@cyclonedx/cdxgen 8.6.0 → 9.0.1

package/README.md

@@ -2,46 +2,45 @@
 
 ![cdxgen logo](cdxgen.png)
 
-This tool creates a valid and compliant [CycloneDX][cyclonedx-homepage] Software Bill-of-Materials (SBOM) containing an aggregate of all project dependencies for c/c++, node.js, php, python, ruby, rust, java, .Net, dart, haskell, elixir, and Go projects in XML and JSON format. CycloneDX 1.4 is a lightweight SBOM specification that is easily created, human and machine-readable, and simple to parse.
+This tool creates a valid and compliant [CycloneDX][cyclonedx-homepage] Software Bill-of-Materials (SBOM) containing an aggregate of all project dependencies for c/c++, node.js, php, python, ruby, rust, java, .Net, dart, haskell, elixir, and Go projects in XML and JSON format. CycloneDX 1.5 is a lightweight SBOM specification that is easily created, human and machine-readable, and simple to parse.
 
 When used with plugins, cdxgen could generate an SBoM for Linux docker images and even VMs running Linux or Windows operating system.
 
 ## Supported languages and package format
 
-| Language/Platform                                      | Package format                                                                                          | Transitive dependencies                                                                           |
-| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
-| node.js                                                | npm-shrinkwrap.json, package-lock.json, pnpm-lock.yaml, yarn.lock, rush.js, bower.json, .min.js         | Yes except .min.js                                                                                |
-| java                                                   | maven (pom.xml [1]), gradle (build.gradle, .kts), scala (sbt), bazel                                    | Yes unless pom.xml is manually parsed due to unavailability of maven or errors                    |
-| php                                                    | composer.lock                                                                                           | Yes                                                                                               |
-| python                                                 | pyproject.toml, setup.py, requirements.txt [2], Pipfile.lock, poetry.lock, bdist_wheel, .whl, .egg-info | Yes using the automatic pip install/freeze. When disabled, only with Pipfile.lock and poetry.lock |
-| go                                                     | binary, go.mod, go.sum, Gopkg.lock                                                                      | Yes except binary                                                                                 |
-| ruby                                                   | Gemfile.lock, gemspec                                                                                   | Only for Gemfile.lock                                                                             |
-| rust                                                   | binary, Cargo.toml, Cargo.lock                                                                          | Only for Cargo.lock                                                                               |
-| .Net                                                   | .csproj, packages.config, project.assets.json [3], packages.lock.json, .nupkg                           | Only for project.assets.json, packages.lock.json                                                  |
-| dart                                                   | pubspec.lock, pubspec.yaml                                                                              | Only for pubspec.lock                                                                             |
-| haskell                                                | cabal.project.freeze                                                                                    | Yes                                                                                               |
-| elixir                                                 | mix.lock                                                                                                | Yes                                                                                               |
-| c/c++                                                  | conan.lock, conanfile.txt                                                                               | Yes only for conan.lock                                                                           |
-| clojure                                                | Clojure CLI (deps.edn), Leiningen (project.clj)                                                         | Yes unless the files are parsed manually due to lack of clojure cli or leiningen command          |
-| swift                                                  | Package.resolved, Package.swift (swiftpm)                                                               | Yes                                                                                               |
-| docker / oci image                                     | All supported languages. Linux OS packages with plugins [4]                                             | Best effort based on lock files                                                                   |
-| GitHub Actions                                         | .github/workflows/\*.yml                                                                                | N/A                                                                                               |
-| Linux                                                  | All supported languages. Linux OS packages with plugins [5]                                             | Best effort based on lock files                                                                   |
-| Windows                                                | All supported languages. OS packages with best effort [5]                                               | Best effort based on lock files                                                                   |
-| Jenkins Plugins                                        | .hpi files                                                                                              |                                                                                                   |
-| Helm Charts                                            | .yaml                                                                                                   | N/A                                                                                               |
-| Skaffold                                               | .yaml                                                                                                   | N/A                                                                                               |
-| kustomization                                          | .yaml                                                                                                   | N/A                                                                                               |
-| Tekton tasks                                           | .yaml                                                                                                   | N/A                                                                                               |
-| Kubernetes                                             | .yaml                                                                                                   | N/A                                                                                               |
-| Maven Cache                                            | $HOME/.m2/repository/\*\*/\*.jar                                                                        | N/A                                                                                               |
-| SBT Cache                                              | $HOME/.ivy2/cache/\*\*/\*.jar                                                                           | N/A                                                                                               |
-| Gradle Cache                                           | $HOME/caches/modules-2/files-2.1/\*\*/\*.jar                                                            | N/A                                                                                               |
-| Helm Index                                             | $HOME/.cache/helm/repository/\*\*/\*.yaml                                                               | N/A                                                                                               |
-| Docker compose                                         | docker-compose\*.yml. Images would also be scanned.                                                     | N/A                                                                                               |
-| Google CloudBuild configuration                        | cloudbuild.yaml                                                                                         | N/A                                                                                               |
-| OpenAPI                                                | openapi\*.json, openapi\*.yaml                                                                          | N/A                                                                                               |
-| [Privado](https://www.privado.ai?utm_source=cyclonedx) | privado.json                                                                                            | Data and service information will be included. Use with universal mode.                           |
+| Language/Platform               | Package format                                                                                          | Transitive dependencies                                                                           |
+| ------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
+| node.js                         | npm-shrinkwrap.json, package-lock.json, pnpm-lock.yaml, yarn.lock, rush.js, bower.json, .min.js         | Yes except .min.js                                                                                |
+| java                            | maven (pom.xml [1]), gradle (build.gradle, .kts), scala (sbt), bazel                                    | Yes unless pom.xml is manually parsed due to unavailability of maven or errors                    |
+| php                             | composer.lock                                                                                           | Yes                                                                                               |
+| python                          | pyproject.toml, setup.py, requirements.txt [2], Pipfile.lock, poetry.lock, bdist_wheel, .whl, .egg-info | Yes using the automatic pip install/freeze. When disabled, only with Pipfile.lock and poetry.lock |
+| go                              | binary, go.mod, go.sum, Gopkg.lock                                                                      | Yes except binary                                                                                 |
+| ruby                            | Gemfile.lock, gemspec                                                                                   | Only for Gemfile.lock                                                                             |
+| rust                            | binary, Cargo.toml, Cargo.lock                                                                          | Only for Cargo.lock                                                                               |
+| .Net                            | .csproj, packages.config, project.assets.json [3], packages.lock.json, .nupkg                           | Only for project.assets.json, packages.lock.json                                                  |
+| dart                            | pubspec.lock, pubspec.yaml                                                                              | Only for pubspec.lock                                                                             |
+| haskell                         | cabal.project.freeze                                                                                    | Yes                                                                                               |
+| elixir                          | mix.lock                                                                                                | Yes                                                                                               |
+| c/c++                           | conan.lock, conanfile.txt                                                                               | Yes only for conan.lock                                                                           |
+| clojure                         | Clojure CLI (deps.edn), Leiningen (project.clj)                                                         | Yes unless the files are parsed manually due to lack of clojure cli or leiningen command          |
+| swift                           | Package.resolved, Package.swift (swiftpm)                                                               | Yes                                                                                               |
+| docker / oci image              | All supported languages. Linux OS packages with plugins [4]                                             | Best effort based on lock files                                                                   |
+| GitHub Actions                  | .github/workflows/\*.yml                                                                                | N/A                                                                                               |
+| Linux                           | All supported languages. Linux OS packages with plugins [5]                                             | Best effort based on lock files                                                                   |
+| Windows                         | All supported languages. OS packages with best effort [5]                                               | Best effort based on lock files                                                                   |
+| Jenkins Plugins                 | .hpi files                                                                                              |                                                                                                   |
+| Helm Charts                     | .yaml                                                                                                   | N/A                                                                                               |
+| Skaffold                        | .yaml                                                                                                   | N/A                                                                                               |
+| kustomization                   | .yaml                                                                                                   | N/A                                                                                               |
+| Tekton tasks                    | .yaml                                                                                                   | N/A                                                                                               |
+| Kubernetes                      | .yaml                                                                                                   | N/A                                                                                               |
+| Maven Cache                     | $HOME/.m2/repository/\*\*/\*.jar                                                                        | N/A                                                                                               |
+| SBT Cache                       | $HOME/.ivy2/cache/\*\*/\*.jar                                                                           | N/A                                                                                               |
+| Gradle Cache                    | $HOME/caches/modules-2/files-2.1/\*\*/\*.jar                                                            | N/A                                                                                               |
+| Helm Index                      | $HOME/.cache/helm/repository/\*\*/\*.yaml                                                               | N/A                                                                                               |
+| Docker compose                  | docker-compose\*.yml. Images would also be scanned.                                                     | N/A                                                                                               |
+| Google CloudBuild configuration | cloudbuild.yaml                                                                                         | N/A                                                                                               |
+| OpenAPI                         | openapi\*.json, openapi\*.yaml                                                                          | N/A                                                                                               |
 
 NOTE:
 
@@ -133,10 +132,6 @@ Minimal example.
 cdxgen -o bom.json
 ```
 
-NOTE:
-
-cdxgen would always produce bom in both xml and json format as per CycloneDX 1.4 specification. json is the recommended format.
-
 For a java project. This would automatically detect maven, gradle or sbt and build bom accordingly
 
 ```shell
@@ -200,17 +195,6 @@ git clone https://github.com/cyclonedx/cdxgen.git
 docker compose up
 ```
 
-## Privado.ai support
-
-In universal mode, cdxgen can look for any [Privado](https://www.privado.ai?utm_source=cyclonedx) scan reports and enrich the SBoM with data (flow and classification), endpoints, and leakage information. Such an SBoM would help with privacy compliance and use cases.
-
-Invoke privado scan first to generate this report followed by an invocation of cdxgen in universal mode as shown.
-
-```shell
-privado scan --enable-javascript <directory>
-cdxgen -t universal <directory> -o bom.json
-```
-
 ## War file support
 
 cdxgen can generate a BoM file from a given war file.
@@ -362,6 +346,24 @@ Permission to modify and redistribute is granted under the terms of the Apache 2
 [license]: https://github.com/cyclonedx/cdxgen/blob/master/LICENSE
 [cyclonedx-homepage]: https://cyclonedx.org
 
+## Integration as library
+
+This project is [ESM only](https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c) and requires Node.js >= 16
+
+Minimal example:
+
+```javascript
+import { createBom, submitBom } from "@cyclonedx/cdxgen";
+// bomNSData would contain bomJson, bomXml
+const bomNSData = await createBom(filePath, options);
+// Submission to dependency track server
+const dbody = await submitBom(args, bomNSData.bomXml);
+```
+
+## Node.js >= 20 permission model
+
+Refer to the [permissions document](./docs/PERMISSIONS.md)
+
 ## Contributing
 
 Follow the usual PR process but prior to raising a PR run the following commands.

package/analyzer.js

@@ -1,8 +1,8 @@
-const babelParser = require("@babel/parser");
-const babelTraverse = require("@babel/traverse").default;
-const { join } = require("path");
-const fs = require("fs");
-const path = require("path");
+import { parse } from "@babel/parser";
+import babelTraverse from "@babel/traverse";
+import { join } from "path";
+import { readdirSync, statSync, readFileSync } from "fs";
+import { basename, resolve, isAbsolute } from "path";
 
 const IGNORE_DIRS = [
   "node_modules",
@@ -28,7 +28,7 @@ const IGNORE_FILE_PATTERN = new RegExp(
 );
 
 const getAllFiles = (dir, extn, files, result, regex) => {
-  files = files || fs.readdirSync(dir);
+  files = files || readdirSync(dir);
   result = result || [];
   regex = regex || new RegExp(`\\${extn}$`);
 
@@ -37,9 +37,9 @@ const getAllFiles = (dir, extn, files, result, regex) => {
       continue;
     }
     let file = join(dir, files[i]);
-    if (fs.statSync(file).isDirectory()) {
+    if (statSync(file).isDirectory()) {
       // Ignore directories
-      const dirName = path.basename(file);
+      const dirName = basename(file);
       if (
         dirName.startsWith(".") ||
         IGNORE_DIRS.includes(dirName.toLowerCase())
@@ -47,7 +47,7 @@ const getAllFiles = (dir, extn, files, result, regex) => {
         continue;
       }
       try {
-        result = getAllFiles(file, extn, fs.readdirSync(file), result, regex);
+        result = getAllFiles(file, extn, readdirSync(file), result, regex);
       } catch (error) {
         continue;
       }
@@ -95,11 +95,11 @@ const setFileRef = (allImports, file, pathway) => {
   // replace relative imports with full path
   let module = pathway;
   if (/\.\//g.test(pathway) || /\.\.\//g.test(pathway)) {
-    module = path.resolve(file, "..", pathway);
+    module = resolve(file, "..", pathway);
   }
 
   // initialise or increase reference count for file
-  if (allImports.hasOwnProperty(module)) {
+  if (Object.prototype.hasOwnProperty.call(allImports, module)) {
     allImports[module] = allImports[module] + 1;
   } else {
     allImports[module] = 1;
@@ -107,9 +107,9 @@ const setFileRef = (allImports, file, pathway) => {
 
   // Handle module package name
   // Eg: zone.js/dist/zone will be referred to as zone.js in package.json
-  if (!path.isAbsolute(module) && module.includes("/")) {
+  if (!isAbsolute(module) && module.includes("/")) {
     const modPkg = module.split("/")[0];
-    if (allImports.hasOwnProperty(modPkg)) {
+    if (Object.prototype.hasOwnProperty.call(allImports, modPkg)) {
       allImports[modPkg] = allImports[modPkg] + 1;
     } else {
       allImports[modPkg] = 1;
@@ -122,10 +122,7 @@ const setFileRef = (allImports, file, pathway) => {
  * references for any import, require or dynamic import files.
  */
 const parseFileASTTree = (file, allImports) => {
-  const ast = babelParser.parse(
-    fs.readFileSync(file, "utf-8"),
-    babelParserOptions
-  );
+  const ast = parse(readFileSync(file, "utf-8"), babelParserOptions);
   babelTraverse(ast, {
     // Used for all ES6 import statements
     ImportDeclaration: (path) => {
@@ -177,7 +174,7 @@ const getAllSrcJSAndTSFiles = (src) =>
 /**
  * Where Node CLI runs from.
  */
-const findJSImports = async (src) => {
+export const findJSImports = async (src) => {
   const allImports = {};
   const errFiles = [];
   try {
@@ -195,4 +192,3 @@ const findJSImports = async (src) => {
     return allImports;
   }
 };
-exports.findJSImports = findJSImports;

package/bin/{cdxgen → cdxgen.js}

@@ -1,13 +1,27 @@
 #!/usr/bin/env node
 
-const bom = require("../index.js");
-const fs = require("fs");
-const path = require("path");
-const jws = require("jws");
-const crypto = require("crypto");
-const bomServer = require("../server.js");
+import { createBom, submitBom } from "../index.js";
+import fs from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import jws from "jws";
+import crypto from "crypto";
+import { start as _serverStart } from "../server.js";
+import { fileURLToPath } from "node:url";
+import globalAgent from "global-agent";
+import { table } from "table";
+import process from "node:process";
 
-const args = require("yargs")
+let url = import.meta.url;
+if (!url.startsWith("file://")) {
+  url = new URL(`file://${import.meta.url}`).toString();
+}
+const dirName = import.meta ? dirname(fileURLToPath(url)) : __dirname;
+
+import yargs from "yargs";
+import { hideBin } from "yargs/helpers";
+
+const args = yargs(hideBin(process.argv))
   .option("output", {
     alias: "o",
     description: "Output file for bom.xml or bom.json. Default bom.json"
@@ -99,7 +113,7 @@ const args = require("yargs")
 
 if (args.version) {
   const packageJsonAsString = fs.readFileSync(
-    path.join(__dirname, "../", "package.json"),
+    join(dirName, "..", "package.json"),
     "utf-8"
   );
   const packageJson = JSON.parse(packageJsonAsString);
@@ -113,16 +127,15 @@ if (process.env.GLOBAL_AGENT_HTTP_PROXY || process.env.HTTP_PROXY) {
   if (!process.env.GLOBAL_AGENT_ENVIRONMENT_VARIABLE_NAMESPACE) {
     process.env.GLOBAL_AGENT_ENVIRONMENT_VARIABLE_NAMESPACE = "";
   }
-  const globalAgent = require("global-agent");
   globalAgent.bootstrap();
 }
 
 let filePath = args._[0] || ".";
 if (!args.projectName) {
   if (filePath !== ".") {
-    args.projectName = path.basename(filePath);
+    args.projectName = basename(filePath);
   } else {
-    args.projectName = path.basename(path.resolve(filePath));
+    args.projectName = basename(resolve(filePath));
   }
 }
 
@@ -150,15 +163,51 @@ let options = {
   serverPort: args.serverPort
 };
 
+/**
+ * Check for node >= 20 permissions
+ *
+ * @param {string} filePath File path
+ * @returns
+ */
+const checkPermissions = (filePath) => {
+  if (!process.permission) {
+    return true;
+  }
+  if (!process.permission.has("fs.read", filePath)) {
+    console.log(
+      `FileSystemRead permission required. Please invoke with the argument --allow-fs-read="${resolve(
+        filePath
+      )}"`
+    );
+    return false;
+  }
+  if (!process.permission.has("fs.write", tmpdir())) {
+    console.log(
+      `FileSystemWrite permission required. Please invoke with the argument --allow-fs-write="${tmpdir()}"`
+    );
+    return false;
+  }
+  if (!process.permission.has("child")) {
+    console.log(
+      "ChildProcess permission is missing. This is required to spawn commands for some languages. Please invoke with the argument --allow-child-process"
+    );
+  }
+  return true;
+};
+
 /**
  * Method to start the bom creation process
  */
 (async () => {
   // Start SBoM server
   if (args.server) {
-    return await bomServer.start(options);
+    return await _serverStart(options);
+  }
+  // Check if cdxgen has the required permissions
+  if (!checkPermissions(filePath)) {
+    return;
   }
-  const bomNSData = (await bom.createBom(filePath, options)) || {};
+  const bomNSData = (await createBom(filePath, options)) || {};
   if (!args.output) {
     args.output = "bom.json";
     args.print = true;
@@ -172,7 +221,7 @@ let options = {
     } else {
       const jsonFile = args.output.replace(".xml", ".json");
       // Create bom json file
-      if (bomNSData.bomJson) {
+      if (!args.output.endsWith(".xml") && bomNSData.bomJson) {
         let jsonPayload = undefined;
         if (
           typeof bomNSData.bomJson === "string" ||
@@ -199,9 +248,9 @@ let options = {
           let privateKeyToUse = undefined;
           let jwkPublicKey = undefined;
           if (args.generateKeyAndSign) {
-            const dirName = path.dirname(jsonFile);
-            const publicKeyFile = path.join(dirName, "public.key");
-            const privateKeyFile = path.join(dirName, "private.key");
+            const jdirName = dirname(jsonFile);
+            const publicKeyFile = join(jdirName, "public.key");
+            const privateKeyFile = join(jdirName, "private.key");
             const { privateKey, publicKey } = crypto.generateKeyPairSync(
               "rsa",
               {
@@ -271,9 +320,8 @@ let options = {
         }
       }
       // Create bom xml file
-      if (bomNSData.bomXml) {
-        const xmlFile = args.output.replace(".json", ".xml");
-        fs.writeFileSync(xmlFile, bomNSData.bomXml);
+      if (args.output.endsWith(".xml") && bomNSData.bomXml) {
+        fs.writeFileSync(args.output, bomNSData.bomXml);
       }
       //
       if (bomNSData.nsMapping && Object.keys(bomNSData.nsMapping).length) {
@@ -296,8 +344,7 @@ let options = {
   // Automatically submit the bom data
   if (args.serverUrl && args.serverUrl != true && args.apiKey) {
     try {
-      // TODO: Need to use json format for v9
-      const dbody = await bom.submitBom(args, bomNSData.bomXml);
+      const dbody = await submitBom(args, bomNSData.bomJson);
       console.log("Response from server", dbody);
     } catch (err) {
       console.log(err);
@@ -305,7 +352,6 @@ let options = {
   }
 
   if (args.print && bomNSData.bomJson && bomNSData.bomJson.components) {
-    const { table } = require("table");
     const data = [["Group", "Name", "Version", "Scope"]];
     for (let comp of bomNSData.bomJson.components) {
       data.push([comp.group || "", comp.name, comp.version, comp.scope || ""]);

package/binary.js

@@ -1,9 +1,19 @@
-const os = require("os");
-const fs = require("fs");
-const path = require("path");
-const { spawnSync } = require("child_process");
-const { PackageURL } = require("packageurl-js");
-const isWin = require("os").platform() === "win32";
+import { platform as _platform, arch as _arch, tmpdir } from "node:os";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { join, dirname, basename } from "node:path";
+import { spawnSync } from "node:child_process";
+import { PackageURL } from "packageurl-js";
+
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+let url = import.meta.url;
+if (!url.startsWith("file://")) {
+  url = new URL(`file://${import.meta.url}`).toString();
+}
+const dirName = import.meta ? path.dirname(fileURLToPath(url)) : __dirname;
+
+const isWin = _platform() === "win32";
 
 // Debug mode flag
 const DEBUG_MODE =
@@ -12,14 +22,14 @@ const DEBUG_MODE =
   process.env.SHIFTLEFT_LOGGING_LEVEL === "debug" ||
   process.env.NODE_ENV === "development";
 
-let platform = os.platform();
+let platform = _platform();
 let extn = "";
 if (platform == "win32") {
   platform = "windows";
   extn = ".exe";
 }
 
-let arch = os.arch();
+let arch = _arch();
 switch (arch) {
   case "x32":
     arch = "386";
@@ -34,26 +44,20 @@ let CDXGEN_PLUGINS_DIR = process.env.CDXGEN_PLUGINS_DIR;
 // Is there a non-empty local plugins directory
 if (
   !CDXGEN_PLUGINS_DIR &&
-  fs.existsSync(path.join(__dirname, "plugins")) &&
-  fs.existsSync(path.join(__dirname, "plugins", "goversion"))
+  existsSync(join(dirName, "plugins")) &&
+  existsSync(join(dirName, "plugins", "goversion"))
 ) {
-  CDXGEN_PLUGINS_DIR = path.join(__dirname, "plugins");
+  CDXGEN_PLUGINS_DIR = join(dirName, "plugins");
 }
 // Is there a non-empty local node_modules directory
 if (
   !CDXGEN_PLUGINS_DIR &&
-  fs.existsSync(
-    path.join(
-      __dirname,
-      "node_modules",
-      "@cyclonedx",
-      "cdxgen-plugins-bin",
-      "plugins"
-    )
+  existsSync(
+    join(dirName, "node_modules", "@cyclonedx", "cdxgen-plugins-bin", "plugins")
   ) &&
-  fs.existsSync(
-    path.join(
-      __dirname,
+  existsSync(
+    join(
+      dirName,
       "node_modules",
       "@cyclonedx",
       "cdxgen-plugins-bin",
@@ -62,8 +66,8 @@ if (
     )
   )
 ) {
-  CDXGEN_PLUGINS_DIR = path.join(
-    __dirname,
+  CDXGEN_PLUGINS_DIR = join(
+    dirName,
     "node_modules",
     "@cyclonedx",
     "cdxgen-plugins-bin",
@@ -88,13 +92,13 @@ if (!CDXGEN_PLUGINS_DIR) {
       }
     }
   }
-  const globalPlugins = path.join(
+  const globalPlugins = join(
     globalNodePath,
     "@cyclonedx",
     "cdxgen-plugins-bin",
     "plugins"
   );
-  if (fs.existsSync(globalPlugins)) {
+  if (existsSync(globalPlugins)) {
     CDXGEN_PLUGINS_DIR = globalPlugins;
     if (DEBUG_MODE) {
       console.log("Found global plugins", CDXGEN_PLUGINS_DIR);
@@ -111,16 +115,16 @@ if (!CDXGEN_PLUGINS_DIR) {
   CDXGEN_PLUGINS_DIR = "";
 }
 let GOVERSION_BIN = null;
-if (fs.existsSync(path.join(CDXGEN_PLUGINS_DIR, "goversion"))) {
-  GOVERSION_BIN = path.join(
+if (existsSync(join(CDXGEN_PLUGINS_DIR, "goversion"))) {
+  GOVERSION_BIN = join(
     CDXGEN_PLUGINS_DIR,
     "goversion",
     "goversion-" + platform + "-" + arch + extn
   );
 }
 let TRIVY_BIN = null;
-if (fs.existsSync(path.join(CDXGEN_PLUGINS_DIR, "trivy"))) {
-  TRIVY_BIN = path.join(
+if (existsSync(join(CDXGEN_PLUGINS_DIR, "trivy"))) {
+  TRIVY_BIN = join(
     CDXGEN_PLUGINS_DIR,
     "trivy",
     "trivy-cdxgen-" + platform + "-" + arch + extn
@@ -129,8 +133,8 @@ if (fs.existsSync(path.join(CDXGEN_PLUGINS_DIR, "trivy"))) {
   TRIVY_BIN = process.env.TRIVY_CMD;
 }
 let CARGO_AUDITABLE_BIN = null;
-if (fs.existsSync(path.join(CDXGEN_PLUGINS_DIR, "cargo-auditable"))) {
-  CARGO_AUDITABLE_BIN = path.join(
+if (existsSync(join(CDXGEN_PLUGINS_DIR, "cargo-auditable"))) {
+  CARGO_AUDITABLE_BIN = join(
     CDXGEN_PLUGINS_DIR,
     "cargo-auditable",
     "cargo-auditable-cdxgen-" + platform + "-" + arch + extn
@@ -139,8 +143,8 @@ if (fs.existsSync(path.join(CDXGEN_PLUGINS_DIR, "cargo-auditable"))) {
   CARGO_AUDITABLE_BIN = process.env.CARGO_AUDITABLE_CMD;
 }
 let OSQUERY_BIN = null;
-if (fs.existsSync(path.join(CDXGEN_PLUGINS_DIR, "osquery"))) {
-  OSQUERY_BIN = path.join(
+if (existsSync(join(CDXGEN_PLUGINS_DIR, "osquery"))) {
+  OSQUERY_BIN = join(
     CDXGEN_PLUGINS_DIR,
     "osquery",
     "osqueryi-" + platform + "-" + arch + extn
@@ -213,7 +217,7 @@ const OS_DISTRO_ALIAS = {
   "debian-1.1": "buzz"
 };
 
-const getGoBuildInfo = (src) => {
+export const getGoBuildInfo = (src) => {
   if (GOVERSION_BIN) {
     let result = spawnSync(GOVERSION_BIN, [src], {
       encoding: "utf-8"
@@ -244,9 +248,8 @@ const getGoBuildInfo = (src) => {
   }
   return undefined;
 };
-exports.getGoBuildInfo = getGoBuildInfo;
 
-const getCargoAuditableInfo = (src) => {
+export const getCargoAuditableInfo = (src) => {
   if (CARGO_AUDITABLE_BIN) {
     let result = spawnSync(CARGO_AUDITABLE_BIN, [src], {
       encoding: "utf-8"
@@ -266,18 +269,17 @@ const getCargoAuditableInfo = (src) => {
   }
   return undefined;
 };
-exports.getCargoAuditableInfo = getCargoAuditableInfo;
 
-const getOSPackages = (src) => {
+export const getOSPackages = (src) => {
   const pkgList = [];
   const allTypes = new Set();
   if (TRIVY_BIN) {
     let imageType = "image";
-    if (fs.existsSync(src)) {
+    if (existsSync(src)) {
       imageType = "rootfs";
     }
-    let tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "trivy-cdxgen-"));
-    const bomJsonFile = path.join(tempDir, "trivy-bom.json");
+    let tempDir = mkdtempSync(join(tmpdir(), "trivy-cdxgen-"));
+    const bomJsonFile = join(tempDir, "trivy-bom.json");
     const args = [
       imageType,
       "--skip-db-update",
@@ -305,11 +307,11 @@ const getOSPackages = (src) => {
         console.error(result.stdout, result.stderr);
       }
     }
-    if (fs.existsSync(bomJsonFile)) {
+    if (existsSync(bomJsonFile)) {
       let tmpBom = {};
       try {
         tmpBom = JSON.parse(
-          fs.readFileSync(bomJsonFile, {
+          readFileSync(bomJsonFile, {
             encoding: "utf-8"
           })
         );
@@ -317,12 +319,12 @@ const getOSPackages = (src) => {
         // ignore errors
       }
       // Clean up
-      if (tempDir && tempDir.startsWith(os.tmpdir())) {
+      if (tempDir && tempDir.startsWith(tmpdir())) {
         if (DEBUG_MODE) {
           console.log(`Cleaning up ${tempDir}`);
         }
-        if (fs.rmSync) {
-          fs.rmSync(tempDir, { recursive: true, force: true });
+        if (rmSync) {
+          rmSync(tempDir, { recursive: true, force: true });
         }
       }
       if (tmpBom && tmpBom.components) {
@@ -347,8 +349,8 @@ const getOSPackages = (src) => {
               continue;
             }
             // Fix the group
-            let group = path.dirname(comp.name);
-            let name = path.basename(comp.name);
+            let group = dirname(comp.name);
+            let name = basename(comp.name);
             let purlObj = undefined;
             let distro_codename = "";
             if (group === ".") {
@@ -483,9 +485,8 @@ const getOSPackages = (src) => {
   }
   return { osPackages: pkgList, allTypes: Array.from(allTypes) };
 };
-exports.getOSPackages = getOSPackages;
 
-const executeOsQuery = (query) => {
+export const executeOsQuery = (query) => {
   if (OSQUERY_BIN) {
     if (!query.endsWith(";")) {
       query = query + ";";
@@ -515,4 +516,3 @@ const executeOsQuery = (query) => {
   }
   return undefined;
 };
-exports.executeOsQuery = executeOsQuery;