Generating duplicate in relationships in CycloneDX

[ShuP1]

What happened:

Syft produces invalid CycloneDX SBOM at least for apkdb-cataloger cataloger.
Due to duplicated refs in dependencies

CycloneDX JSON Reference #dependencies states:

All items must be unique

This rule is enforced by https://github.com/CycloneDX/cyclonedx-cli

What you expected to happen:

Syft produces a valid SBOM.

Steps to reproduce the issue:

> syft packages alpine:latest -o cyclonedx-json > sbom.json
> cyclonedx-cli validate --input-file sbom.json
Unable to validate against any JSON schemas.
BOM is not valid.
> cyclonedx-cli validate --input-file sbom.json --input-version v1_4
Validating JSON BOM...
Validation failed: Found duplicates at the following index pairs: "(2, 4)"
#/properties/dependencies/uniqueItems
BOM is not valid.

Anything else we need to know?:

/* ... */
"dependencies": [
    {
      "ref": "pkg:apk/alpine/alpine-baselayout@3.4.3-r1?arch=x86_64&distro=alpine-3.18.3&package-id=4457aba38f428cff",
      "dependsOn": [
        "pkg:apk/alpine/alpine-baselayout-data@3.4.3-r1?arch=x86_64&upstream=alpine-baselayout&distro=alpine-3.18.3&package-id=afce4445f1c5ffeb"
      ]
    },
    {
      "ref": "pkg:apk/alpine/alpine-baselayout@3.4.3-r1?arch=x86_64&distro=alpine-3.18.3&package-id=4457aba38f428cff",
      "dependsOn": [
        "pkg:apk/alpine/busybox-binsh@1.36.1-r2?arch=x86_64&upstream=busybox&distro=alpine-3.18.3&package-id=337ecb49f16db0b4"
      ]
    },
/* ... */

Should be:

/* ... */
"dependencies": [
    {
      "ref": "pkg:apk/alpine/alpine-baselayout@3.4.3-r1?arch=x86_64&distro=alpine-3.18.3&package-id=4457aba38f428cff",
      "dependsOn": [
        "pkg:apk/alpine/alpine-baselayout-data@3.4.3-r1?arch=x86_64&upstream=alpine-baselayout&distro=alpine-3.18.3&package-id=afce4445f1c5ffeb",
        "pkg:apk/alpine/busybox-binsh@1.36.1-r2?arch=x86_64&upstream=busybox&distro=alpine-3.18.3&package-id=337ecb49f16db0b4"
      ]
    },
/* ... */

Environment:

• Output of syft version: 0.87.1
• OS (e.g: cat /etc/os-release or similar): Ubuntu 22.04.3 LTS

[kzantow]

Thanks for the report @ShuP1

[ShuP1]

That was fast! Thanks