feat(core): add hybrid NIST EC + ML-KEM key wrapping support

.github/scripts/init-temp-keys.sh

@@ -50,6 +50,9 @@ openssl rsa -in "$opt_output/kas-private.pem" -pubout -out "$opt_output/kas-cert
 openssl ecparam -name prime256v1 >ecparams.tmp
 openssl req -x509 -nodes -newkey ec:ecparams.tmp -subj "/CN=kas" -keyout "$opt_output/kas-ec-private.pem" -out "$opt_output/kas-ec-cert.pem" -days 365
 
+# Generate hybrid post-quantum key pairs (X-Wing, P256+ML-KEM-768, P384+ML-KEM-1024)
+go run ./service/cmd/keygen -output "$opt_output"
+
 mkdir -p keys
 openssl req -x509 -nodes -newkey RSA:2048 -subj "/CN=ca" -keyout keys/keycloak-ca-private.pem -out keys/keycloak-ca.pem -days 365
 printf "subjectAltName=DNS:localhost,IP:127.0.0.1" >keys/sanX509.conf

.github/scripts/watch.sh

@@ -53,18 +53,54 @@ done
 file_to_watch="$1"
 shift
 
+file_signature() {
+    if [[ ! -e "$1" ]]; then
+        echo "missing"
+        return
+    fi
+
+    if stat -c '%i:%s:%Y' "$1" >/dev/null 2>&1; then
+        stat -c '%i:%s:%Y' "$1"
+        return
+    fi
+
+    stat -f '%i:%z:%m' "$1"
+}
+
 wait_for_change_to() {
-    if which inotifywait; then
-        echo "[INFO] inotifywaiting to [${file_to_watch}]"
-        inotifywait -e modify -e move -e create -e delete -e attrib -r "${file_to_watch}"
+    if command -v inotifywait >/dev/null 2>&1; then
+        local watch_dir
+        local watch_name
+        local changed_file
+
+        watch_dir=$(dirname "${file_to_watch}")
+        watch_name=$(basename "${file_to_watch}")
+
+        echo "[INFO] inotifywaiting to [${file_to_watch}] via [${watch_dir}]"
+        while true; do
+            changed_file=$(inotifywait -q \
+                -e close_write \
+                -e moved_to \
+                -e delete \
+                -e attrib \
+                --format '%f' \
+                "${watch_dir}")
+
+            if [[ "${changed_file}" == "${watch_name}" ]]; then
+                return
+            fi
+        done
     else
-        m=$(date -r "${file_to_watch}" +%s)
+        local m
+        local n
+
+        m=$(file_signature "${file_to_watch}")
         echo "[INFO] stat checking [${file_to_watch}] from [${m}]"
         while true; do
             sleep 1
-            n=$(date -r "${file_to_watch}" +%s)
-            echo "[INFO] stat checking [${file_to_watch}] from [${m} < ${n}]"
-            if [[ $m < $n ]]; then
+            n=$(file_signature "${file_to_watch}")
+            echo "[INFO] stat checking [${file_to_watch}] from [${m} != ${n}]"
+            if [[ "${m}" != "${n}" ]]; then
                 return
             fi
         done

.github/workflows/checks.yaml

@@ -598,7 +598,7 @@ jobs:
       - uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
         with:
           github_token: ${{ github.token }}
-          version: "1.68.2"
+          version: "1.68.3"
       - uses: bufbuild/buf-lint-action@06f9dd823d873146471cfaaf108a993fe00e5325 # v1.1.1
         with:
           input: service

.gitignore

@@ -31,6 +31,7 @@ opentdf.yaml
 tmp-gen/
 /examples/examples
 /**/kas-*.pem
+!/service/pkg/server/testdata/kas-*.pem
 /opentdf
 /sdkjava/target
 /serviceapp

Makefile

@@ -3,8 +3,8 @@
 
 .PHONY: all buf-check build clean connect-wrapper-generate docker-build fix fmt go-lint license lint otdfctl/otdfctl policy-sql-gen proto-generate proto-helper-generate proto-lint sdk/sdk sqlc-check test tidy toolcheck
 
-MODS=protocol/go lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service examples otdfctl
-HAND_MODS=lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service examples otdfctl
+MODS=protocol/go lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service examples otdfctl tests-bdd
+HAND_MODS=lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service examples otdfctl tests-bdd
 REQUIRED_BUF_VERSION=1.68.2
 REQUIRED_SQLC_VERSION=1.31.0