Improve merge performance (Alternative)

src/CycloneDX.Core/Json/Serializer.Serialization.cs

@@ -89,5 +89,18 @@ internal static string Serialize(Models.Vulnerabilities.Vulnerability vulnerabil
             Contract.Requires(vulnerability != null);
             return JsonSerializer.Serialize(vulnerability, _options);
         }
+
+        internal static string Serialize(Models.Composition composition)
+        {
+            Contract.Requires(composition != null);
+            return JsonSerializer.Serialize(composition, _options);
+        }
+
+        internal static string Serialize(Models.ExternalReference externalReference)
+        {
+            Contract.Requires(externalReference != null);
+            return JsonSerializer.Serialize(externalReference, _options);
+        }
+
     }
 }

src/CycloneDX.Core/Models/Component.cs

@@ -218,8 +218,25 @@ public bool NonNullableModified
         [ProtoMember(26)]
         public Data Data { get; set; }
 
+        public override bool Equals(object obj)
+        {
+            var other = obj as Component;
+            if (other == null)
+            {
+                return false;
+            }
+
+            return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(other);
+        }
+
         public bool Equals(Component obj)
         {
+            // quick check without Serializer for improved performance
+            if (obj == null || Name != obj.Name)
+            {
+                return false;
+            }
+
             return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(obj);
         }
 

src/CycloneDX.Core/Models/Composition.cs

@@ -25,7 +25,7 @@
 namespace CycloneDX.Models
 {
     [ProtoContract]
-    public class Composition : IXmlSerializable
+    public class Composition : IXmlSerializable, IEquatable<Composition>
     {
         [ProtoContract]
         public enum AggregateType
@@ -194,5 +194,26 @@ public void WriteXml(System.Xml.XmlWriter writer) {
                 writer.WriteEndElement();
             }
         }
+
+        public override bool Equals(object obj)
+        {
+            var other = obj as Composition;
+            if (other == null)
+            {
+                return false;
+            }
+
+            return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(other);
+        }
+
+        public bool Equals(Composition obj)
+        {
+            return CycloneDX.Json.Serializer.Serialize(this) == CycloneDX.Json.Serializer.Serialize(obj);
+        }
+
+        public override int GetHashCode()
+        {
+            return CycloneDX.Json.Serializer.Serialize(this).GetHashCode();
+        }
     }
 }

src/CycloneDX.Core/Models/Dependency.cs

@@ -36,6 +36,17 @@ public class Dependency: IEquatable<Dependency>
         [ProtoMember(2)]
         public List<Dependency> Dependencies { get; set; }
 
+        public override bool Equals(object obj)
+        {
+            var other = obj as Dependency;
+            if (other == null)
+            {
+                return false;
+            }
+
+            return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(other);
+        }
+
         public bool Equals(Dependency obj)
         {
             return CycloneDX.Json.Serializer.Serialize(this) == CycloneDX.Json.Serializer.Serialize(obj);

src/CycloneDX.Core/Models/ExternalReference.cs

@@ -15,16 +15,18 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (c) OWASP Foundation. All Rights Reserved.
 
+using System;
 using System.Collections.Generic;
 using System.Diagnostics.CodeAnalysis;
+using System.Text.Json.Serialization;
 using System.Xml.Serialization;
 using ProtoBuf;
 
 namespace CycloneDX.Models
 {
     [SuppressMessage("Microsoft.Naming", "CA1707:IdentifiersShouldNotContainUnderscores")]
     [ProtoContract]
-    public class ExternalReference
+    public class ExternalReference : IEquatable<ExternalReference>
     {
         [ProtoContract]
         public enum ExternalReferenceType
@@ -125,5 +127,26 @@ public enum ExternalReferenceType
         [ProtoMember(4)]
         public List<Hash> Hashes { get; set; }
         public bool ShouldSerializeHashes() { return Hashes?.Count > 0; }
+
+        public override bool Equals(object obj)
+        {
+            var other = obj as ExternalReference;
+            if (other == null)
+            {
+                return false;
+            }
+
+            return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(other);
+        }
+
+        public bool Equals(ExternalReference obj)
+        {
+            return CycloneDX.Json.Serializer.Serialize(this) == CycloneDX.Json.Serializer.Serialize(obj);
+        }
+
+        public override int GetHashCode()
+        {
+            return CycloneDX.Json.Serializer.Serialize(this).GetHashCode();
+        }
     }
 }

src/CycloneDX.Core/Models/Service.cs

@@ -194,6 +194,17 @@ public ServiceDataChoices XmlData
 
         public bool ShouldSerializeProperties() => Properties?.Count > 0;
 
+        public override bool Equals(object obj)
+        {
+            var other = obj as Service;
+            if (other == null)
+            {
+                return false;
+            }
+
+            return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(other);
+        }
+
         public bool Equals(Service obj)
         {
             return CycloneDX.Json.Serializer.Serialize(this) == CycloneDX.Json.Serializer.Serialize(obj);

src/CycloneDX.Core/Models/Tool.cs

@@ -48,6 +48,17 @@ public class Tool: IEquatable<Tool>
         public List<ExternalReference> ExternalReferences { get; set; }
         public bool ShouldSerializeExternalReferences() { return ExternalReferences?.Count > 0; }
 
+        public override bool Equals(object obj)
+        {
+            var other = obj as Tool;
+            if (other == null)
+            {
+                return false;
+            }
+
+            return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(other);
+        }
+
         public bool Equals(Tool obj)
         {
             return CycloneDX.Json.Serializer.Serialize(this) == CycloneDX.Json.Serializer.Serialize(obj);

src/CycloneDX.Core/Models/Vulnerabilities/Vulnerability.cs

@@ -143,7 +143,18 @@ public DateTime? Rejected
         [ProtoMember(18)]
         public List<Property> Properties { get; set; }
         public bool ShouldSerializeProperties() { return Properties?.Count > 0; }
-
+
+        public override bool Equals(object obj)
+        {
+            var other = obj as Vulnerability;
+            if (other == null)
+            {
+                return false;
+            }
+
+            return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(other);
+        }
+
         public bool Equals(Vulnerability obj)
         {
             return CycloneDX.Json.Serializer.Serialize(this) == CycloneDX.Json.Serializer.Serialize(obj);

src/CycloneDX.Utils/Merge.cs

@@ -23,7 +23,7 @@
 
 namespace CycloneDX.Utils
 {
-    class ListMergeHelper<T>
+    class ListMergeHelper<T> where T : IEquatable<T>
     {
         public List<T> Merge(List<T> list1, List<T> list2)
         {
@@ -34,7 +34,7 @@ public List<T> Merge(List<T> list1, List<T> list2)
 
             foreach (var item in list2)
             {
-                if (!(result.Contains(item))) 
+                if (!(result.Contains(item)))
                 {
                     result.Add(item);
                 }

tests/CycloneDX.Utils.Tests/MergeTests.cs

@@ -105,6 +105,31 @@ public void FlatMergeComponentsTest()
             Snapshot.Match(result);
         }
 
+        [Fact]
+        public void FlatMergeDuplicatedComponentsTest()
+        {
+            var sboms = new List<Bom>();
+            for (int i = 0; i < 3; i++)
+            {
+                var bom = new Bom
+                {
+                    Components = new List<Component>
+                    {
+                        new Component
+                        {
+                            Name = "Component1",
+                            Version = "1"
+                        }
+                    }
+                };
+                sboms.Add(bom);
+            }
+            var result = CycloneDXUtils.FlatMerge(sboms);
+
+            Assert.Single(result.Components);
+        }
+
+
         [Fact]
         public void FlatMergeVulnerabilitiesTest()
         {