fix: duplicate package dependencies in lock file (#189)

Make sure that package dependencies in a lock file are added only once.

Resolves #184 & Closes #184.

Author: birunts

MODULE.bazel

@@ -96,9 +96,14 @@ apt.install(
     manifest = "apt/tests/resolution/arch_all.yaml",
     nolock = True,
 )
+apt.install(
+    name = "unique_dependencies",
+    manifest = "//apt/tests/resolution:dependencies.yaml",
+    nolock = True,
+)
 apt.install(
     name = "clang",
     manifest = "apt/tests/resolution/clang.yaml",
     nolock = True,
 )
-use_repo(apt, "arch_all_test", "arch_all_test_resolve", "bullseye", "bullseye_nolock", "clang", "noble", "resolution_test", "resolution_test_empty_lock_resolve", "resolution_test_resolve")
+use_repo(apt, "arch_all_test", "arch_all_test_resolve", "bullseye", "bullseye_nolock", "clang", "noble", "resolution_test", "resolution_test_empty_lock_resolve", "resolution_test_resolve", "unique_dependencies_resolve")

apt/private/lockfile.bzl

@@ -1,5 +1,6 @@
 "lock"
 
+load("@bazel_skylib//lib:new_sets.bzl", "sets")
 load(":util.bzl", "util")
 
 def _make_package_key(name, version, arch):
@@ -29,17 +30,22 @@ def _add_package(lock, package, arch):
         "dependencies": [],
     })
     lock.fast_package_lookup[k] = len(lock.packages) - 1
+    lock.fast_package_dependencies_lookup[k] = sets.make()
 
 def _add_package_dependency(lock, package, dependency, arch):
     k = _package_key(package, arch)
     if k not in lock.fast_package_lookup:
         fail("Broken state: %s is not in the lockfile." % package["Package"])
     i = lock.fast_package_lookup[k]
-    lock.packages[i]["dependencies"].append(dict(
-        key = _package_key(dependency, arch),
-        name = dependency["Package"],
-        version = dependency["Version"],
-    ))
+
+    dependency_key = _package_key(dependency, arch)
+    if not sets.contains(lock.fast_package_dependencies_lookup[k], dependency_key):
+        lock.packages[i]["dependencies"].append(dict(
+            key = dependency_key,
+            name = dependency["Package"],
+            version = dependency["Version"],
+        ))
+        lock.fast_package_dependencies_lookup[k] = sets.insert(lock.fast_package_dependencies_lookup[k], dependency_key)
 
 def _has_package(lock, name, version, arch):
     key = "%s_%s_%s" % (util.sanitize(name), util.sanitize(version), arch)
@@ -60,6 +66,7 @@ def _empty(rctx):
         version = 1,
         packages = list(),
         fast_package_lookup = dict(),
+        fast_package_dependencies_lookup = dict(),
     )
     return _create(rctx, lock)
 
@@ -75,6 +82,7 @@ def _from_json(rctx, content):
         version = lock["version"],
         packages = lock["packages"],
         fast_package_lookup = dict(),
+        fast_package_dependencies_lookup = dict(),
     )
     for (i, package) in enumerate(lock.packages):
         # TODO: only support urls before 1.0
@@ -83,6 +91,7 @@ def _from_json(rctx, content):
 
         lock.packages[i] = package
         lock.fast_package_lookup[package["key"]] = i
+        lock.fast_package_dependencies_lookup[package["key"]] = sets.make([d["key"] for d in package["dependencies"]])
     return _create(rctx, lock)
 
 lockfile = struct(

apt/tests/resolution/BUILD.bazel

@@ -62,6 +62,21 @@ assert_contains(
     expected = "73",
 )
 
+jq(
+    name = "unique_dependencies",
+    srcs = [
+        "@unique_dependencies_resolve//:lockfile",
+    ],
+    args = ["-rj"],
+    filter = '.packages | map(select(.name == "gcc")) | .[0].dependencies | group_by(.) | map(select(length>1) | .[0]) | length',
+)
+
+assert_contains(
+    name = "test_unique_dependencies",
+    actual = ":unique_dependencies",
+    expected = "0",
+)
+
 build_test(
     name = "build_clang",
     target_compatible_with = [

apt/tests/resolution/dependencies.yaml

@@ -0,0 +1,15 @@
+version: 1
+sources:
+  - channel: jammy main
+    url: https://snapshot.ubuntu.com/ubuntu/20250302T030400Z
+  - channel: jammy universe
+    url: https://snapshot.ubuntu.com/ubuntu/20250302T030400Z
+  - channel: jammy-security main
+    url: https://snapshot.ubuntu.com/ubuntu/20250302T030400Z
+  - channel: jammy-updates main
+    url: https://snapshot.ubuntu.com/ubuntu/20250302T030400Z
+archs:
+  - "arm64"
+packages:
+  - "gcc"
+  - "gcc-aarch64-linux-gnu"