test(showcase): update integration tests to use Showcase Auto-TLS mode

TAG=agy
CONV=385b9ab5-874c-4c9a-b331-66dab51fef61

Author: lqiu96

build-with-local-http-client.sh

@@ -56,9 +56,39 @@ else
   popd
 fi
 
+SHOWCASE_DIR="${SHOWCASE_DIR:-${PARENT_DIR}/gapic-showcase}"
+SHOWCASE_BIN="${SHOWCASE_DIR}/gapic-showcase"
+
+if [ -f "${SHOWCASE_BIN}" ]; then
+  echo "========================================================================="
+  echo "Starting Showcase TLS server in background..."
+  echo "========================================================================="
+  
+  # Start showcase in Auto-TLS mode on port 7470
+  "${SHOWCASE_BIN}" run \
+    --port 7470 \
+    --tls \
+    --ca-cert-output-file /tmp/showcase-ca.pem > showcase-server.log 2>&1 &
+  SHOWCASE_PID=$!
+  
+  # Ensure we kill the background process on script exit
+  trap "echo 'Stopping Showcase...'; kill ${SHOWCASE_PID} 2>/dev/null || true; wait ${SHOWCASE_PID} 2>/dev/null || true; rm -f /tmp/showcase-ca.pem" EXIT
+  
+  # Wait a bit for the server to initialize and write the cert
+  sleep 2
+else
+  echo "========================================================================="
+  echo "Warning: gapic-showcase binary not found at: ${SHOWCASE_BIN}"
+  echo "Please ensure Showcase is running manually in TLS mode on port 7470,"
+  echo "and its CA certificate is written to /tmp/showcase-ca.pem."
+  echo "========================================================================="
+fi
+
 echo "========================================================================="
 echo "Building and verifying gapic-showcase with PQC in google-cloud-java..."
 echo "========================================================================="
 
-# Run the showcase tests
-mvn test -pl java-showcase/gapic-showcase -Dtest=ITPqc
+# Run the showcase tests using the secure endpoint and cert path
+mvn test -pl java-showcase/gapic-showcase -Dtest=ITPqc \
+  -Dshowcase.secure.endpoint=localhost:7470 \
+  -Dshowcase.ca.cert.path=/tmp/showcase-ca.pem

java-showcase/gapic-showcase/src/test/java/com/google/showcase/v1beta1/it/ITPqc.java

@@ -18,8 +18,6 @@
 
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth.assertWithMessage;
-import static com.google.showcase.v1beta1.it.util.TestClientInitializer.DEFAULT_GRPC_ENDPOINT;
-import static com.google.showcase.v1beta1.it.util.TestClientInitializer.DEFAULT_HTTPJSON_ENDPOINT;
 
 import com.google.api.client.http.javanet.NetHttpTransport;
 import com.google.api.gax.core.NoCredentialsProvider;
@@ -115,7 +113,11 @@ public class ITPqc {
   private static final String EXPECTED_TLS_VERSION = "TLS 1.3";
   private static final String EXPECTED_TLS_CIPHER = "TLS_AES_128_GCM_SHA256";
 
-  private static final String DEFAULT_CA_CERT_PATH = "target/showcase-ca.pem";
+  private static final String DEFAULT_CA_CERT_PATH =
+      System.getProperty("showcase.ca.cert.path", "target/showcase-ca.pem");
+
+  private static final String SECURE_ENDPOINT =
+      System.getProperty("showcase.secure.endpoint", "localhost:7470");
 
   @BeforeAll
   static void setUp() {
@@ -132,7 +134,7 @@ void testGrpcPqc() throws Exception {
     ChannelCredentials creds =
         TlsChannelCredentials.newBuilder().trustManager(new File(DEFAULT_CA_CERT_PATH)).build();
 
-    ManagedChannel channel = Grpc.newChannelBuilder(DEFAULT_GRPC_ENDPOINT, creds).build();
+    ManagedChannel channel = Grpc.newChannelBuilder(SECURE_ENDPOINT, creds).build();
     try {
       TransportChannel transportChannel = GrpcTransportChannel.create(channel);
 
@@ -195,7 +197,7 @@ void testHttpJsonPqc() throws Exception {
     InstantiatingHttpJsonChannelProvider transportChannelProvider =
         EchoSettings.defaultHttpJsonTransportProviderBuilder()
             .setHttpTransport(transport)
-            .setEndpoint(DEFAULT_HTTPJSON_ENDPOINT.replace("http://", "https://"))
+            .setEndpoint("https://" + SECURE_ENDPOINT)
             .setInterceptorProvider(() -> Collections.singletonList(interceptor))
             .build();
 
@@ -250,7 +252,7 @@ void testHttpJsonPqc_withExplicitSecurityProvider() throws Exception {
     InstantiatingHttpJsonChannelProvider transportChannelProvider =
         EchoSettings.defaultHttpJsonTransportProviderBuilder()
             .setHttpTransport(transport)
-            .setEndpoint(DEFAULT_HTTPJSON_ENDPOINT.replace("http://", "https://"))
+            .setEndpoint("https://" + SECURE_ENDPOINT)
             .setInterceptorProvider(() -> Collections.singletonList(interceptor))
             .build();
 

pqc-verification/README.md

@@ -30,24 +30,21 @@ git checkout feat-pqc-tls
 go build ./cmd/gapic-showcase
 ```
 
-### Step 2.2: Generate TLS Certificates
-Generate self-signed testing certificates using `openssl` (saved to `~/pqc-certs`):
-```shell
-mkdir -p ~/pqc-certs
-openssl req -x509 -newkey rsa:4096 -keyout ~/pqc-certs/server.key -out ~/pqc-certs/server.crt -sha256 -days 365 -nodes -subj "/CN=localhost"
-openssl x509 -outform pem -in ~/pqc-certs/server.crt -out ~/pqc-certs/ca.crt
-```
+### Step 2.2: Run the Showcase Server with Auto-TLS (Recommended)
+Start the Showcase server in Auto-TLS mode. This automatically generates a CA certificate in-memory at startup and saves it to the target directory:
 
-### Step 2.3: Run the Showcase Server
-Start the Showcase server in TLS mode using the generated certificate:
 ```shell
 # Run on secure port 7470
 ./gapic-showcase run \
-  --tls-cert ~/pqc-certs/server.crt \
-  --tls-key ~/pqc-certs/server.key \
-  --port 7470
+  --port 7470 \
+  --tls \
+  --ca-cert-output-file /tmp/showcase-ca.pem
 ```
 
+*Note: The helper script `build-with-local-http-client.sh` will automatically launch and clean up this Showcase server if it finds the `gapic-showcase` repository cloned next to the `google-cloud-java` monorepo.*
+If running manually, execute the tests using:
+`mvn test -pl java-showcase/gapic-showcase -Dtest=ITPqc -Dshowcase.ca.cert.path=/tmp/showcase-ca.pem`
+
 ---
 
 ## 3. Running Local Verification Tests