[panavenue]

Summary

• Document default Post-Quantum Cryptography (PQC) hybrid TLS 1.3 key exchange (X25519MLKEM768, IANA 0x11ec) support in README.md and CLI --help (cmd/root.go / docs/cmd/cloud-sql-proxy.md), including:
  • Supported versions: Cloud SQL Auth Proxy v2 (v2.15.2+) and v1 (v1.37.6+ / v1.38.4+), Go 1.24+ source builds, and gcloud sql connect binary resolution.
  • Automatic TLS 1.3 fallback to classical X25519 when connecting to servers that do not yet advertise hybrid PQC.
  • Runtime opt-out via GODEBUG=tlsmlkem=0 (for example, when troubleshooting middleboxes or firewalls that drop or reset larger ClientHello messages).
• Add end-to-end TLS 1.3 handshake and payload verification tests (internal/proxy/pqc_test.go) covering:
  • Default hybrid X25519MLKEM768 (0x11ec) negotiation and PQC-only server connections.
  • Classical X25519 and P-256 (HelloRetryRequest) fallback against classical-only TLS 1.3 servers.
  • GODEBUG=tlsmlkem=0 client-side opt-out (against both hybrid-capable and PQC-only servers) and explicit GODEBUG=tlsmlkem=1.

Testing

• go test -v -race -count=1 ./internal/proxy -run TestProxyPQCKeyExchange
• go vet ./... and ./build.sh lint