Duplicate Detection

Identifies components at multiple versions: unresolved dependency conflicts or stale transitive deps.


Short name	Duplicates
Region	Internal
Country or scope	Internal
Sector	Supply Chain
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers Duplicates

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 6 controls from Safeguard's control catalog for Duplicates.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for Duplicates and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`DUP-ID-PURL` Version-Qualified Identifiers	Duplicate detection requires each component instance to carry a PURL, whose coordinates make same-name/different-version occurrences mechanically distinguishable (Package URL specification; CycloneDX component identity)	Scan
`DUP-VER-PRES` Versions Present for Comparison	A component without a version cannot be checked for duplication against its siblings, so version fields must be populated (NTIA Minimum Elements - version of the component)	Scan
`DUP-VER-SPEC` Exact Versions Only	Ranged or floating versions (latest, *, >=) mask duplicate resolution and defeat conflict analysis; every declared version must be a single resolved value (CycloneDX/SPDX version field semantics)	Scan
`DUP-DEP-GRAPH` Dependency Paths Documented	Distinguishing a legitimate multi-version situation from a stale transitive dependency requires the dependency relationships that pull each instance in (NTIA Minimum Elements - dependency relationship)	Scan
`DUP-COMPLETE` Name+Version Completeness	Duplicate analysis keys on the (name, version) pair, so components must carry both fields to participate in the check (NTIA Minimum Elements - component name and version)	Scan
`DUP-HASH-DIST` Hashes Distinguish Rebuilds	Integrity hashes distinguish genuinely different artefacts from re-listed identical ones, sharpening duplicate classification (CycloneDX component.hashes; SPDX PackageChecksum)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`DUP-01`	Multi-Version Duplicate Detection
`DUP-02`	Transitive Conflict Resolution Policy
`DUP-03`	Deduplication Policy Enforcement
`DUP-04`	Bundle / Vendor Copy Detection
`DUP-05`	Duplicate Vulnerability Deduplication in Reporting
`DUP-06`	Duplicate Count Trend Monitoring

Policy templates

Written for Duplicates:

Duplicate Component Detection and Deduplication Policy
Duplicate Vulnerability Reporting and Trend Monitoring Policy

And 22 from the standard set, adapted to Duplicates.