE_BIN}" ]; then
+  echo "========================================================================="
+  echo "Starting Showcase TLS server in background..."
+  echo "========================================================================="
+
+  # Start showcase in Auto-TLS mode on port 7470
+  "${SHOWCASE_BIN}" run \
+    --port 7470 \
+    --tls \
+    --ca-cert-output-file /tmp/showcase-ca.pem > showcase-server.log 2>&1 &
+  SHOWCASE_PID=$!
+
+  # Ensure we kill the background process on script exit
+  trap "echo 'Stopping Showcase...'; kill ${SHOWCASE_PID} 2>/dev/null || true; wait ${SHOWCASE_PID} 2>/dev/null || true; rm -f /tmp/showcase-ca.pem" EXIT
+
+  # Wait a bit for the server to initialize and write the cert
+  sleep 2
+else
+  echo "========================================================================="
+  echo "Warning: gapic-showcase binary not found at: ${SHOWCASE_BIN}"
+  echo "Please ensure Showcase is running manually in TLS mode on port 7470,"
+  echo "and its CA certificate is written to /tmp/showcase-ca.pem."
+  echo "========================================================================="
+fi
+
+echo "========================================================================="
+echo "Building and verifying gapic-showcase with PQC in google-cloud-java..."
+echo "========================================================================="
+
+# Run the showcase tests using the secure endpoint and cert path
+mvn test -pl java-showcase/gapic-showcase -Dtest=ITPqc \
+  -Dshowcase.secure.endpoint=localhost:7470 \
+  -Dshowcase.ca.cert.path=/tmp/showcase-ca.pem

google-auth-library-java/pom.xml

@@ -481,4 +481,40 @@
       </properties>
     </profile>
   </profiles>
+
+  <repositories>
+    <repository>
+      <id>sonatype-central-snapshots</id>
+      <name>Sonatype Central Snapshots</name>
+      <url>https://central.sonatype.com/repository/maven-snapshots/</url>
+      <releases>
+        <enabled>false</enabled>
+      </releases>
+      <snapshots>
+        <enabled>true</enabled>
+      </snapshots>
+    </repository>
+    <repository>
+      <id>sonatype-snapshots</id>
+      <name>Sonatype Snapshots</name>
+      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
+      <releases>
+        <enabled>false</enabled>
+      </releases>
+      <snapshots>
+        <enabled>true</enabled>
+      </snapshots>
+    </repository>
+    <repository>
+      <id>sonatype-s01-snapshots</id>
+      <name>Sonatype S01 Snapshots</name>
+      <url>https://s01.oss.sonatype.org/content/repositories/snapshots</url>
+      <releases>
+        <enabled>false</enabled>
+      </releases>
+      <snapshots>
+        <enabled>true</enabled>
+      </snapshots>
+    </repository>
+  </repositories>
 </project>

google-cloud-pom-parent/pom.xml

@@ -137,6 +137,39 @@
       <name>Maven Central</name>
       <url>https://repo1.maven.org/maven2</url>
     </repository>
+    <repository>
+      <id>sonatype-central-snapshots</id>
+      <name>Sonatype Central Snapshots</name>
+      <url>https://central.sonatype.com/repository/maven-snapshots/</url>
+      <releases>
+        <enabled>false</enabled>
+      </releases>
+      <snapshots>
+        <enabled>true</enabled>
+      </snapshots>
+    </repository>
+    <repository>
+      <id>sonatype-snapshots</id>
+      <name>Sonatype Snapshots</name>
+      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
+      <releases>
+        <enabled>false</enabled>
+      </releases>
+      <snapshots>
+        <enabled>true</enabled>
+      </snapshots>
+    </repository>
+    <repository>
+      <id>sonatype-s01-snapshots</id>
+      <name>Sonatype S01 Snapshots</name>
+      <url>https://s01.oss.sonatype.org/content/repositories/snapshots</url>
+      <releases>
+        <enabled>false</enabled>
+      </releases>
+      <snapshots>
+        <enabled>true</enabled>
+      </snapshots>
+    </repository>
   </repositories>
 </project>
 

java-showcase/gapic-showcase/pom.xml

@@ -78,6 +78,42 @@
     </plugins>
   </build>
 
+  <repositories>
+    <repository>
+      <id>sonatype-central-snapshots</id>
+      <name>Sonatype Central Snapshots</name>
+      <url>https://central.sonatype.com/repository/maven-snapshots/</url>
+      <releases>
+        <enabled>false</enabled>
+      </releases>
+      <snapshots>
+        <enabled>true</enabled>
+      </snapshots>
+    </repository>
+    <repository>
+      <id>sonatype-snapshots</id>
+      <name>Sonatype Snapshots</name>
+      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
+      <releases>
+        <enabled>false</enabled>
+      </releases>
+      <snapshots>
+        <enabled>true</enabled>
+      </snapshots>
+    </repository>
+    <repository>
+      <id>sonatype-s01-snapshots</id>
+      <name>Sonatype S01 Snapshots</name>
+      <url>https://s01.oss.sonatype.org/content/repositories/snapshots</url>
+      <releases>
+        <enabled>false</enabled>
+      </releases>
+      <snapshots>
+        <enabled>true</enabled>
+      </snapshots>
+    </repository>
+  </repositories>
+
   <dependencies>
     <dependency>
       <groupId>io.grpc</groupId>
@@ -136,6 +172,12 @@
     </dependency>
 
     <!-- Test dependencies -->
+    <dependency>
+      <groupId>org.conscrypt</groupId>
+      <artifactId>conscrypt-openjdk-uber</artifactId>
+      <version>2.6.0</version>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>org.junit.jupiter</groupId>
       <artifactId>junit-jupiter-engine</artifactId>