Invalid cyclonedx sbom is generated for tykio/tyk-gateway:v5.8

[jakub-bochenski]

Description

Invalid cyclonedx sbom is generated for tykio/tyk-gateway:v5.8

Desired Behavior

Valid cyclonedx sbom is generated

Actual Behavior

1. {
        "type": "unique",
        "field": "dependencies",
        "context": "(root).dependencies",
        "description": "array items[1,30] must be unique",
        "value": {
            "type": "array",
            "index": 1,
            "item": {
                "dependsOn": [
                    "File---usr-share-doc-base-files-copyright"
                ],
                "ref": "package-pkg-deb-debian-base-files-12.4-2Bdeb12u10-os-name-debian-os-version-Debian"
            }
        }
    }
2. {
        "type": "unique",
        "field": "dependencies",
        "context": "(root).dependencies",
        "description": "array items[33,318] must be unique",
        "value": {
            "type": "array",
            "index": 33,
            "item": {
                "dependsOn": [
                    "File---usr-share-doc-libc6-copyright"
                ],
                "ref": "package-pkg-deb-debian-glibc-2.36-9-2Bdeb12u10-os-name-debian-os-version-Debian"
            }
        }
    }
3. {
        "type": "unique",
        "field": "dependencies",
        "context": "(root).dependencies",
        "description": "array items[321,606] must be unique",
        "value": {
            "type": "array",
            "index": 321,
            "item": {
                "dependsOn": [
                    "File---usr-share-doc-libc6-copyright"
                ],
                "ref": "package-pkg-deb-debian-libc6-2.36-9-2Bdeb12u10-os-name-debian-os-version-Debian"
            }
        }
    }
4. {
        "type": "unique",
        "field": "dependencies",
        "context": "(root).dependencies",
        "description": "array items[609,620] must be unique",
        "value": {
            "type": "array",
            "index": 609,
            "item": {
                "dependsOn": [
                    "File---usr-share-doc-libssl3-copyright"
                ],
                "ref": "package-pkg-deb-debian-libssl3-3.0.15-1-deb12u1-os-name-debian-os-version-Debian"
            }
        }
    }
5. {
        "type": "unique",
        "field": "dependencies",
        "context": "(root).dependencies",
        "description": "array items[622,626] must be unique",
        "value": {
            "type": "array",
            "index": 622,
            "item": {
                "dependsOn": [
                    "File---usr-share-doc-netbase-copyright"
                ],
                "ref": "package-pkg-deb-debian-netbase-6.4-os-name-debian-os-version-Debian"
            }
        }
    }
6. {
        "type": "unique",
        "field": "dependencies",
        "context": "(root).dependencies",
        "description": "array items[628,639] must be unique",
        "value": {
            "type": "array",
            "index": 628,
            "item": {
                "dependsOn": [
                    "File---usr-share-doc-libssl3-copyright"
                ],
                "ref": "package-pkg-deb-debian-openssl-3.0.15-1-deb12u1-os-name-debian-os-version-Debian"
            }
        }
    }
7. {
        "type": "unique",
        "field": "dependencies",
        "context": "(root).dependencies",
        "description": "array items[641,647] must be unique",
        "value": {
            "type": "array",
            "index": 641,
            "item": {
                "dependsOn": [
                    "File---usr-share-doc-tzdata-copyright"
                ],
                "ref": "package-pkg-deb-debian-tzdata-2025b-0-2Bdeb12u1-os-name-debian-os-version-Debian"
            }
        }
    }

Reproduction Steps

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy:0.65.0 image --scanners license --license-full --license-confidence-level 0 --format cyclonedx tykio/tyk-gateway:v5.8 

### Target

None

### Scanner

None

### Output Format

None

### Mode

None

### Debug Output

```bash
see above

Operating System

linux

Version

see above

Checklist

• Run trivy clean --all
• Read the troubleshooting

[jakub-bochenski]

sorry, mixed up validation results