Annotate duplicate entries with a (*)

[jamessan]

Rather than re-traverse the entries, which can lead to pathological cases of recursion, keep track of which PackageIds have been shown. When encountering a duplicate PackageId, indicate this with "(*)" as "cargo tree" does, and return early.

[jamessan]

This doesn't address the pathological case if -a is used, though. That would likely require taking into account the feature's depended on, like cargo tree does. The reason we get into trouble is that we just consider the package (independent of feature), so there are loops.

[kpcyrd]

I think I'd prefer this feature opt-in instead of opt-out, not removing duplicates was intentional because it often makes the output easier to work with - especially with large dependency trees and many missing packages it's very difficult to track down the (*) references, and expanding them gives you a better idea of "how many levels" are missing.

I've investigated this and it's because the way the ruff repository uses [dev-dependencies] is causing cycles. Since debian needs the dev-dependencies to package a crate, these are considered by cargo-debstatus, but cargo will only consider the [dev-dependencies] of the specific crate you want to build (but not the [dev-dependencies] of any dependencies), so it doesn't consider this a cycle. cargo-debstatus doesn't consider disabled features so there are no other cycles (problems with expanding features is documented in #2).

Maybe we could keep track of the current path with a hashset and as soon as there truly is a cycle (like with ruff) we could detect this because .insert would return false and we could stop traversing at then.