Deduplicate packages across multiple container image layers (#930)

internal/formats/github/encoder.go

@@ -58,8 +58,9 @@ func toSnapshotMetadata(s *sbom.SBOM) Metadata {
 }
 
 func filesystem(p pkg.Package) string {
-	if len(p.Locations) > 0 {
-		return p.Locations[0].FileSystemID
+	locations := p.Locations.ToSlice()
+	if len(locations) > 0 {
+		return locations[0].FileSystemID
 	}
 	return ""
 }
@@ -76,8 +77,9 @@ func toPath(s source.Metadata, p pkg.Package) string {
 	if inputPath == "." {
 		inputPath = ""
 	}
-	if len(p.Locations) > 0 {
-		location := p.Locations[0]
+	locations := p.Locations.ToSlice()
+	if len(locations) > 0 {
+		location := locations[0]
 		packagePath := location.RealPath
 		if location.VirtualPath != "" {
 			packagePath = location.VirtualPath

internal/formats/github/encoder_test.go

@@ -35,32 +35,38 @@ func Test_toGithubModel(t *testing.T) {
 		{
 			Name:    "pkg-1",
 			Version: "1.0.1",
-			Locations: []source.Location{{
-				Coordinates: source.Coordinates{
-					RealPath:     "/usr/lib",
-					FileSystemID: "fsid-1",
+			Locations: source.NewLocationSet(
+				source.Location{
+					Coordinates: source.Coordinates{
+						RealPath:     "/usr/lib",
+						FileSystemID: "fsid-1",
+					},
 				},
-			}},
+			),
 		},
 		{
 			Name:    "pkg-2",
 			Version: "2.0.2",
-			Locations: []source.Location{{
-				Coordinates: source.Coordinates{
-					RealPath:     "/usr/lib",
-					FileSystemID: "fsid-1",
+			Locations: source.NewLocationSet(
+				source.Location{
+					Coordinates: source.Coordinates{
+						RealPath:     "/usr/lib",
+						FileSystemID: "fsid-1",
+					},
 				},
-			}},
+			),
 		},
 		{
 			Name:    "pkg-3",
 			Version: "3.0.3",
-			Locations: []source.Location{{
-				Coordinates: source.Coordinates{
-					RealPath:     "/etc",
-					FileSystemID: "fsid-1",
+			Locations: source.NewLocationSet(
+				source.Location{
+					Coordinates: source.Coordinates{
+						RealPath:     "/etc",
+						FileSystemID: "fsid-1",
+					},
 				},
-			}},
+			),
 		},
 	} {
 		p.PURL = packageurl.NewPackageURL(