fix(package): avoid duplicated dependencies

src/debsbom/dpkg/package.py

@@ -367,6 +367,22 @@ def purl(self, vendor="debian") -> PackageURL:
             purl = purl + "?arch={}".format(self.architecture)
         return PackageURL.from_string(purl)
 
+    @property
+    def unique_depends(self):
+        """
+        Returns the unique dependencies without version.
+        The raw dependencies can include version specifiers, but as only a single
+        version can be installed at a time, we ignore them.
+        """
+        seen = set()
+        unique = []
+        for dep in self.depends:
+            key = (dep.name, dep.arch)
+            if key not in seen:
+                seen.add(key)
+                unique.append(dep)
+        return unique
+
     def merge_with(self, other: "BinaryPackage"):
         """Copy properties from other which are unset on our side. Merge lists and dicts. Or booleans."""
         super().merge_with(other)

src/debsbom/generate/cdx.py

@@ -140,7 +140,7 @@ def cyclonedx_bom(
                 cdx_dependency.Dependency(refs[reference.as_str(SBOMType.CycloneDX)])
             )
         # copy the depends to not alter the package itself
-        pkg_deps = list(package.depends) or []
+        pkg_deps = list(package.unique_depends) or []
         # add dependency to source package
         if package.source:
             pkg_deps.append(package.source)

src/debsbom/generate/spdx.py

@@ -185,7 +185,7 @@ def spdx_bom(
                 )
             )
         if package.depends:
-            for dep in package.depends:
+            for dep in package.unique_depends:
                 ref_id = Reference.lookup(package, dep, SBOMType.SPDX, refs)
                 if ref_id:
                     relationship = spdx_relationship.Relationship(

tests/test_dpkg.py

@@ -145,3 +145,14 @@ def test_parse_pkgs_stream(data):
     assert pkg.name == "binutils-bpf"
     assert pkg.version.upstream_version == "2.40"
     assert pkg.architecture == "amd64"
+
+
+def test_unique_depends():
+    deps = [
+        Dependency("libc6", None, (">>", Version("2.41")), arch="amd64"),
+        Dependency("libc6", None, ("<<", Version("2.42")), arch="amd64"),
+        Dependency("foo", None, ("", Version("2.41"))),
+    ]
+    pkg = BinaryPackage("foo", "1.0", architecture="amd64", depends=deps)
+    assert len(pkg.depends) == 3
+    assert len(pkg.unique_depends) == 2