docs: Add a Http/Json Post-Quantum Cryptography Guide - #13963
Conversation
… steps and locally scoped security providers
…k flow, and format JDK 27 as addendum
…and custom provider builder examples
…JDK 27 addendum scope
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a comprehensive Post-Quantum Cryptography (PQC) User Guide for HTTP/JSON Java Client Libraries. The guide details the quantum threat, library support, Conscrypt integration, platform compatibility, and custom configurations. The review feedback correctly identifies that NetHttpTransport.Builder lacks a setSecurityProvider method in the custom configuration example and provides a valid code suggestion to configure an SSLContext with the custom provider instead.
| // Step 2: Configure NetHttpTransport with custom security provider and SSLSocketConfigurator | ||
| NetHttpTransport customTransport = | ||
| new NetHttpTransport.Builder() | ||
| .setSecurityProvider(customProvider) | ||
| .setSslSocketConfigurator( | ||
| socket -> { | ||
| // Configure custom SSLSocket options (e.g., cipher suites, protocols, or named groups) | ||
| }) |
There was a problem hiding this comment.
NetHttpTransport.Builder does not have a setSecurityProvider method. To use a custom security provider, you should configure an SSLContext with the custom provider and set the SSLSocketFactory on the builder.
| // Step 2: Configure NetHttpTransport with custom security provider and SSLSocketConfigurator | |
| NetHttpTransport customTransport = | |
| new NetHttpTransport.Builder() | |
| .setSecurityProvider(customProvider) | |
| .setSslSocketConfigurator( | |
| socket -> { | |
| // Configure custom SSLSocket options (e.g., cipher suites, protocols, or named groups) | |
| }) | |
| javax.net.ssl.SSLContext sslContext; | |
| try { | |
| sslContext = javax.net.ssl.SSLContext.getInstance("TLS", customProvider); | |
| sslContext.init(null, null, null); | |
| } catch (Exception e) { | |
| throw new RuntimeException("Failed to initialize SSLContext with custom provider", e); | |
| } | |
| NetHttpTransport customTransport = | |
| new NetHttpTransport.Builder() | |
| .setSslSocketFactory(sslContext.getSocketFactory()) | |
| .setSslSocketConfigurator( | |
| socket -> { | |
| // Configure custom SSLSocket options (e.g., cipher suites, protocols, or named groups) | |
| }) | |
| .build(); |
|
|
||
| If your environment cannot load native Conscrypt libraries or cannot configure PQC groups, the library emits a concise, one-line warning at `Level.WARNING` and safely falls back to standard JDK TLS: | ||
| ``` | ||
| WARNING: Conscrypt native libraries not available. Falling back to JDK TLS. |
There was a problem hiding this comment.
What actions can customers take to remove this warning?
There was a problem hiding this comment.
From online, some ways to remove/ resolve (some examples from a non-exhaustive list):
- add a C compat
RUN apk add --no-cache gcompat libc6-compat - swap from alphin to another distro with glibc compat
- Set java.io.tmpdir to an executable directory
- Set the Conscrypt-specific temporary directory (org.conscrypt.tmpdir)
depends on the environment and if they can run this. some of these may be not possible for each user
There was a problem hiding this comment.
Thanks! Is this documented somewhere from Conscrypt?
There was a problem hiding this comment.
Not from Conscrypt documentation. It's what I've found from searching what others have done resolve common issues from musl/ Alpine and non-exec dirs from docker/ kube restrictions
… callout on user responsibility
2 participants
No description provided.