@cyclonedx/cdxgen 11.2.1 → 11.2.2

package/data/component-tags.json

@@ -320,8 +320,8 @@
       {
         "browser": [
           "^(edge)",
-          "(firefox|chrome|opera|brave|mullvad|tor|chromium)",
-          "(microsoft+edge|microsoft+edge+webview2|microsoft+html)"
+          "^(firefox|chrome|opera|brave|mullvad|tor|chromium)",
+          "^(microsoft+edge|microsoft+edge+webview2|microsoft+html)"
         ]
       },
       {

package/lib/cli/index.js

@@ -628,6 +628,10 @@ function addMetadata(parentComponent = {}, options = {}, context = {}) {
     }
     metadata.component = parentComponent;
   }
+  // Have we already captured the oci properties
+  if (metadata?.properties?.some((prop) => prop.name === "oci:image:Id")) {
+    return metadata;
+  }
   if (options) {
     const mproperties = [];
     if (options.exportData) {
@@ -718,19 +722,137 @@ function addMetadata(parentComponent = {}, options = {}, context = {}) {
             value: lastLayerConfig.created,
           });
         }
-        if (lastLayerConfig.config) {
-          const env = lastLayerConfig.config.Env;
-          if (env && Array.isArray(env) && env.length) {
+      }
+      const layerConfig =
+        lastLayerConfig?.config || options.exportData?.inspectData;
+      if (layerConfig) {
+        const env = layerConfig?.config?.Env || layerConfig?.Config?.Env;
+        if (env && Array.isArray(env) && env.length) {
+          mproperties.push({
+            name: "oci:image:lastLayer:Env",
+            value: env.join("\\n"),
+          });
+          // Does the image have any special packages that cdxgen cannot detect such as android-sdk and sdkman
+          const evalue = env.join(":");
+          if (
+            evalue.includes("android-sdk") ||
+            evalue.includes("commandlinetools")
+          ) {
+            mproperties.push({
+              name: "oci:image:bundles:AndroidSdk",
+              value: "true",
+            });
+          }
+          // Track the use of special environment variables that could influence the search paths for libraries
+          // This list was generated by repeatedly prompting ChatGPT with examples.
+          // FIXME: Move these to a config file
+          for (const senvValue of [
+            "LD_LIBRARY_PATH",
+            "DYLD_LIBRARY_PATH",
+            "LD_PRELOAD",
+            "PYTHONPATH",
+            "CLASSPATH",
+            "PERL5LIB",
+            "PERLLIB",
+            "RUBYLIB",
+            "NODE_PATH",
+            "LUA_PATH",
+            "JULIA_LOAD_PATH",
+            "R_LIBS",
+            "R_LIBS_USER",
+            "GEM_PATH",
+            "DOTNET_ROOT",
+            "DOTNET_ADDITIONAL_DEPS",
+            "DOTNET_SHARED_STORE",
+            "DOTNET_STARTUP_HOOKS",
+            "DOTNET_BUNDLE_EXTRACT_BASE_DIR",
+            "JAVA_OPTIONS",
+            "JAVA_TOOL_OPTIONS",
+            "NODE_OPTIONS",
+            "PYTHONSTARTUP",
+            "RUBYOPT",
+            "WGETRC",
+            "APT_CONFIG",
+            "NPM_CONFIG_PREFIX",
+            "NPM_CONFIG_REGISTRY",
+            "YARN_CACHE_FOLDER",
+            "PNPM_STORE_PATH",
+            "PNPM_HOME",
+            "PNPM_CONFIG_",
+          ]) {
+            if (evalue.includes(senvValue)) {
+              mproperties.push({
+                name: `oci:image:env:${senvValue}`,
+                value: "true",
+              });
+            }
+          }
+          // This value represents a filtered and expanded path
+          if (options?.binPaths?.length) {
+            mproperties.push({
+              name: "oci:image:env:PATH",
+              value: options.binPaths.join(":"),
+            });
+          }
+          if (evalue.includes(".sdkman")) {
+            mproperties.push({
+              name: "oci:image:bundles:Sdkman",
+              value: "true",
+            });
+          }
+          if (evalue.includes(".nvm")) {
             mproperties.push({
-              name: "oci:image:lastLayer:Env",
-              value: env.join("\\n"),
+              name: "oci:image:bundles:Nvm",
+              value: "true",
             });
           }
-          const ccmd = lastLayerConfig.config.Cmd;
-          if (ccmd && Array.isArray(ccmd) && ccmd.length) {
+          if (evalue.includes(".rbenv")) {
+            mproperties.push({
+              name: "oci:image:bundles:Rbenv",
+              value: "true",
+            });
+          }
+        }
+        const ccmd =
+          layerConfig?.config?.Cmd ||
+          layerConfig?.Config?.Cmd ||
+          layerConfig?.Config?.EntryPoint;
+        if (ccmd) {
+          if (Array.isArray(ccmd) && ccmd.length) {
+            const fullCommand = ccmd.join(" ");
             mproperties.push({
               name: "oci:image:lastLayer:Cmd",
-              value: ccmd.join(" "),
+              value: fullCommand,
+            });
+            let appLanguage;
+            // TODO: Move these lists to a config file.
+            for (const lang in [
+              "java",
+              "node",
+              "dotnet",
+              "python",
+              "python3",
+              "ruby",
+              "php",
+              "php7",
+              "php8",
+              "perl",
+            ]) {
+              if (fullCommand.includes(`${lang} `)) {
+                appLanguage = lang;
+                break;
+              }
+            }
+            if (appLanguage) {
+              mproperties.push({
+                name: "oci:image:appLanguage",
+                value: appLanguage,
+              });
+            }
+          } else {
+            mproperties.push({
+              name: "oci:image:lastLayer:Cmd",
+              value: ccmd.toString(),
             });
           }
         }
@@ -742,7 +864,29 @@ function addMetadata(parentComponent = {}, options = {}, context = {}) {
         value: options.allOSComponentTypes.sort().join("\\n"),
       });
     }
-
+    // Should we move these to formulation?
+    if (options?.bundledSdks?.length) {
+      for (const sdk of options.bundledSdks) {
+        try {
+          const purlObj = PackageURL.fromString(sdk);
+          const sdkName = purlObj.name.split("-")[0].toLowerCase();
+          mproperties.push({
+            name: `oci:image:bundles:${sdkName}Sdk`,
+            value: "true",
+          });
+        } catch (e) {
+          // ignore
+        }
+      }
+    }
+    if (options?.bundledRuntimes?.length) {
+      for (const runt of options.bundledRuntimes) {
+        mproperties.push({
+          name: `oci:image:bundles:${runt}Runtime`,
+          value: "true",
+        });
+      }
+    }
     if (mproperties.length) {
       metadata.properties = mproperties;
     }
@@ -1207,6 +1351,14 @@ export async function createJarBom(path, options) {
   let pkgList = [];
   let jarFiles;
   let nsMapping = {};
+  if (!options.exclude) {
+    options.exclude = [];
+  }
+  // Exclude certain directories during oci sbom generation
+  if (hasAnyProjectType(["oci"], options, false)) {
+    options.exclude.push("**/android-sdk*/**");
+    options.exclude.push("**/.sdkman/**");
+  }
   const parentComponent = createDefaultParentComponent(path, "maven", options);
   if (options.useGradleCache) {
     nsMapping = await collectGradleDependencies(
@@ -3086,9 +3238,9 @@ export async function createNodejsBom(path, options) {
     }
   }
   if (!pkgList.length && (yarnLockFiles.length || pkgLockFiles.length)) {
-    if (options.projectType.length) {
+    if (options.projectType?.length) {
       thoughtLog(
-        `Despite seeing some lock files, I didn't find any components in this Node.js project. Is there an issue with the project type '${options.projectType.join(", ")}' used 🤔? I recommend trying again with a different type.`,
+        `Despite seeing some lock files, I didn't find any components in this Node.js project. Is there an issue with the project type '${options.projectType?.join(", ")}' used 🤔? I recommend trying again with a different type.`,
       );
     } else {
       thoughtLog(
@@ -4131,7 +4283,7 @@ export async function createRustBom(path, options) {
     //    options.deep is true or options.lifecycle == build or post-build with installDeps
     // Why the need for installDeps? It currently defaults to true, so let's obey if someone wants no installs
     if (
-      options.deep === true ||
+      (options.deep && !hasAnyProjectType(["oci"], options, false)) ||
       (options.installDeps &&
         !safeExistsSync(f.replace(".toml", ".lock")) &&
         ["build", "post-build"].includes(options.lifecycle))
@@ -4556,7 +4708,7 @@ export function createClojureBom(path, options) {
       filename: leinFiles.join(", "),
     });
   }
-  if (ednFiles.length) {
+  if (ednFiles.length && !hasAnyProjectType(["oci"], options, false)) {
     let CLJ_ARGS = ["-Stree"];
     if (process.env.CLJ_ARGS) {
       CLJ_ARGS = process.env.CLJ_ARGS.split(" ");
@@ -5790,7 +5942,10 @@ export async function createRubyBom(path, options) {
     );
   }
   // Should we collect the module names for the gems
-  if (options.resolveClass || options.deep) {
+  if (
+    options.resolveClass ||
+    (options.deep && !hasAnyProjectType(["oci"], options, false))
+  ) {
     if (gemHome && !isGemHomeEmpty) {
       const rubyCommand =
         process.env.CDXGEN_RUBY_CMD || process.env.RUBY_CMD || "ruby";
@@ -5883,7 +6038,7 @@ export async function createCsharpBom(path, options) {
   let parentComponent = createDefaultParentComponent(path, "nuget", options);
   const slnFiles = getAllFiles(
     path,
-    `${options.multiProject ? "**/" : ""}*.sln`,
+    `${options.multiProject ? "**/" : ""}*.sln*`,
     options,
   );
   const csProjFiles = getAllFiles(
@@ -6042,6 +6197,8 @@ export async function createCsharpBom(path, options) {
         console.log("---------");
         if (result.stderr) {
           console.log(result.stderr);
+        } else if (result.stdout) {
+          console.log(result.stdout);
         }
         console.log("---------");
         options.failOnError && process.exit(1);
@@ -6557,17 +6714,36 @@ export async function createMultiXBom(pathList, options) {
     hasAnyProjectType(["oci"], options, false) &&
     options.allLayersExplodedDir
   ) {
-    const { osPackages, dependenciesList, allTypes } = getOSPackages(
+    const {
+      osPackages,
+      dependenciesList,
+      allTypes,
+      bundledSdks,
+      bundledRuntimes,
+      binPaths,
+      executables,
+      sharedLibs,
+    } = getOSPackages(
       options.allLayersExplodedDir,
+      options.exportData?.inspectData?.Config,
     );
+    // TODO: Need to test these with docker-compose type where multiple images could have different values.
+    // This is also clearly misusing options, which must become immutable at some point.
+    options.bundledSdks = bundledSdks;
+    options.bundledRuntimes = bundledRuntimes;
+    options.binPaths = binPaths;
     if (DEBUG_MODE) {
       console.log(
-        `**OS**: Found ${osPackages.length} OS packages at ${options.allLayersExplodedDir}`,
+        `**OS**: Found ${osPackages.length} OS packages, ${executables?.length} executables, and ${sharedLibs.length} shared libraries at ${options.allLayersExplodedDir}`,
       );
     }
     if (osPackages.length) {
       thoughtLog(
-        `I found ${osPackages.length} OS packages at ${options.allLayersExplodedDir}`,
+        `I found ${osPackages.length} OS packages and ${executables?.length} executables at ${options.allLayersExplodedDir}`,
+      );
+    } else if (executables?.length || sharedLibs?.length) {
+      thoughtLog(
+        `I couldn't find any OS packages, but I found ${executables.length} executables and ${sharedLibs.length} shared libraries at ${options.allLayersExplodedDir}. Perhaps the binary plugin wasn't available, or the architecture is unsupported.`,
       );
     } else {
       thoughtLog(
@@ -6578,6 +6754,8 @@ export async function createMultiXBom(pathList, options) {
       options.allOSComponentTypes = allTypes;
     }
     components = components.concat(osPackages);
+    components = components.concat(executables);
+    components = components.concat(sharedLibs);
     if (dependenciesList?.length) {
       dependencies = dependencies.concat(dependenciesList);
     }
@@ -6613,9 +6791,11 @@ export async function createMultiXBom(pathList, options) {
     }
     // Node.js
     if (hasAnyProjectType(["oci", "js"], options)) {
-      thoughtLog(
-        "**JS**: Now looking for JavaScript projects (npm, yarn, pnpm) and files.",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**JS**: Now looking for JavaScript projects (npm, yarn, pnpm) and files.",
+        );
+      }
       bomData = await createNodejsBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -6648,9 +6828,11 @@ export async function createMultiXBom(pathList, options) {
     }
     // Java
     if (hasAnyProjectType(["oci", "java"], options)) {
-      thoughtLog(
-        "**JAVA**: Looking for Java projects (e.g., Maven, Gradle, SBT). I hope all configurations—from Java version to individual build settings—are correctly aligned.",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**JAVA**: Looking for Java projects (e.g., Maven, Gradle, SBT). I hope all configurations—from Java version to individual build settings—are correctly aligned.",
+        );
+      }
       bomData = await createJavaBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -6698,10 +6880,12 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "py"], options)) {
-      thoughtLog(
-        "**PYTHON**: Looking for Python projects with package managers such as pip, poetry, uv, etc. Wish me good luck!",
-      );
-      if (process.env?.CDXGEN_IN_CONTAINER !== "true") {
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**PYTHON**: Looking for Python projects with package managers such as pip, poetry, uv, etc. Wish me good luck!",
+        );
+      }
+      if (process.env?.CDXGEN_IN_CONTAINER !== "true" && pathList.length <= 2) {
         thoughtLog(
           "I'm running in a non-container environment. Let's hope the correct build tools are available ✌️.",
         );
@@ -6730,9 +6914,11 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "go"], options)) {
-      thoughtLog(
-        "**GO**: Looking for go projects. I need to be cautious about purl namespaces and potential failures with the 'go list' command.",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**GO**: Looking for go projects. I need to be cautious about purl namespaces and potential failures with the 'go list' command.",
+        );
+      }
       bomData = await createGoBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(`I found ${bomData.bomJson.components.length} go packages.`);
@@ -6755,9 +6941,11 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "rust"], options)) {
-      thoughtLog(
-        "**RUST**: Let's search for Cargo/Rust projects. Should I warn the user that we don't support Cargo 'features' and native dependencies, which may lead to both false positives and false negatives? 🤔?",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**RUST**: Let's search for Cargo/Rust projects. Should I warn the user that we don't support Cargo 'features' and native dependencies, which may lead to both false positives and false negatives? 🤔?",
+        );
+      }
       bomData = await createRustBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -6789,9 +6977,11 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "php"], options)) {
-      thoughtLog(
-        "**PHP**: About to search for Composer-based projects. I hope lock files are available; otherwise, the 'composer install' command might fail for various reasons.",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**PHP**: About to search for Composer-based projects. I hope lock files are available; otherwise, the 'composer install' command might fail for various reasons.",
+        );
+      }
       bomData = createPHPBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -6823,9 +7013,11 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "ruby"], options)) {
-      thoughtLog(
-        "**RUBY**: Are there any Ruby projects in this path? There's only one way to know.",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**RUBY**: Are there any Ruby projects in this path? There's only one way to know.",
+        );
+      }
       bomData = await createRubyBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -6858,7 +7050,9 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "csharp"], options)) {
-      thoughtLog("**CSHARP**: What about csharp and fsharp projects?");
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog("**CSHARP**: What about csharp and fsharp projects?");
+      }
       bomData = await createCsharpBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -6890,9 +7084,11 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "dart"], options)) {
-      thoughtLog(
-        "**DART**: Looking for Dart projects. These are rare ones. Should I inform the user that they can pass the types argument via the command-line to speed things up?",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**DART**: Looking for Dart projects. These are rare ones. Should I inform the user that they can pass the types argument via the command-line to speed things up?",
+        );
+      }
       bomData = await createDartBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -6917,9 +7113,11 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "haskell"], options)) {
-      thoughtLog(
-        "**HASKELL**: Looking for Haskell projects. They're rarely encountered.",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**HASKELL**: Looking for Haskell projects. They're rarely encountered.",
+        );
+      }
       bomData = createHaskellBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -6944,9 +7142,11 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "elixir"], options)) {
-      thoughtLog(
-        "**ELIXIR**: Looking for Elixir projects—they're quite rare as well.",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**ELIXIR**: Looking for Elixir projects—they're quite rare as well.",
+        );
+      }
       bomData = createElixirBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -6971,9 +7171,11 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "c"], options)) {
-      thoughtLog(
-        "**C/C++**: Looking for C/C++ projects. Should I warn the user that the generated SBOM might have low accuracy and contain errors?",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**C/C++**: Looking for C/C++ projects. Should I warn the user that the generated SBOM might have low accuracy and contain errors?",
+        );
+      }
       bomData = createCppBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -6998,9 +7200,11 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "clojure"], options)) {
-      thoughtLog(
-        "**CLOJURE**: Looking for Clojure projects. Should I warn the user that the purl namespace 'clojars' isn't widely supported by tools like Dependency-Track?",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**CLOJURE**: Looking for Clojure projects. Should I warn the user that the purl namespace 'clojars' isn't widely supported by tools like Dependency-Track?",
+        );
+      }
       bomData = createClojureBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -7025,7 +7229,11 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "github"], options)) {
-      thoughtLog("**GITHUB**: Looking for any github packages and workflows.");
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**GITHUB**: Looking for any github packages and workflows.",
+        );
+      }
       bomData = createGitHubBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -7050,9 +7258,11 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "cloudbuild"], options)) {
-      thoughtLog(
-        "**CLOUDBUILD**: Let's check for CloudBuild configuration files that include package dependencies.",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**CLOUDBUILD**: Let's check for CloudBuild configuration files that include package dependencies.",
+        );
+      }
       bomData = createCloudBuildBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -7077,9 +7287,11 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "swift"], options)) {
-      thoughtLog(
-        "**SWIFT**: Now checking for Swift projects. We don't support CocoaPods, Objective-C, or pure Xcode projects, so the SBOM will be incomplete.",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**SWIFT**: Now checking for Swift projects. We don't support CocoaPods, Objective-C, or pure Xcode projects, so the SBOM will be incomplete.",
+        );
+      }
       bomData = await createSwiftBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -7104,9 +7316,11 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     if (hasAnyProjectType(["oci", "jar", "war", "ear"], options)) {
-      thoughtLog(
-        "**JAR**: Let's check for any bundled jar/war/ear files to improve the SBOM accuracy.",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**JAR**: Let's check for any bundled jar/war/ear files to improve the SBOM accuracy.",
+        );
+      }
       bomData = await createJarBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -7150,9 +7364,11 @@ export async function createMultiXBom(pathList, options) {
     }
     // Collect any crypto keys
     if (options.specVersion >= 1.6 && options.includeCrypto) {
-      thoughtLog(
-        "**CBOM**: Wait, the user wants me to look for cryptographic assets. Let's check thoroughly.",
-      );
+      if (!hasAnyProjectType(["oci"], options, false)) {
+        thoughtLog(
+          "**CBOM**: Wait, the user wants me to look for cryptographic assets. Let's check thoroughly.",
+        );
+      }
       bomData = await createCryptoCertsBom(path, options);
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
@@ -7195,7 +7411,9 @@ export async function createMultiXBom(pathList, options) {
   }
   // Retain the components of parent component
   if (parentSubComponents.length) {
-    thoughtLog("**METADATA**: Tweaking the parent component hierarchy.");
+    if (!hasAnyProjectType(["oci"], options, false)) {
+      thoughtLog("**METADATA**: Tweaking the parent component hierarchy.");
+    }
     if (!parentComponent || !Object.keys(parentComponent).length) {
       parentComponent = parentSubComponents[0];
     }
@@ -7701,6 +7919,9 @@ export async function createBom(path, options) {
     }
     // Pass the entire export data about the image layers
     options.exportData = exportData;
+    if (exportData?.binPaths) {
+      options.binPaths = exportData.binPaths;
+    }
     options.lastWorkingDir = exportData?.lastWorkingDir;
     options.allLayersExplodedDir = exportData?.allLayersExplodedDir;
     return await createMultiXBom(