Taking too much time to verify the SPDX tag-value SBOM

[boravinod145]

Description

An invalid Tag value SBOM contains large relationships and has thousands of SPDX warnings taking exponential time to verify.

Example

To generate this issue download the attached spdx tag value file is an invalid SBOM and try to verify it:

SBOM: issued.zip

java -jar tools-java-1.1.8-jar-with-dependencies.jar Verify ./issued.spdx

I waited for 5 hours and it is still not validated. After debugging this, found verifying elements in relationships in line L1489 in spdx-java-tagvalue-store lib is taking too much time to verify the relationships.

To verify this I've created a new jar by commenting lines L1488C3-L1490C4, is verified the same SBOM within 1 min.