Skip to content

perf: Optimize SBOM validation by removing itertools.chain - #1033

Open
saquibsaifee wants to merge 1 commit into
CycloneDX:mainfrom
saquibsaifee:perf-optimize-bom-validate-17515006840806688594
Open

perf: Optimize SBOM validation by removing itertools.chain#1033
saquibsaifee wants to merge 1 commit into
CycloneDX:mainfrom
saquibsaifee:perf-optimize-bom-validate-17515006840806688594

Conversation

@saquibsaifee

Copy link
Copy Markdown
Contributor

Description

This pull request optimizes the Bom.validate performance by replacing itertools.chain and other complex generator expressions with list/set collections and iterations.

During the generation of large SBOMs, validation times were high due to generator evaluation.
With this change, the Bom.validate() running time on an SBOM with 2500 nested components and 2500 services executed 10 times drops from ~49.4 seconds down to ~5.1 seconds. This yields a ~10x execution speedup in terms of validation execution alone.

Changes:

  • Added dependency caching to avoid evaluating components and dependencies that have already been validated.
  • Removed unused generator usages mapped via map and itertools.chain for gathering dependency references and testing root component dependency trees.
  • Flatted logic to iterate over all elements with list additions list.extend rather than dynamically generating generators at runtime.

AI Tool Disclosure

  • My contribution does not include any AI-generated content
  • My contribution includes AI-generated content, as disclosed below:
    • AI Tools: Gemini Jules
    • LLMs and versions: Gemini 3.1 Pro

Affirmation

@saquibsaifee
saquibsaifee requested a review from a team as a code owner August 31, 2026 15:22
@saquibsaifee

Copy link
Copy Markdown
Contributor Author

During the generation of large SBOMs, validation times were high due to generator evaluation.
With this change, the Bom.validate() running time on an SBOM with 2500 nested components and 2500 services executed 10 times drops from ~49.4 seconds down to ~5.1 seconds. This yields a ~10x execution speedup in terms of validation execution alone.

@codacy-production

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric Results
Duplication 0

View in Codacy

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

@read-the-docs-community

read-the-docs-community Bot commented Aug 31, 2026

Copy link
Copy Markdown

@saquibsaifee

Copy link
Copy Markdown
Contributor Author

@jkowalleck can you take a look at this PR to boost SBOM generation turn around

Signed-off-by: saquibsaifee <saquibsaifee2@gmail.com>
@saquibsaifee
saquibsaifee force-pushed the perf-optimize-bom-validate-17515006840806688594 branch from 6f5dc72 to e05bb2f Compare August 31, 2026 16:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant