Duplicates in Syft JSON "artifactRelationships"

[Joerki]

What happened:

In the "artifactRelationships" section there may be duplicates:

 ...
  "artifactRelationships": [
  {
   "parent": "01f4e15782e8ef55",
   "child": "983745821c840533",
   "type": "evident-by"
  },
  {
   "parent": "024f43ee9d2b0709",
   "child": "2a8438c8b82f4048",
   "type": "evident-by"
  },
  {
   "parent": "0319e43ee9c5a85f",
   "child": "f63c01b962849c5e",
   "type": "evident-by"
  },
  {
   "parent": "03bccb8ed860664f",
   "child": "05fee808ded509ab",
   "type": "contains"
  },
  {
   "parent": "03bccb8ed860664f",
   "child": "05fee808ded509ab",
   "type": "contains"
  },
  {
   "parent": "03bccb8ed860664f",
   "child": "05fee808ded509ab",
   "type": "contains"
  },
  {
   "parent": "03bccb8ed860664f",
   "child": "05fee808ded509ab",
   "type": "contains"
  },
  {
   "parent": "03bccb8ed860664f",
   "child": "05fee808ded509ab",
   "type": "contains"
  },..

What you expected to happen:
Any parent/child/type item is unique

Steps to reproduce the issue:
Generate a Syft JSON SBOM (from a Docker image in my case).

Anything else we need to know?:

• N/A

Environment:

• Output of syft version: 0.94.0
• OS (e.g: cat /etc/os-release or similar): linux/amd64, PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"

[tgerla]

Hi @Joerki, thanks for the report! Is there a public Docker image that we can use to reproduce this problem? Thanks.

[Joerki]

Hi Tim,
I'm sorry, I got this extract from our product and cannot provide a public sample at this time.
I just can tell you that we scan all layers of a container.

[tgerla]

Hi @Joerki, no problem, I think we can make progress on this without your private image. We'll let you know if we need any more info to reproduce.

[Joerki]

Is this the same issue described and fixed with #2509?

[spiffcs]

@Joerki - it's very similar, but my fix was specific to a double call of building relationships that was newly introduced after this issue was filed. If your specific example (I didn't see the image you used in the issue) is still showing duplicate relationships please let me know. I added a regression test in syft to try and protect against this happening in the future, but some odd edges could still exist.

If you still find duplicate relationships on the latest release please let us know! I will close this issue, but reopen if you find your case is still relevant =)