fix(cyclonedx): duplicated entries in dependsOn

Author: d3vv3

pkg/sbom/cyclonedx/marshal.go

@@ -175,6 +175,7 @@ func (m *Marshaler) marshalDependencies() *[]cdx.Dependency {
 			d, ok := m.componentIDs[rel.Dependency]
 			return d, ok
 		})
+		deps = lo.Uniq(deps)
 		sort.Strings(deps)
 
 		dependencies = append(dependencies, cdx.Dependency{

pkg/sbom/cyclonedx/marshal_test.go

@@ -2428,3 +2428,91 @@ func TestMarshaler_Licenses(t *testing.T) {
 		})
 	}
 }
+
+func TestMarshaler_DuplicateDependencies(t *testing.T) {
+	clock.SetFakeTime(t)
+
+	inputReport := types.Report{
+		SchemaVersion: report.SchemaVersion,
+		ArtifactName:  "test-image",
+		ArtifactType:  ftypes.TypeContainerImage,
+		Results: types.Results{
+			{
+				Target: "test",
+				Class:  types.ClassLangPkg,
+				Type:   ftypes.Jar,
+				Packages: []ftypes.Package{
+					{
+						ID:      "[email protected]",
+						Name:    "pkg-a",
+						Version: "1.0.0",
+						Identifier: ftypes.PkgIdentifier{
+							UID: "A",
+							PURL: &packageurl.PackageURL{
+								Type:    packageurl.TypeMaven,
+								Name:    "pkg-a",
+								Version: "1.0.0",
+							},
+						},
+						DependsOn: []string{
+							"[email protected]",
+							"[email protected]",
+							"[email protected]",
+							"[email protected]",
+							"[email protected]",
+						},
+					},
+					{
+						ID:      "[email protected]",
+						Name:    "pkg-b",
+						Version: "1.0.0",
+						Identifier: ftypes.PkgIdentifier{
+							UID: "B",
+							PURL: &packageurl.PackageURL{
+								Type:    packageurl.TypeMaven,
+								Name:    "pkg-b",
+								Version: "1.0.0",
+							},
+						},
+					},
+					{
+						ID:      "[email protected]",
+						Name:    "pkg-c",
+						Version: "1.0.0",
+						Identifier: ftypes.PkgIdentifier{
+							UID: "C",
+							PURL: &packageurl.PackageURL{
+								Type:    packageurl.TypeMaven,
+								Name:    "pkg-c",
+								Version: "1.0.0",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	marshaler := cyclonedx.NewMarshaler("dev")
+	bom, err := marshaler.MarshalReport(clock.NewContext(), inputReport)
+	require.NoError(t, err)
+
+	require.NotNil(t, bom.Dependencies)
+	deps := *bom.Dependencies
+
+	var pkgADeps *cdx.Dependency
+	for i := range deps {
+		if deps[i].Ref == "pkg:maven/[email protected]" {
+			pkgADeps = &deps[i]
+			break
+		}
+	}
+
+	require.NotNil(t, pkgADeps, "pkg-a dependency not found")
+	require.NotNil(t, pkgADeps.Dependencies, "pkg-a dependencies is nil")
+
+	actualDeps := *pkgADeps.Dependencies
+	assert.Len(t, actualDeps, 2, "expected 2 unique dependencies, got %d", len(actualDeps))
+	assert.Contains(t, actualDeps, "pkg:maven/[email protected]")
+	assert.Contains(t, actualDeps, "pkg:maven/[email protected]")
+}