v0.1.1

Added

• Published benchmark results for 0.1.0, in docs/benchmarks/0.1.0/, covering the five platforms
  with a hosted runner. Every native in the run was a cache hit whose sha256 matches
  native/CHECKSUMS.txt, so the numbers describe the released bytes rather than a rebuild.
  Windows arm64 is measured for the first time. The export list and /GL change from ADR-0006
  shows up as 10 percent on W2, flat on Linux over the same pair of runs, which is the control
  that makes it attributable. W1 improved on Windows too, but improved further on Linux with no
  build change, so the page credits that to the runner rather than to the optimisation.
• linux-musl-arm64. Alpine on arm64 got a DllNotFoundException for a reason that had nothing
  to do with the caller's code. Built by the existing build-musl.sh on an arm64 runner, and the
  consumption test runs in an Alpine container on arm64, so the library is loaded on the platform
  it targets rather than assumed to work because it compiled. ADR-0009.
• SECURITY.md added, pointing vulnerability reports at private GitHub security advisories.

Changed

• README rewritten as a short consumer page. Its links are absolute, because the README ships in
  the package and relative links were broken on nuget.org. Benchmark detail moved to
  docs/performance.md.
• Windows natives build without /GL and /LTCG, so both Windows binaries are byte identical
  across runner images and native/CHECKSUMS.txt gates them again. With them on, MSVC produced
  different bytes on different images from identical sources and component versions, and a
  release had roughly a coin flip per Windows RID of failing its checksum step for an innocent
  reason. Costs 4 to 13 percent on CanParse and 3 to 5 percent on a hard URL. CanParse stays
  well ahead of Uri.TryCreate. The generated export list stays. ADR-0011, #45.
• native/build-windows.ps1 takes -Ipo on|off, default off. on exists so the comparison can
  be rerun. all-symbols with /GL is refused up front, since it dies in cmake -E __create_def
  on IL objects.
• win-perf-experiment.yml gains variant c, a pure /GL comparison, and a RID input so
  win-arm64 can be measured on windows-11-arm. Variant a moves exports and /GL together,
  so #18's 7 percent covers the pair rather than /GL alone.

Fixed

• scripts/collate-benchmarks.py no longer drops a platform without saying so. Its platform list
  is hand maintained, win-arm64 was added to bench.yml and not to it, and the result was a
  green run and a summary that simply had no Windows arm64 column. It now fails when a
  benchmark-<rid> artifact arrives for a RID it does not know.
• scripts/collate-benchmarks.py no longer labels a measured row as the baseline of its group.
  It read the baseline off Ratio being 1.00, which a row that lands within half a percent of
  the baseline also prints. Two real Windows x64 rows in this run did exactly that, 158.90 ns
  against 158.15 ns. Program.cs now asks BenchmarkDotNet for its Baseline column, and the
  script prefers it, falling back to Ratio only where a single row in the group claims 1.00.
• The Alpine image was pinned to an amd64 image digest rather than to the multi-architecture
  index. On an arm64 host docker either refuses that or runs it under emulation and produces an
  x86-64 .so in the linux-musl-arm64 directory. The pin is now the 3.20.0 index, which
  resolves per host and keeps both musl RIDs on one Alpine release. The amd64 image inside it is
  the one the old pin named, so linux-musl-x64 is byte for byte unchanged.
• native/build-musl.sh hands ownership of what it built back to the invoking user. The
  container runs as root, so everything it wrote into the bind mount was root owned and the
  runner user could not delete it. The reproducibility check does exactly that between its two
  builds and failed with Permission denied on every file the first build produced. apk needs
  root, so ownership is handed back on the way out rather than dropped on the way in.
• native/verify-unix.sh checks the ELF machine type against the RID instead of trusting the
  runner. A container built for one platform, or a QEMU binfmt handler doing its job quietly,
  produces a library for the wrong architecture that passes exports, hardening and checksums, and
  then fails on exactly the machines the RID exists for. ADR-0008 added the PE half of this for
  win-arm64.

Install

dotnet add package Ada.Url --version 0.1.1

Verification

• Attached: the package, its symbols, and a CycloneDX SBOM listing the native library.
• The eight native binaries are built from the pinned Ada tag in CI and their SHA-256
  checksums are matched against native/CHECKSUMS.txt before the package is pushed.
• Published with NuGet trusted publishing, so no long lived API key exists for this repository.

Full changelog