Windows 지원과 1.1.0 릴리즈 준비

.github/workflows/ci.yml

@@ -2,10 +2,14 @@ name: ci
 
 on:
   push:
-    branches: ["**"]
+    branches: [main]
     tags: ["v*"]
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -47,6 +51,55 @@ jobs:
           cargo test --frozen -p kms-engine --features pqc
           cargo test --frozen --no-default-features --features non-fips
 
+  core-windows:
+    env:
+      CARGO_NET_OFFLINE: "true"
+      AWS_LC_SYS_PREBUILT_NASM: "0"
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-2025, windows-11-arm]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: git settings
+        run: |
+          git config --global core.autocrlf false
+          git config --global core.longpaths true
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - name: nasm
+        if: runner.arch == 'X64'
+        run: |
+          choco install nasm --no-progress -y
+          echo 'C:\Program Files\NASM' >> "$GITHUB_PATH"
+      - name: toolchain
+        run: |
+          cd core && rustup show active-toolchain
+          cmake --version
+      - name: lint
+        run: |
+          cd core
+          cargo fmt --all --check
+          cargo clippy --frozen -p kms-sys --all-targets -- -D warnings
+          cargo clippy --frozen -p kms-core --all-targets --features pqc -- -D warnings
+      - name: test
+        run: |
+          cd core
+          cargo test --frozen -p kms-sys
+          cargo test --frozen -p kms-sys process_dacl -- --nocapture
+          cargo test --frozen -p kms-engine
+          cargo test --frozen -p kms-engine --features pqc
+          cargo test --frozen -p kms-core --features pqc
+      - name: release build
+        run: |
+          cd core
+          cargo build --frozen --release -p kms-core --features pqc
+          out=$(target/release/kms-core.exe --version)
+          echo "$out"
+          case "$out" in *"fips=false"*) ;; *) echo "unexpected fips mode"; exit 1;; esac
+
   host:
     env:
       CARGO_NET_OFFLINE: "true"
@@ -73,6 +126,47 @@ jobs:
           go test -run='^$' -fuzz=FuzzDecodeHeader -fuzztime=20s ./internal/wire/
           go test -run='^$' -fuzz=FuzzDecodeBody -fuzztime=20s ./internal/wire/
 
+  host-windows:
+    env:
+      CARGO_NET_OFFLINE: "true"
+      AWS_LC_SYS_PREBUILT_NASM: "0"
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-2025, windows-11-arm]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: git settings
+        run: |
+          git config --global core.autocrlf false
+          git config --global core.longpaths true
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        with:
+          go-version-file: host/go.mod
+          cache: false
+      - name: nasm
+        if: runner.arch == 'X64'
+        run: |
+          choco install nasm --no-progress -y
+          echo 'C:\Program Files\NASM' >> "$GITHUB_PATH"
+      - name: toolchain
+        run: cd core && rustup show active-toolchain
+      - name: core for tests
+        run: cd core && cargo build --frozen -p kms-core --features pqc
+      - name: lint
+        run: |
+          cd host
+          test -z "$(gofmt -l .)"
+          go vet ./...
+      - name: test
+        run: |
+          cd host
+          KMS_CORE_BIN="$GITHUB_WORKSPACE/core/target/debug/kms-core.exe" go test ./...
+
   fips:
     env:
       CARGO_NET_OFFLINE: "true"
@@ -161,3 +255,62 @@ jobs:
             dist/*.tar.gz
             dist/*.cdx.json
             dist/SHA256SUMS
+
+  dist-windows:
+    needs: [core-windows, host-windows]
+    env:
+      CARGO_NET_OFFLINE: "true"
+      AWS_LC_SYS_PREBUILT_NASM: "0"
+      GOFIPS140: certified
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-2025, windows-11-arm]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: git settings
+        run: |
+          git config --global core.autocrlf false
+          git config --global core.longpaths true
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        with:
+          go-version-file: host/go.mod
+          cache: false
+      - name: nasm
+        if: runner.arch == 'X64'
+        run: |
+          choco install nasm --no-progress -y
+          echo 'C:\Program Files\NASM' >> "$GITHUB_PATH"
+      - name: toolchain
+        run: cd core && rustup show active-toolchain
+      - name: dist
+        run: |
+          version=$(sed -n 's/^version = "\(.*\)"/\1/p' core/Cargo.toml | head -1)
+          epoch=$(git log -1 --format=%ct)
+          case "$RUNNER_ARCH" in
+            X64) arch=amd64 ;;
+            ARM64) arch=arm64 ;;
+            *) echo "unknown arch $RUNNER_ARCH"; exit 1 ;;
+          esac
+          root=$(cygpath -w "$PWD")
+          (cd core && RUSTFLAGS="--remap-path-prefix=$root=/pairier" cargo build --release --frozen -p kms-core --features pqc)
+          (cd host && go build -ldflags "-s -w -X main.version=$version" -o bin/ ./cmd/...)
+          mkdir -p dist
+          python -I scripts/sbom.py --version "$version" --cargo cargo --core-flags "--features pqc" \
+            --go-binary host/bin/kmsd.exe --go-binary host/bin/kmsctl.exe --epoch "$epoch" --out dist/sbom.cdx.json
+          DIST_ARCH=$arch PYTHON=python SOURCE_DATE_EPOCH=$epoch sh scripts/dist.sh "$version" \
+            core/target/release/kms-core.exe host/bin/kmsd.exe host/bin/kmsctl.exe dist dist/sbom.cdx.json
+          rm -f dist/sbom.cdx.json
+          cat dist/SHA256SUMS
+          unzip -l dist/*.zip
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: pairier-${{ matrix.os }}
+          path: |
+            dist/*.zip
+            dist/*.cdx.json
+            dist/SHA256SUMS

Makefile

@@ -1,7 +1,3 @@
-ifeq ($(OS),Windows_NT)
-$(error native Windows builds are not supported; build inside WSL2 with Ubuntu 24.04, see USAGE.md)
-endif
-
 GO    ?= go
 CARGO ?= cargo
 
@@ -15,7 +11,28 @@ CORE_FLAGS := --no-default-features --features fips,$(CORE_FEATURES)
 else
 CORE_FLAGS := --features $(CORE_FEATURES)
 endif
-KMS_CORE_BIN  := $(abspath $(CORE_DIR)/target/debug/kms-core)
+ifeq ($(OS),Windows_NT)
+EXE    := .exe
+RACE   :=
+CGO    := 0
+PYTHON ?= python
+CORE_TEST_FEATURES := --features kms-core/pqc,kms-engine/pqc
+DIST_ARCH    ?= $(shell echo "$${PROCESSOR_ARCHITEW6432:-$$PROCESSOR_ARCHITECTURE}" | tr '[:upper:]' '[:lower:]')
+SRC_ROOT     := $(shell cygpath -w "$(abspath .)" 2>/dev/null || echo "$(abspath .)")
+KMS_CORE_BIN := $(shell cygpath -m "$(abspath $(CORE_DIR)/target/debug/kms-core.exe)" 2>/dev/null || echo "$(abspath $(CORE_DIR)/target/debug/kms-core.exe)")
+ifeq ($(FIPS),1)
+$(error the FIPS core is not available on Windows)
+endif
+else
+EXE    :=
+RACE   := -race
+CGO    := 1
+PYTHON ?= python3
+CORE_TEST_FEATURES := --all-features
+SRC_ROOT     := $(abspath .)
+KMS_CORE_BIN := $(abspath $(CORE_DIR)/target/debug/kms-core)
+endif
+export PYTHON DIST_ARCH
 
 export GOTOOLCHAIN := local
 export GOPROXY     := off
@@ -30,7 +47,7 @@ GO_LDFLAGS     := -s -w -X main.version=$(VERSION)
 SOURCE_DATE_EPOCH ?= $(shell git log -1 --format=%ct 2>/dev/null || echo 0)
 export SOURCE_DATE_EPOCH
 DIST_DIR       := dist
-CORE_RELEASE   := $(abspath $(CORE_DIR)/target/release/kms-core)
+CORE_RELEASE   := $(abspath $(CORE_DIR)/target/release/kms-core$(EXE))
 CARGO_NET      := $(CARGO) +$(RUST_TOOLCHAIN)
 CORE_MANIFEST  := --manifest-path $(CORE_DIR)/Cargo.toml
 GO_NET         := GOPROXY=https://proxy.golang.org,direct GOFLAGS=-trimpath $(GO)
@@ -42,25 +59,25 @@ all: build
 build: build-core build-host
 
 build-core:
-	cd $(CORE_DIR) && RUSTFLAGS="--remap-path-prefix=$(abspath .)=/pairier $(RUSTFLAGS)" $(CARGO) build --release --frozen -p kms-core $(CORE_FLAGS)
+	cd $(CORE_DIR) && RUSTFLAGS="--remap-path-prefix=$(SRC_ROOT)=/pairier $(RUSTFLAGS)" $(CARGO) build --release --frozen -p kms-core $(CORE_FLAGS)
 
 build-host:
 	cd $(HOST_DIR) && $(GO) build -ldflags "$(GO_LDFLAGS)" -o bin/ ./cmd/...
 
 test: test-core test-host
 
 test-core:
-	cd $(CORE_DIR) && $(CARGO) test --frozen --all-features
+	cd $(CORE_DIR) && $(CARGO) test --frozen $(CORE_TEST_FEATURES)
 
 test-host:
 	cd $(CORE_DIR) && $(CARGO) build --frozen -p kms-core --features pqc
-	cd $(HOST_DIR) && CGO_ENABLED=1 KMS_CORE_BIN=$(KMS_CORE_BIN) $(GO) test -race ./...
+	cd $(HOST_DIR) && CGO_ENABLED=$(CGO) KMS_CORE_BIN=$(KMS_CORE_BIN) $(GO) test $(RACE) ./...
 
 lint: lint-core lint-host
 
 lint-core:
 	cd $(CORE_DIR) && $(CARGO) fmt --all --check
-	cd $(CORE_DIR) && $(CARGO) clippy --frozen --all-targets --all-features -- -D warnings
+	cd $(CORE_DIR) && $(CARGO) clippy --frozen --all-targets $(CORE_TEST_FEATURES) -- -D warnings
 
 lint-host:
 	cd $(HOST_DIR) && test -z "$$(gofmt -l .)"
@@ -80,10 +97,10 @@ update:
 
 dist: build
 	mkdir -p $(DIST_DIR)
-	python3 -I scripts/sbom.py --version $(VERSION) --cargo "$(CARGO)" --core-flags "$(CORE_FLAGS)" \
-		--go-binary $(HOST_DIR)/bin/kmsd --go-binary $(HOST_DIR)/bin/kmsctl \
+	$(PYTHON) -I scripts/sbom.py --version $(VERSION) --cargo "$(CARGO)" --core-flags "$(CORE_FLAGS)" \
+		--go-binary $(HOST_DIR)/bin/kmsd$(EXE) --go-binary $(HOST_DIR)/bin/kmsctl$(EXE) \
 		--epoch $(SOURCE_DATE_EPOCH) --out $(DIST_DIR)/sbom.cdx.json
-	./scripts/dist.sh $(VERSION) $(CORE_RELEASE) $(HOST_DIR)/bin/kmsd $(HOST_DIR)/bin/kmsctl $(DIST_DIR) $(DIST_DIR)/sbom.cdx.json
+	./scripts/dist.sh $(VERSION) $(CORE_RELEASE) $(HOST_DIR)/bin/kmsd$(EXE) $(HOST_DIR)/bin/kmsctl$(EXE) $(DIST_DIR) $(DIST_DIR)/sbom.cdx.json
 	rm -f $(DIST_DIR)/sbom.cdx.json
 
 sign:

README.md

@@ -37,7 +37,7 @@ The following features are also included.
 - Algorithms: AES-256-GCM, ECDSA P-256/P-384, Ed25519, ML-DSA-65/87, ML-KEM-768/1024, and the MLKEM768-P256 hybrid KEM (draft-ietf-hpke-pq)
 - Optional PQC: enabled only when both the compile-time `pqc` feature and the runtime `--pqc` flag are set, and advertised to the host through capability bits in the `HELLO` response.
 - Key usage enforcement: the core rejects any operation outside the usage assigned at generation time (ENCRYPT, DECRYPT, SIGN, VERIFY, and so on).
-- Core hardening: on startup the core disables core dumps, denies `ptrace`, sets `no_new_privs` and `umask 077`, scrubs environment variables, closes unneeded `fd`s, verifies the peer UID, and checks the root key file's permissions, owner, and links. On Linux, `mlockall` prevents memory from being swapped.
+- Core hardening: on startup the core disables core dumps, denies `ptrace`, sets `no_new_privs` and `umask 077`, scrubs environment variables, closes unneeded `fd`s, verifies the peer UID, and checks the root key file's permissions, owner, and links. On Linux, `mlockall` prevents memory from being swapped. On Windows (experimental since 1.1.0) the core restricts its own process object with a DACL, verifies the peer's user SID and protects files with owner-only DACLs.
 - Strict protocol: fixed 16-byte header, length-prefixed fields, 1 MiB body limit, and rejection of trailing bytes. `HELLO` must come first, and any framing violation terminates the session.
 - Air-gapped build: Rust dependencies are vendored in `core/vendor` and built with `--frozen`. Go builds with `GOPROXY=off` and `-mod=vendor` and has no external dependencies.
 

README_KR.md

@@ -37,13 +37,13 @@
 - 알고리즘: AES-256-GCM, ECDSA P-256/P-384, Ed25519, ML-DSA-65/87, ML-KEM-768/1024, MLKEM768-P256 하이브리드 KEM(draft-ietf-hpke-pq)
 - 선택적 PQC: 컴파일 타임 `pqc` feature와 런타임 `--pqc` 플래그를 모두 설정해야 활성화되며, `HELLO` 응답의 capability 비트를 통해 호스트에 알립니다.
 - 키 용도 강제: 생성 시 지정한 용도(ENCRYPT, DECRYPT, SIGN, VERIFY 등) 외의 연산은 코어 측에서 거부합니다.
-- 코어 하드닝: 시작 시 코어 덤프 차단, `ptrace` 거부, `no_new_privs`, `umask 077`, 환경 변수 제거, 불필요 `fd` 정리, 피어(peer) UID 검증, 루트 키 파일 권한·소유자·링크 검증을 수행합니다. Linux에서는 `mlockall`로 메모리 스와핑(swap)을 막습니다.
+- 코어 하드닝: 시작 시 코어 덤프 차단, `ptrace` 거부, `no_new_privs`, `umask 077`, 환경 변수 제거, 불필요 `fd` 정리, 피어(peer) UID 검증, 루트 키 파일 권한·소유자·링크 검증을 수행합니다. Linux에서는 `mlockall`로 메모리 스와핑(swap)을 막습니다. Windows(1.1.0부터 experimental)에서는 코어가 자기 프로세스 객체를 DACL로 제한하고, 피어의 사용자 SID를 검증하며, 파일을 소유자 전용 DACL로 보호합니다.
 - 엄격한 프로토콜: 고정 16바이트 헤더와 길이 접두 필드, 1MiB 본문 상한, 후행 바이트를 거부합니다. `HELLO` 선행을 강제하며 프레이밍(framing) 위반 시 세션을 끊어냅니다.
 - 폐쇄 빌드: Rust 의존성은 `core/vendor`에 벤더링되고 `--frozen`으로 빌드합니다. Go는 `GOPROXY=off`, `-mod=vendor`로 빌드하며 외부 의존성이 없습니다.
 
 ## 빌드 및 실행
 
-이 내용에 관해서는 [USAGE.md](USAGE_KR.md)를 확인할 수 있습니다.
+이 내용에 관해서는 [USAGE_KR.md](USAGE_KR.md)를 확인할 수 있습니다.
 
 ## 보안