perf: optimize dependency resolver with map-based deduplication

Replace strset-based deduplication with efficient map-based approach to avoid
external dependency overhead. Use struct keys instead of string concatenation
for relationship tracking, eliminating temporary string allocations.

Changes:
- Add pairKey struct to track relationship pairs without string concatenation
- Replace strset.New() with map[string]struct{} in deduplicate()
- Use pairKey struct in Resolve() to avoid string key construction
- Remove dependency on scylladb/go-set/strset

Benchmarks:
- BenchmarkDeduplicate_VeryLarge (5000 strings): 85566 ns/op, 237232 B/op, 27 allocs/op
- BenchmarkResolve_CraftedRelationships_VeryLarge (1000 pkgs): 857822 ns/op, 1.03 MB, 12063 allocs/op

Related: PR anchore#4585 (closed)

Author: matthyx

syft/pkg/cataloger/internal/dependency/resolver.go

@@ -3,14 +3,17 @@ package dependency
 import (
 	"sort"
 
-	"github.com/scylladb/go-set/strset"
-
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
+// pairKey is a struct used to track seen relationship pairs without string concatenation
+type pairKey struct {
+	from, to artifact.ID
+}
+
 // Specification holds strings that indicate abstract resources that a package provides for other packages and
 // requires for itself. These strings can represent anything from file paths, package names, or any other concept
 // that is useful for dependency resolution within that packing ecosystem.
@@ -64,15 +67,15 @@ func Resolve(specifier Specifier, pkgs []pkg.Package) (relationships []artifact.
 		specsByPkg[id] = allProvides(pkgsProvidingResource, id, specifier(p))
 	}
 
-	seen := strset.New()
+	seen := make(map[pairKey]struct{})
 	for _, dependantPkg := range pkgs {
 		specs := specsByPkg[dependantPkg.ID()]
 		for _, spec := range specs {
 			for _, resource := range deduplicate(spec.Requires) {
 				for providingPkgID := range pkgsProvidingResource[resource] {
-					// prevent creating duplicate relationships
-					pairKey := string(providingPkgID) + "-" + string(dependantPkg.ID())
-					if seen.Has(pairKey) {
+					// prevent creating duplicate relationships using struct key instead of string concatenation
+					key := pairKey{from: providingPkgID, to: dependantPkg.ID()}
+					if _, exists := seen[key]; exists {
 						continue
 					}
 
@@ -86,7 +89,7 @@ func Resolve(specifier Specifier, pkgs []pkg.Package) (relationships []artifact.
 						},
 					)
 
-					seen.Add(pairKey)
+					seen[key] = struct{}{}
 				}
 			}
 		}
@@ -112,8 +115,16 @@ func allProvides(pkgsProvidingResource map[string]internal.Set[artifact.ID], id
 
 func deduplicate(ss []string) []string {
 	// note: we sort the set such that multiple invocations of this function will be deterministic
-	set := strset.New(ss...)
-	list := set.List()
-	sort.Strings(list)
-	return list
+	// use map for O(1) lookups without strset overhead
+	unique := make(map[string]struct{}, len(ss))
+	result := make([]string, 0, len(unique))
+
+	for _, s := range ss {
+		if _, exists := unique[s]; !exists {
+			unique[s] = struct{}{}
+			result = append(result, s)
+		}
+	}
+	sort.Strings(result)
+	return result
 }

syft/pkg/cataloger/internal/dependency/resolver_bench_test.go

@@ -0,0 +1,108 @@
+package dependency
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func BenchmarkDeduplicate(b *testing.B) {
+	input := generateDuplicateStrings(100, 50)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = deduplicate(input)
+	}
+}
+
+func BenchmarkDeduplicate_Large(b *testing.B) {
+	input := generateDuplicateStrings(1000, 200)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = deduplicate(input)
+	}
+}
+
+func BenchmarkDeduplicate_VeryLarge(b *testing.B) {
+	input := generateDuplicateStrings(5000, 500)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = deduplicate(input)
+	}
+}
+
+func BenchmarkDeduplicate_Memory(b *testing.B) {
+	input := generateDuplicateStrings(5000, 500)
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = deduplicate(input)
+	}
+}
+
+func BenchmarkResolve_CraftedRelationships(b *testing.B) {
+	pkgs := generatePackages(100, 100)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = Resolve(testDependencySpecifier, pkgs)
+	}
+}
+
+func BenchmarkResolve_CraftedRelationships_Large(b *testing.B) {
+	pkgs := generatePackages(500, 200)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = Resolve(testDependencySpecifier, pkgs)
+	}
+}
+
+func BenchmarkResolve_CraftedRelationships_VeryLarge(b *testing.B) {
+	pkgs := generatePackages(1000, 500)
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = Resolve(testDependencySpecifier, pkgs)
+	}
+}
+
+func generateDuplicateStrings(total, unique int) []string {
+	result := make([]string, total)
+	for i := 0; i < total; i++ {
+		result[i] = fmt.Sprintf("resource-%d", i%unique)
+	}
+	return result
+}
+
+func generatePackages(numPkgs, numResources int) []pkg.Package {
+	pkgs := make([]pkg.Package, numPkgs)
+	for i := 0; i < numPkgs; i++ {
+		p := pkg.Package{
+			Name:     fmt.Sprintf("package-%d", i),
+			Version:  fmt.Sprintf("1.0.%d", i),
+			Language: pkg.JavaScript,
+		}
+		p.SetID()
+		pkgs[i] = p
+	}
+	return pkgs
+}
+
+func testDependencySpecifier(p pkg.Package) Specification {
+	return Specification{
+		ProvidesRequires: ProvidesRequires{
+			Provides: []string{
+				fmt.Sprintf("provides-%s", p.Name),
+			},
+			Requires: []string{
+				fmt.Sprintf("requires-%s", p.Name),
+			},
+		},
+	}
+}