fix: statically link MSVC CRT to remove VC++ Redistributable dependency

[DennisDyallo]

Summary

Fixes #391 — Yubico.NativeShims.dll on Windows dynamically linked VCRUNTIME140.dll and 9 api-ms-win-crt-* UCRT forwarding DLLs, causing DllNotFoundException on machines without the VC++ Redistributable installed (e.g., bare Windows 11 Home on new Dell hardware).

Changes

• Sets CMAKE_MSVC_RUNTIME_LIBRARY to MultiThreaded (/MT) in the WIN32 block of CMakeLists.txt, statically linking the C runtime into the DLL. This is consistent with the existing x64-windows-static vcpkg triplet which already statically links OpenSSL.
• Bumps cmake_minimum_required from 3.13 to 3.15 — required for CMake policy CMP0091 which enables the CMAKE_MSVC_RUNTIME_LIBRARY variable. Without this, the /MT flag was silently ignored.
• Adds a CI verification step using dumpbin /imports that inspects all three Windows architecture builds (x64, x86, arm64) and fails the build if any VC++ Redistributable dependencies are detected.
• Adds inline comments and logical section grouping to CMakeLists.txt for improved readability.
• Documents the static CRT linkage in Yubico.NativeShims/readme.md.

Passing build

https://github.com/Yubico/Yubico.NET.SDK/actions/runs/23155104306/job/67267560977

Licensing review

Does static CRT linking require special licensing?

No. Static linking with /MT is not governed by the REDIST list. The REDIST list exclusively covers redistribution of separate files (DLLs, merge modules, vcredist installers). With /MT, the CRT code is embedded into the binary — no separate CRT files are distributed.

What does Microsoft's own documentation say?

Microsoft's CRT library features documentation explicitly lists the static CRT libraries as standard build options:

Library	Characteristics	Option
libucrt.lib	Statically links the UCRT into your code	/MT
libvcruntime.lib	Statically linked into your code	/MT
libcmt.lib	Statically links the native CRT startup into your code	/MT

Key observations:

• The release static libraries (libucrt.lib, libvcruntime.lib, libcmt.lib) carry no "Not redistributable" marker
• The debug variants (libucrtd.lib, libvcruntimed.lib, libcmtd.lib) are explicitly marked "Not redistributable"
• This distinction is intentional — Microsoft permits release static linking while restricting debug
• Static linking is actually the default compiler behavior: "If you link your program from the command line without a compiler option that specifies a C runtime library, the linker will use the statically linked CRT libraries"

Our build satisfies all requirements

Requirement	Status
Licensed Visual Studio user	CI builds on windows-2022 runners with VS 2022 Enterprise
Release builds only	build-windows.ps1 builds --config Release exclusively
No debug CRT redistributed	/MT in Release, /MTd only hypothetically in Debug
No separate CRT files distributed	Static linking embeds CRT — nothing to redistribute

Why full static (/MT) over hybrid linking?

Microsoft supports a hybrid approach (static vcruntime, dynamic UCRT). We chose full static because:

• The affected user's machine was missing both VCRUNTIME140.dll and UCRT forwarders
• Full static is simpler — no partial dependencies to reason about
• NativeShims is a thin P/Invoke bridge with minimal CRT surface area
• The CRT state isolation caveat doesn't apply — NativeShims manages its own memory internally and doesn't share CRT objects across DLL boundaries

Trade-offs

	Static (/MT) — this PR	Dynamic (/MD) — before
Runtime dependency	None beyond Windows system DLLs	Requires VC++ Redistributable
Binary size	~200-300KB larger	Smaller
CRT security patches	Picked up at SDK build time	Applied via OS updates
User experience	Just works	Can fail on bare machines

The security patching trade-off is minimal — NativeShims uses CRT for basic operations (malloc, memcpy), and the SDK ships regular releases that incorporate updated static CRT at build time.

Test plan

• build-nativeshims workflow passes on Windows (all 3 architectures)
• CI verification step confirms zero VCRUNTIME or api-ms-win-crt-* imports in built DLLs
• Linux and macOS builds unaffected (CMake change scoped to WIN32 block)
• Verify DLL loads on a Windows machine without VC++ Redistributable installed

🤖 Generated with Claude Code