Windows x86_64 support, rustls TLS migration, and vector-index perf

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Install system dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libssl-dev pkg-config
+          sudo apt-get install -y pkg-config
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -46,6 +46,37 @@ jobs:
       - name: Run tests
         run: cargo test --release
 
+  # Compile-only gate for Windows. The full test suite is not run here: a cold RocksDB C++
+  # build on windows-latest is slow enough to dominate CI, and the value of this job is
+  # catching portability breakage on the PR rather than at tag time in build-binaries.
+  windows-check:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      # See the note in build-binaries: point bindgen at the preinstalled libclang, but
+      # leave CC/CXX alone so RocksDB is built by cl.exe rather than clang++.
+      - name: Configure libclang
+        shell: pwsh
+        run: echo "LIBCLANG_PATH=C:\Program Files\LLVM\bin" >> $env:GITHUB_ENV
+
+      - name: Cargo cache
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry/
+            ~/.cargo/git/
+            target/
+          key: ${{ runner.os }}-cargo-check-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-check-
+
+      - name: Check
+        run: cargo check --all-targets
+
   clippy:
     runs-on: ubuntu-latest
     steps:
@@ -54,7 +85,7 @@ jobs:
       - name: Install system dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libssl-dev pkg-config
+          sudo apt-get install -y pkg-config
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -114,6 +145,9 @@ jobs:
           - target: aarch64-unknown-linux-gnu
             os: ubuntu-latest
             artifact: solidb-linux-arm64
+          - target: x86_64-pc-windows-msvc
+            os: windows-latest
+            artifact: solidb-windows-amd64
     runs-on: ${{ matrix.os }}
     permissions:
       contents: write
@@ -129,26 +163,53 @@ jobs:
         if: runner.os == 'Linux'
         run: |
           sudo apt-get update
-          sudo apt-get install -y libssl-dev pkg-config
+          sudo apt-get install -y pkg-config
 
       - name: Install system dependencies (Linux ARM64 cross)
         if: matrix.target == 'aarch64-unknown-linux-gnu'
         run: |
           sudo apt-get update
           sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
 
+      # librocksdb-sys runs bindgen, which needs libclang. LLVM, MSVC and CMake are all
+      # preinstalled on windows-latest, so this only points bindgen at libclang.dll.
+      # Do NOT export CC/CXX=clang here: the target is *-pc-windows-msvc, so cc-rs emits
+      # MSVC-style flags (-EHsc, -std:c++20) that plain clang++ rejects. RocksDB must be
+      # compiled by cl.exe.
+      - name: Configure libclang (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: echo "LIBCLANG_PATH=C:\Program Files\LLVM\bin" >> $env:GITHUB_ENV
+
       - name: Build
         run: cargo build --release --target ${{ matrix.target }}
 
       - name: Package binaries
+        if: runner.os != 'Windows'
         run: |
           tar -czf ${{ matrix.artifact }}.tar.gz -C target/${{ matrix.target }}/release solidb solidb-dump solidb-restore
 
+      - name: Package binaries (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $rel = "target/${{ matrix.target }}/release"
+          Compress-Archive -Path "$rel/solidb.exe","$rel/solidb-dump.exe","$rel/solidb-restore.exe" `
+            -DestinationPath "${{ matrix.artifact }}.zip"
+
       - name: Upload to release
+        if: runner.os != 'Windows'
         env:
           GH_TOKEN: ${{ github.token }}
         run: gh release upload --clobber ${{ github.ref_name }} ${{ matrix.artifact }}.tar.gz
 
+      - name: Upload to release (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload --clobber ${{ github.ref_name }} ${{ matrix.artifact }}.zip
+
   publish-release:
     needs: [build-binaries]
     if: startsWith(github.ref, 'refs/tags/v')
@@ -209,7 +270,7 @@ jobs:
       - name: Install system dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libssl-dev pkg-config
+          sudo apt-get install -y pkg-config
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable

CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [0.32.1](https://github.com/solisoft/solidb/compare/v0.32.0...v0.32.1) (2026-07-24)
+
+### Fixes
+
+* **`solidb-restore` now honours `--database` / `--collection`.** Both flags are documented as overrides, but the target was resolved as "name embedded in the dump, falling back to the flag". Since every dump emits `_database` and `_collection`, the fallback was unreachable and both flags were silently ignored — `solidb-restore -d staging --input prod.dump` restored into `prod`. The CLI flag now wins and the dump's name is the fallback, across document, blob-chunk and index records. **Operators who relied on the old behaviour to restore a dump back into its original database can simply omit `-d`.**
+
+## [0.32.0](https://github.com/solisoft/solidb/compare/v0.31.0...v0.32.0) (2026-07-19)
+
+### Features
+
+* **Windows x86_64 builds**: releases now include `solidb-windows-amd64.zip` (`solidb.exe`, `solidb-dump.exe`, `solidb-restore.exe`) alongside the Linux and macOS tarballs. Two caveats for operators:
+  * `--daemon` is Unix-only and exits with an error. Run SoliDB in a console, or wrap it with a service manager such as NSSM or `sc.exe`.
+  * The generated `.admin_password` file is written with default ACLs rather than the owner-only permissions used on Unix. Restrict the data directory yourself on a shared machine.
+  * FUSE (`solidb-fuse`) remains Unix-only, and `solidb update` still does not support Windows.
+
+### Changes
+
+* **TLS moves from OpenSSL to rustls.** OpenSSL is no longer in the dependency graph at all. The Docker image no longer installs `libssl3`, and building from source no longer needs `libssl-dev` (or Perl/NASM on Windows). Certificate validation now uses the platform trust store via rustls rather than OpenSSL; `ca-certificates` is still required in the container image.
+
+### Performance
+
+* Vector-index persistence is throttled to at most once per 5s behind a dirty flag, with a shutdown flush, instead of re-serializing the whole index (all vectors + HNSW graph) after every write batch. Bulk loads into embedding-bearing collections are no longer O(batches × index size).
+* Document updates that leave every vector index's embedding unchanged skip the delete+reinsert entirely, so an incremental sync that only rewrites metadata pays no HNSW churn.
+
 ## [0.26.4](https://github.com/solisoft/solidb/compare/v0.26.3...v0.26.4) (2026-06-11)
 
 ### Security

Cargo.toml

@@ -3,7 +3,7 @@ members = ["clients/rust-client", "sdbql-core", "benchmarks"]
 
 [package]
 name = "solidb"
-version = "0.31.0"
+version = "0.32.1"
 edition = "2021"
 default-run = "solidb"
 description = "A lightweight, high-performance structured database server written in Rust."
@@ -29,7 +29,7 @@ async-trait = "0.1"
 
 # WebSocket Client (for global changefeed aggregation)
 
-tokio-tungstenite = { version = "0.28", features = ["native-tls"] }
+tokio-tungstenite = { version = "0.28", features = ["rustls-tls-native-roots"] }
 url = "2.4"
 
 # JSON serialization
@@ -76,6 +76,9 @@ cron = "0.15"
 
 # Authentication
 argon2 = "0.5"
+# Keep the aws_lc_rs backend: the `rust_crypto` alternative pulls in the `rsa` crate, which
+# commit 7320477 deliberately removed (RUSTSEC-2023-0071, no fixed version). See the
+# windows-gated aws-lc-rs entry below for how this stays buildable on windows-msvc.
 jsonwebtoken = { version = "10.3", default-features = false, features = ["aws_lc_rs", "use_pem"] }
 once_cell = "1.19"
 rand_core = "0.6"
@@ -91,10 +94,18 @@ subtle = "2.6"
 tempfile = "3.10"
 
 # HTTP client (for benchmarks)
-reqwest = { version = "0.13", features = ["json", "blocking", "multipart"] }
-
-# Vendored OpenSSL for cross-compilation support
-openssl = { version = "0.10", features = ["vendored"] }
+# rustls rather than the default native-tls: it keeps the build free of OpenSSL, which
+# otherwise needs Perl + NASM on Windows. default-features = false drops http2 and charset
+# along with native-tls, so both are re-added explicitly.
+reqwest = { version = "0.13", default-features = false, features = [
+    "json",
+    "blocking",
+    "multipart",
+    "rustls",
+    "http2",
+    "charset",
+    "system-proxy",
+] }
 
 # FUSE filesystem (requires macFUSE on macOS)
 fuser = { version = "0.16", optional = true }
@@ -191,6 +202,14 @@ solidb-client = { path = "clients/rust-client" }
 [target.'cfg(not(target_env = "msvc"))'.dependencies]
 tikv-jemallocator = "0.6"
 
+# aws-lc-sys (pulled in by jsonwebtoken and by reqwest's rustls provider) assembles its
+# x86_64 asm with NASM on windows-msvc, which is not on the GitHub runner image. The
+# prebuilt-nasm feature uses the object files shipped in the crate instead, leaving CMake +
+# MSVC as the only build requirements — both preinstalled on windows-latest. Feature
+# unification applies this to every aws-lc-rs in the graph.
+[target.'cfg(windows)'.dependencies]
+aws-lc-rs = { version = "1", features = ["prebuilt-nasm"] }
+
 [features]
 fuse = ["dep:fuser"]
 

Dockerfile

@@ -14,9 +14,10 @@ LABEL org.opencontainers.image.vendor="Solisoft"
 LABEL org.opencontainers.image.licenses="MIT"
 
 # Install runtime dependencies
+# libssl3 is no longer needed: TLS is rustls, statically linked into the binary.
+# ca-certificates still is — rustls reads the system trust store.
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
-    libssl3 \
     libzstd1 \
     curl \
     && rm -rf /var/lib/apt/lists/* \