Trust roots on Ubuntu and other linux distributions are stored in a single PEM file that contains multiple certificates. We want to support loading these in the future and therefore need to be able to parse multiple certificates from a single PEM file.
Modificaitons
add PEMDocument.parseMultiple(pemString:) that returns an array of PEMDocuments
use new multi PEM parser for PEMDocument(pemString:) as well to speed up parsing and reduce allocations significantly
Result
TL;DR: Parsing & decoding a PEM document is now ~5x faster and mallocs ~12x less. This allows us to parse the WebPKI trust roots from its PEM string representation to the Swift type Certificate from swift-certificates in under 5ms.
I have run a couple benchmarks (Swift 5.8.1 on arm64 (M1 Max) in docker) that parses 130 certificates (100 times in a loop) found at /etc/ssl/certs on Ubuntu.
The first test just parse the PEM String to a PEMDocument:
Motivation
Trust roots on Ubuntu and other linux distributions are stored in a single PEM file that contains multiple certificates. We want to support loading these in the future and therefore need to be able to parse multiple certificates from a single PEM file.
Modificaitons
PEMDocument.parseMultiple(pemString:)
that returns an array ofPEMDocument
sPEMDocument(pemString:)
as well to speed up parsing and reduce allocations significantlyResult
TL;DR: Parsing & decoding a PEM document is now ~5x faster and mallocs ~12x less. This allows us to parse the WebPKI trust roots from its PEM string representation to the Swift type
Certificate
fromswift-certificates
in under 5ms.I have run a couple benchmarks (Swift 5.8.1 on arm64 (M1 Max) in docker) that parses 130 certificates (100 times in a loop) found at
/etc/ssl/certs
on Ubuntu. The first test just parse the PEMString
to aPEMDocument
:The second test parse the PEM
String
to aPEMDocument
and subsequently as aCertificate
:I also run a benchmark that uses the new
PEMDocument.parseMultiple(pemString:)
method:which is roughly the same as parsing each PEM individually:
Note that macOS is even faster, likely because of the different base64 decode implementation: