@cyclonedx/cdxgen 9.0.1 → 9.1.0

package/index.js

@@ -1,7 +1,10 @@
+import Ajv from "ajv";
+import addFormats from "ajv-formats";
 import { platform as _platform, homedir, tmpdir } from "node:os";
-import { join, dirname, sep } from "node:path";
+import { basename, join, dirname, sep } from "node:path";
 import { parse } from "ssri";
 import {
+  lstatSync,
   mkdtempSync,
   rmSync,
   existsSync,
@@ -50,7 +53,7 @@ import {
   parseBdistMetadata,
   readZipEntry,
   parsePiplockData,
-  executePipFreezeInVenv,
+  getPipFrozenTree,
   parseReqFile,
   getPyModules,
   parseSetupPyFile,
@@ -148,7 +151,7 @@ if (process.env.SWIFT_CMD) {
 }
 
 // Construct sbt cache directory
-let SBT_CACHE_DIR =
+const SBT_CACHE_DIR =
   process.env.SBT_CACHE_DIR || join(homedir(), ".ivy2", "cache");
 
 // Debug mode flag
@@ -167,7 +170,10 @@ const TIMEOUT_MS = parseInt(process.env.CDXGEN_TIMEOUT_MS) || 10 * 60 * 1000;
 
 const createDefaultParentComponent = (path) => {
   // Create a parent component based on the directory name
-  let dirName = dirname(path);
+  let dirName =
+    existsSync(path) && lstatSync(path).isDirectory()
+      ? basename(path)
+      : dirname(path);
   const tmpA = dirName.split(sep);
   dirName = tmpA[tmpA.length - 1];
   const parentComponent = {
@@ -206,55 +212,14 @@ const determineParentComponent = (options) => {
   return parentComponent;
 };
 
-/**
- * Method to create global external references
- *
- * @param pkg
- * @returns {Array}
- */
-function addGlobalReferences(src, filename, format = "xml") {
-  let externalReferences = [];
-  if (format === "json") {
-    externalReferences.push({
-      type: "other",
-      url: src,
-      comment: "Base path"
-    });
-  } else {
-    externalReferences.push({
-      reference: { "@type": "other", url: src, comment: "Base path" }
-    });
-  }
-  let packageFileMeta = filename;
-  if (!filename.includes(src)) {
-    packageFileMeta = join(src, filename);
-  }
-  if (format === "json") {
-    externalReferences.push({
-      type: "other",
-      url: packageFileMeta,
-      comment: "Package file"
-    });
-  } else {
-    externalReferences.push({
-      reference: {
-        "@type": "other",
-        url: packageFileMeta,
-        comment: "Package file"
-      }
-    });
-  }
-  return externalReferences;
-}
-
 /**
  * Function to create the services block
  */
 function addServices(services, format = "xml") {
-  let serv_list = [];
+  const serv_list = [];
   for (const aserv of services) {
     if (format === "xml") {
-      let service = {
+      const service = {
         "@bom-ref": aserv["bom-ref"],
         group: aserv.group || "",
         name: aserv.name,
@@ -276,9 +241,9 @@ function addServices(services, format = "xml") {
  * Function to create the dependency block
  */
 function addDependencies(dependencies) {
-  let deps_list = [];
+  const deps_list = [];
   for (const adep of dependencies) {
-    let dependsOnList = adep.dependsOn.map((v) => ({
+    const dependsOnList = adep.dependsOn.map((v) => ({
       "@ref": v
     }));
     const aentry = {
@@ -299,7 +264,7 @@ function addDependencies(dependencies) {
 function addMetadata(parentComponent = {}, format = "xml", options = {}) {
   // DO NOT fork this project to just change the vendor or author's name
   // Try to contribute to this project by sending PR or filing issues
-  let metadata = {
+  const metadata = {
     timestamp: new Date().toISOString(),
     tools: {
       components: [
@@ -359,11 +324,17 @@ function addMetadata(parentComponent = {}, format = "xml", options = {}) {
         if (parentComponent && parentComponent.components) {
           firstPComp.components = parentComponent.components;
         }
+        if (firstPComp.evidence) {
+          delete firstPComp.evidence;
+        }
         metadata.component = firstPComp;
       }
     } else {
       // As a fallback, retain the parent component
       if (format === "json") {
+        if (parentComponent.evidence) {
+          delete parentComponent.evidence;
+        }
         metadata.component = parentComponent;
       }
     }
@@ -508,7 +479,7 @@ function addMetadata(parentComponent = {}, format = "xml", options = {}) {
  * @returns {Array}
  */
 function addExternalReferences(opkg, format = "xml") {
-  let externalReferences = [];
+  const externalReferences = [];
   let pkgList = [];
   if (Array.isArray(opkg)) {
     pkgList = opkg;
@@ -549,7 +520,7 @@ function addExternalReferences(opkg, format = "xml") {
       } else {
         if (pkg.homepage && pkg.homepage.url) {
           externalReferences.push({
-            type: "website",
+            type: pkg.homepage.url.includes("git") ? "vcs" : "website",
             url: pkg.homepage.url
           });
         }
@@ -575,17 +546,15 @@ function addExternalReferences(opkg, format = "xml") {
  * For all modules in the specified package, creates a list of
  * component objects from each one.
  */
-const _listComponents = listComponents;
-export { _listComponents as listComponents };
-function listComponents(
+export function listComponents(
   options,
   allImports,
   pkg,
   ptype = "npm",
   format = "xml"
 ) {
-  let compMap = {};
-  let isRootPkg = ptype === "npm";
+  const compMap = {};
+  const isRootPkg = ptype === "npm";
   if (Array.isArray(pkg)) {
     pkg.forEach((p) => {
       addComponent(options, allImports, p, ptype, compMap, false, format);
@@ -616,13 +585,13 @@ function addComponent(
     return;
   }
   if (!isRootPkg) {
-    let pkgIdentifier = parsePackageJsonName(pkg.name);
-    let author = pkg.author || "";
-    let publisher = pkg.publisher || "";
+    const pkgIdentifier = parsePackageJsonName(pkg.name);
+    const author = pkg.author || "";
+    const publisher = pkg.publisher || "";
     let group = pkg.group || pkgIdentifier.scope;
     // Create empty group
     group = group || "";
-    let name = pkgIdentifier.fullName || pkg.name || "";
+    const name = pkgIdentifier.fullName || pkg.name || "";
     // name is mandatory
     if (!name) {
       return;
@@ -640,13 +609,13 @@ function addComponent(
     ) {
       return;
     }
-    let version = pkg.version;
+    const version = pkg.version;
     if (!version || ["dummy", "ignore"].includes(version)) {
       return;
     }
-    let licenses = pkg.licenses || getLicenses(pkg, format);
+    const licenses = pkg.licenses || getLicenses(pkg, format);
 
-    let purl =
+    const purl =
       pkg.purl ||
       new PackageURL(
         ptype,
@@ -680,7 +649,7 @@ function addComponent(
     if (options.requiredOnly && ["optional", "excluded"].includes(compScope)) {
       return;
     }
-    let component = {
+    const component = {
       author,
       publisher,
       group,
@@ -709,8 +678,14 @@ function addComponent(
 
     processHashes(pkg, component, format);
     // Retain any component properties
-    if (format === "json" && pkg.properties && pkg.properties.length) {
-      component.properties = pkg.properties;
+    if (format === "json") {
+      // Retain evidence
+      if (pkg.evidence && Object.keys(pkg.evidence).length) {
+        component.evidence = pkg.evidence;
+      }
+      if (pkg.properties && pkg.properties.length) {
+        component.properties = pkg.properties;
+      }
     }
     if (compMap[component.purl]) return; //remove cycles
     compMap[component.purl] = component;
@@ -735,7 +710,7 @@ function determinePackageType(pkg) {
   }
   if (pkg.purl) {
     try {
-      let purl = PackageURL.fromString(pkg.purl);
+      const purl = PackageURL.fromString(pkg.purl);
       if (purl.type) {
         if (["docker", "oci", "container"].includes(purl.type)) {
           return "container";
@@ -801,7 +776,7 @@ function determinePackageType(pkg) {
     }
   }
   if (Object.prototype.hasOwnProperty.call(pkg, "keywords")) {
-    for (let keyword of pkg.keywords) {
+    for (const keyword of pkg.keywords) {
       if (keyword.toLowerCase() === "framework") {
         return "framework";
       }
@@ -832,7 +807,7 @@ function processHashes(pkg, component, format = "xml") {
       });
     }
   } else if (pkg._integrity) {
-    let integrity = parse(pkg._integrity) || {};
+    const integrity = parse(pkg._integrity) || {};
     // Components may have multiple hashes with various lengths. Check each one
     // that is supported by the CycloneDX specification.
     if (Object.prototype.hasOwnProperty.call(integrity, "sha512")) {
@@ -919,11 +894,6 @@ const buildBomXml = (
   bom.ele("metadata").ele(metadata);
   if (components && components.length) {
     bom.ele("components").ele(components);
-    if (context && context.src && context.filename) {
-      bom
-        .ele("externalReferences")
-        .ele(addGlobalReferences(context.src, context.filename, "xml"));
-    }
     if (context) {
       if (context.services && context.services.length) {
         bom.ele("services").ele(addServices(context.services, "xml"));
@@ -987,13 +957,6 @@ const buildBomNSData = (options, pkgInfo, ptype, context) => {
       components: listComponents(options, allImports, pkgInfo, ptype, "json"),
       dependencies
     };
-    if (context && context.src && context.filename) {
-      jsonTpl.externalReferences = addGlobalReferences(
-        context.src,
-        context.filename,
-        "json"
-      );
-    }
     bomNSData.bomXml = bomString;
     bomNSData.bomJson = jsonTpl;
     bomNSData.nsMapping = nsMapping;
@@ -1009,10 +972,7 @@ const buildBomNSData = (options, pkgInfo, ptype, context) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createJarBom = (path, options) => {
-  console.log(
-    `About to create SBoM for all jar files under ${path}. This would take a while ...`
-  );
+export const createJarBom = (path, options) => {
   let pkgList = [];
   let jarFiles = getAllFiles(
     path,
@@ -1026,8 +986,8 @@ const createJarBom = (path, options) => {
   if (hpiFiles.length) {
     jarFiles = jarFiles.concat(hpiFiles);
   }
-  let tempDir = mkdtempSync(join(tmpdir(), "jar-deps-"));
-  for (let jar of jarFiles) {
+  const tempDir = mkdtempSync(join(tmpdir(), "jar-deps-"));
+  for (const jar of jarFiles) {
     if (DEBUG_MODE) {
       console.log(`Parsing ${jar}`);
     }
@@ -1038,7 +998,6 @@ const createJarBom = (path, options) => {
   }
   // Clean up
   if (tempDir && tempDir.startsWith(tmpdir()) && rmSync) {
-    console.log(`Cleaning up ${tempDir}`);
     rmSync(tempDir, { recursive: true, force: true });
   }
   return buildBomNSData(options, pkgList, "maven", {
@@ -1054,7 +1013,7 @@ const createJarBom = (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createJavaBom = async (path, options) => {
+export const createJavaBom = async (path, options) => {
   let jarNSMapping = {};
   let pkgList = [];
   let dependencies = [];
@@ -1068,7 +1027,7 @@ const createJavaBom = async (path, options) => {
       if (DEBUG_MODE) {
         console.log(`Retrieving packages from ${path}`);
       }
-      let tempDir = mkdtempSync(join(tmpdir(), "war-deps-"));
+      const tempDir = mkdtempSync(join(tmpdir(), "war-deps-"));
       pkgList = extractJarArchive(path, tempDir);
       if (pkgList.length) {
         pkgList = await getMvnMetadata(pkgList);
@@ -1119,7 +1078,7 @@ const createJavaBom = async (path, options) => {
         const addArgs = process.env.MVN_ARGS.split(" ");
         mvnArgs = mvnArgs.concat(addArgs);
       }
-      for (let f of pomFiles) {
+      for (const f of pomFiles) {
         const basePath = dirname(f);
         const settingsXml = join(basePath, "settings.xml");
         if (existsSync(settingsXml)) {
@@ -1127,7 +1086,7 @@ const createJavaBom = async (path, options) => {
             `maven settings.xml found in ${basePath}. Please set the MVN_ARGS environment variable based on the full mvn build command used for this project.\nExample: MVN_ARGS='--settings ${settingsXml}'`
           );
         }
-        let mavenCmd = getMavenCommand(basePath, path);
+        const mavenCmd = getMavenCommand(basePath, path);
         // Should we attempt to resolve class names
         if (options.resolveClass) {
           console.log(
@@ -1150,8 +1109,8 @@ const createJavaBom = async (path, options) => {
         const bomJsonFiles = getAllFiles(path, "**/target/*.json");
         const bomGenerated = bomJsonFiles.length;
         if (!bomGenerated || result.status !== 0 || result.error) {
-          let tempDir = mkdtempSync(join(tmpdir(), "cdxmvn-"));
-          let tempMvnTree = join(tempDir, "mvn-tree.txt");
+          const tempDir = mkdtempSync(join(tmpdir(), "cdxmvn-"));
+          const tempMvnTree = join(tempDir, "mvn-tree.txt");
           let mvnTreeArgs = ["dependency:tree", "-DoutputFile=" + tempMvnTree];
           if (process.env.MVN_ARGS) {
             const addArgs = process.env.MVN_ARGS.split(" ");
@@ -1281,18 +1240,18 @@ const createJavaBom = async (path, options) => {
       }
     }
     // gradle
-    let gradleFiles = getAllFiles(
+    const gradleFiles = getAllFiles(
       path,
       (options.multiProject ? "**/" : "") + "build.gradle*"
     );
-    let allProjects = [];
+    const allProjects = [];
     const allProjectsAddedPurls = [];
     const rootDependsOn = [];
     // Execute gradle properties
     if (gradleFiles && gradleFiles.length) {
       let retMap = executeGradleProperties(path, null, null);
       const allProjectsStr = retMap.projects || [];
-      let rootProject = retMap.rootProject;
+      const rootProject = retMap.rootProject;
       if (rootProject) {
         parentComponent = {
           name: rootProject,
@@ -1314,11 +1273,11 @@ const createJavaBom = async (path, options) => {
       }
       // Get the sub-project properties and set the root dependencies
       if (allProjectsStr && allProjectsStr.length) {
-        for (let spstr of allProjectsStr) {
+        for (const spstr of allProjectsStr) {
           retMap = executeGradleProperties(path, null, spstr);
-          let rootSubProject = retMap.rootProject;
+          const rootSubProject = retMap.rootProject;
           if (rootSubProject) {
-            let rspName = rootSubProject.replace(/^:/, "").replace(/:/, "/");
+            const rspName = rootSubProject.replace(/^:/, "").replace(/:/, "/");
             const rootSubProjectObj = {
               name: rspName,
               type: "application",
@@ -1356,9 +1315,9 @@ const createJavaBom = async (path, options) => {
       }
     }
     if (gradleFiles && gradleFiles.length && options.installDeps) {
-      let gradleCmd = getGradleCommand(path, null);
+      const gradleCmd = getGradleCommand(path, null);
       allProjects.push(parentComponent);
-      for (let sp of allProjects) {
+      for (const sp of allProjects) {
         let gradleDepArgs = [
           sp.purl === parentComponent.purl
             ? "dependencies"
@@ -1452,13 +1411,13 @@ const createJavaBom = async (path, options) => {
 
     // Bazel
     // Look for the BUILD file only in the root directory
-    let bazelFiles = getAllFiles(path, "BUILD");
+    const bazelFiles = getAllFiles(path, "BUILD");
     if (bazelFiles && bazelFiles.length) {
       let BAZEL_CMD = "bazel";
       if (process.env.BAZEL_HOME) {
         BAZEL_CMD = join(process.env.BAZEL_HOME, "bin", "bazel");
       }
-      for (let f of bazelFiles) {
+      for (const f of bazelFiles) {
         const basePath = dirname(f);
         // Invoke bazel build first
         const bazelTarget = process.env.BAZEL_TARGET || ":all";
@@ -1500,7 +1459,7 @@ const createJavaBom = async (path, options) => {
             console.error(result.stdout, result.stderr);
             options.failOnError && process.exit(1);
           }
-          let stdout = result.stdout;
+          const stdout = result.stdout;
           if (stdout) {
             const cmdOutput = Buffer.from(stdout).toString();
             const dlist = parseBazelSkyframe(cmdOutput);
@@ -1545,7 +1504,7 @@ const createJavaBom = async (path, options) => {
     );
 
     let sbtProjects = [];
-    for (let i in sbtProjectFiles) {
+    for (const i in sbtProjectFiles) {
       // parent dir of sbtProjectFile is the `project` directory
       // parent dir of `project` is the sbt root project directory
       const baseDir = dirname(dirname(sbtProjectFiles[i]));
@@ -1558,7 +1517,7 @@ const createJavaBom = async (path, options) => {
         path,
         (options.multiProject ? "**/" : "") + "*.sbt"
       );
-      for (let i in sbtProjectFiles) {
+      for (const i in sbtProjectFiles) {
         const baseDir = dirname(sbtProjectFiles[i]);
         sbtProjects = sbtProjects.concat(baseDir);
       }
@@ -1566,7 +1525,7 @@ const createJavaBom = async (path, options) => {
 
     sbtProjects = [...new Set(sbtProjects)]; // eliminate duplicates
 
-    let sbtLockFiles = getAllFiles(
+    const sbtLockFiles = getAllFiles(
       path,
       (options.multiProject ? "**/" : "") + "build.sbt.lock"
     );
@@ -1575,15 +1534,15 @@ const createJavaBom = async (path, options) => {
       let pkgList = [];
       // If the project use sbt lock files
       if (sbtLockFiles && sbtLockFiles.length) {
-        for (let f of sbtLockFiles) {
+        for (const f of sbtLockFiles) {
           const dlist = parseSbtLock(f);
           if (dlist && dlist.length) {
             pkgList = pkgList.concat(dlist);
           }
         }
       } else {
-        let SBT_CMD = process.env.SBT_CMD || "sbt";
-        let sbtVersion = determineSbtVersion(path);
+        const SBT_CMD = process.env.SBT_CMD || "sbt";
+        const sbtVersion = determineSbtVersion(path);
         if (DEBUG_MODE) {
           console.log("Detected sbt version: " + sbtVersion);
         }
@@ -1596,11 +1555,11 @@ const createJavaBom = async (path, options) => {
         const useSlashSyntax = gte(sbtVersion, "1.5.0");
         const isDependencyTreeBuiltIn =
           sbtVersion != null && gte(sbtVersion, "1.4.0");
-        let tempDir = mkdtempSync(join(tmpdir(), "cdxsbt-"));
-        let tempSbtgDir = mkdtempSync(join(tmpdir(), "cdxsbtg-"));
+        const tempDir = mkdtempSync(join(tmpdir(), "cdxsbt-"));
+        const tempSbtgDir = mkdtempSync(join(tmpdir(), "cdxsbtg-"));
         mkdirSync(tempSbtgDir, { recursive: true });
         // Create temporary plugins file
-        let tempSbtPlugins = join(tempSbtgDir, "dep-plugins.sbt");
+        const tempSbtPlugins = join(tempSbtgDir, "dep-plugins.sbt");
 
         // Requires a custom version of `sbt-dependency-graph` that
         // supports `--append` for `toFile` subtask.
@@ -1613,9 +1572,9 @@ const createJavaBom = async (path, options) => {
         }
         writeFileSync(tempSbtPlugins, sbtPluginDefinition);
 
-        for (let i in sbtProjects) {
+        for (const i in sbtProjects) {
           const basePath = sbtProjects[i];
-          let dlFile = join(tempDir, "dl-" + i + ".tmp");
+          const dlFile = join(tempDir, "dl-" + i + ".tmp");
           console.log(
             "Executing",
             SBT_CMD,
@@ -1624,8 +1583,8 @@ const createJavaBom = async (path, options) => {
             "using plugins",
             tempSbtgDir
           );
-          var sbtArgs = [];
-          var pluginFile = null;
+          let sbtArgs = [];
+          let pluginFile = null;
           if (standalonePluginFile) {
             sbtArgs = [
               `-addPluginSbtFile=${tempSbtPlugins}`,
@@ -1709,7 +1668,7 @@ const createJavaBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createNodejsBom = async (path, options) => {
+export const createNodejsBom = async (path, options) => {
   let pkgList = [];
   let manifestFiles = [];
   let dependencies = [];
@@ -1720,7 +1679,7 @@ const createNodejsBom = async (path, options) => {
     const pkgJsonFiles = getAllFiles(path, "**/package.json");
     // Are there any package.json files in the container?
     if (pkgJsonFiles.length) {
-      for (let pj of pkgJsonFiles) {
+      for (const pj of pkgJsonFiles) {
         const dlist = await parsePkgJson(pj);
         if (dlist && dlist.length) {
           pkgList = pkgList.concat(dlist);
@@ -1776,7 +1735,7 @@ const createNodejsBom = async (path, options) => {
   // Parse min js files
   if (minJsFiles && minJsFiles.length) {
     manifestFiles = manifestFiles.concat(minJsFiles);
-    for (let f of minJsFiles) {
+    for (const f of minJsFiles) {
       const dlist = await parseMinJs(f);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
@@ -1786,7 +1745,7 @@ const createNodejsBom = async (path, options) => {
   // Parse bower json files
   if (bowerFiles && bowerFiles.length) {
     manifestFiles = manifestFiles.concat(bowerFiles);
-    for (let f of bowerFiles) {
+    for (const f of bowerFiles) {
       const dlist = await parseBowerJson(f);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
@@ -1795,7 +1754,7 @@ const createNodejsBom = async (path, options) => {
   }
   if (pnpmLockFiles && pnpmLockFiles.length) {
     manifestFiles = manifestFiles.concat(pnpmLockFiles);
-    for (let f of pnpmLockFiles) {
+    for (const f of pnpmLockFiles) {
       const basePath = dirname(f);
       // Determine the parent component
       const packageJsonF = join(basePath, "package.json");
@@ -1841,7 +1800,7 @@ const createNodejsBom = async (path, options) => {
   }
   if (pkgLockFiles && pkgLockFiles.length) {
     manifestFiles = manifestFiles.concat(pkgLockFiles);
-    for (let f of pkgLockFiles) {
+    for (const f of pkgLockFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
@@ -1917,7 +1876,7 @@ const createNodejsBom = async (path, options) => {
   }
   if (yarnLockFiles && yarnLockFiles.length) {
     manifestFiles = manifestFiles.concat(yarnLockFiles);
-    for (let f of yarnLockFiles) {
+    for (const f of yarnLockFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
@@ -1993,7 +1952,7 @@ const createNodejsBom = async (path, options) => {
       "**/package.json"
     );
     manifestFiles = manifestFiles.concat(pkgJsonFiles);
-    for (let pkgjf of pkgJsonFiles) {
+    for (const pkgjf of pkgJsonFiles) {
       const dlist = await parsePkgJson(pkgjf);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
@@ -2026,9 +1985,13 @@ const createNodejsBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createPythonBom = async (path, options) => {
+export const createPythonBom = async (path, options) => {
   let allImports = {};
   let metadataFilename = "";
+  let dependencies = [];
+  let pkgList = [];
+  const tempDir = mkdtempSync(join(tmpdir(), "cdxgen-venv-"));
+  const parentComponent = createDefaultParentComponent(path);
   const pipenvMode = existsSync(join(path, "Pipfile"));
   const poetryFiles = getAllFiles(
     path,
@@ -2054,7 +2017,6 @@ const createPythonBom = async (path, options) => {
     path,
     (options.multiProject ? "**/" : "") + "*.egg-info"
   );
-  let pkgList = [];
   const setupPy = join(path, "setup.py");
   const pyProjectFile = join(path, "pyproject.toml");
   const pyProjectMode = existsSync(pyProjectFile);
@@ -2065,7 +2027,7 @@ const createPythonBom = async (path, options) => {
   // Poetry sets up its own virtual env containing site-packages so
   // we give preference to poetry lock file. Issue# 129
   if (poetryMode) {
-    for (let f of poetryFiles) {
+    for (const f of poetryFiles) {
       const lockData = readFileSync(f, { encoding: "utf-8" });
       const dlist = await parsePoetrylockData(lockData);
       if (dlist && dlist.length) {
@@ -2078,7 +2040,7 @@ const createPythonBom = async (path, options) => {
     });
   } else if (metadataFiles && metadataFiles.length) {
     // dist-info directories
-    for (let mf of metadataFiles) {
+    for (const mf of metadataFiles) {
       const mData = readFileSync(mf, {
         encoding: "utf-8"
       });
@@ -2090,7 +2052,7 @@ const createPythonBom = async (path, options) => {
   }
   // .whl files. Zip file containing dist-info directory
   if (whlFiles && whlFiles.length) {
-    for (let wf of whlFiles) {
+    for (const wf of whlFiles) {
       const mData = await readZipEntry(wf, "METADATA");
       if (mData) {
         const dlist = parseBdistMetadata(mData);
@@ -2102,7 +2064,7 @@ const createPythonBom = async (path, options) => {
   }
   // .egg-info files
   if (eggInfoFiles && eggInfoFiles.length) {
-    for (let ef of eggInfoFiles) {
+    for (const ef of eggInfoFiles) {
       const dlist = parseBdistMetadata(readFileSync(ef, { encoding: "utf-8" }));
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
@@ -2126,15 +2088,15 @@ const createPythonBom = async (path, options) => {
     } else if (requirementsMode) {
       metadataFilename = "requirements.txt";
       if (reqFiles && reqFiles.length) {
-        for (let f of reqFiles) {
+        for (const f of reqFiles) {
           const basePath = dirname(f);
           let reqData = undefined;
           let frozen = false;
           // Attempt to pip freeze in a virtualenv to improve precision
           if (options.installDeps) {
-            const dlist = await executePipFreezeInVenv(basePath, f);
-            if (dlist && dlist.length) {
-              pkgList = pkgList.concat(dlist);
+            const pkgMap = getPipFrozenTree(basePath, f, tempDir);
+            if (pkgMap.pkgList && pkgMap.pkgList.length) {
+              pkgList = pkgList.concat(pkgMap.pkgList);
               frozen = true;
             }
           }
@@ -2154,7 +2116,7 @@ const createPythonBom = async (path, options) => {
         } // for
         metadataFilename = reqFiles.join(", ");
       } else if (reqDirFiles && reqDirFiles.length) {
-        for (let j in reqDirFiles) {
+        for (const j in reqDirFiles) {
           const f = reqDirFiles[j];
           const reqData = readFileSync(f, { encoding: "utf-8" });
           const dlist = await parseReqFile(reqData, false);
@@ -2168,27 +2130,48 @@ const createPythonBom = async (path, options) => {
   }
   // Use atom in requirements, setup.py and pyproject.toml mode
   if (requirementsMode || setupPyMode || pyProjectMode) {
-    let dlist = undefined;
     /**
      * The order of preference is pyproject.toml (newer) and then setup.py
      */
     if (options.installDeps) {
+      let pkgMap = undefined;
       if (pyProjectMode) {
-        dlist = await executePipFreezeInVenv(path, pyProjectFile);
+        pkgMap = getPipFrozenTree(path, pyProjectFile, tempDir);
       } else if (setupPyMode) {
-        dlist = await executePipFreezeInVenv(path, setupPy);
+        pkgMap = getPipFrozenTree(path, setupPy, tempDir);
+      } else {
+        pkgMap = getPipFrozenTree(path, undefined, tempDir);
+      }
+      // Get the imported modules and a dedupe list of packages
+      const parentDependsOn = [];
+      const retMap = await getPyModules(path, pkgList);
+      if (retMap.pkgList && retMap.pkgList.length) {
+        pkgList = pkgList.concat(retMap.pkgList);
+        for (const p of retMap.pkgList) {
+          parentDependsOn.push(`pkg:pypi/${p.name}@${p.version}`);
+        }
       }
-      if (dlist && dlist.length) {
-        pkgList = pkgList.concat(dlist);
+      if (retMap.dependenciesList) {
+        dependencies = mergeDependencies(dependencies, retMap.dependenciesList);
       }
-    }
-    // Get the imported modules and a dedupe list of packages
-    const retMap = await getPyModules(path, pkgList);
-    if (retMap.pkgList && retMap.pkgList.length) {
-      pkgList = pkgList.concat(retMap.pkgList);
-    }
-    if (retMap.allImports) {
-      allImports = { ...allImports, ...retMap.allImports };
+      if (retMap.allImports) {
+        allImports = { ...allImports, ...retMap.allImports };
+      }
+      // Complete the dependency tree by making parent component depend on the first level
+      for (const p of pkgMap.rootList) {
+        parentDependsOn.push(`pkg:pypi/${p.name}@${p.version}`);
+      }
+      if (pkgMap.pkgList && pkgMap.pkgList.length) {
+        pkgList = pkgList.concat(pkgMap.pkgList);
+      }
+      if (pkgMap.dependenciesList) {
+        dependencies = mergeDependencies(dependencies, pkgMap.dependenciesList);
+      }
+      const pdependencies = {
+        ref: parentComponent.purl,
+        dependsOn: parentDependsOn
+      };
+      dependencies.splice(0, 0, pdependencies);
     }
   }
   // Final fallback is to manually parse setup.py if we still
@@ -2200,10 +2183,16 @@ const createPythonBom = async (path, options) => {
       pkgList = pkgList.concat(dlist);
     }
   }
+  // Clean up
+  if (tempDir && tempDir.startsWith(tmpdir()) && rmSync) {
+    rmSync(tempDir, { recursive: true, force: true });
+  }
   return buildBomNSData(options, pkgList, "pypi", {
     allImports,
     src: path,
-    filename: metadataFilename
+    filename: metadataFilename,
+    dependencies,
+    parentComponent
   });
 };
 
@@ -2213,7 +2202,7 @@ const createPythonBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createGoBom = async (path, options) => {
+export const createGoBom = async (path, options) => {
   let pkgList = [];
   // Is this a binary file
   let maybeBinary = false;
@@ -2230,8 +2219,8 @@ const createGoBom = async (path, options) => {
     }
     // Since this pkg list is derived from the binary mark them as used.
     const allImports = {};
-    for (let mpkg of pkgList) {
-      let pkgFullName = `${mpkg.group}/${mpkg.name}`;
+    for (const mpkg of pkgList) {
+      const pkgFullName = `${mpkg.group}/${mpkg.name}`;
       allImports[pkgFullName] = true;
     }
     return buildBomNSData(options, pkgList, "golang", {
@@ -2255,7 +2244,7 @@ const createGoBom = async (path, options) => {
       "Using go.sum to generate BOMs for go projects may return an inaccurate representation of transitive dependencies.\nSee: https://github.com/golang/go/wiki/Modules#is-gosum-a-lock-file-why-does-gosum-include-information-for-module-versions-i-am-no-longer-using\n",
       "Set USE_GOSUM=false to generate BOMs using go.mod as the dependency source of truth."
     );
-    for (let f of gosumFiles) {
+    for (const f of gosumFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
@@ -2274,7 +2263,7 @@ const createGoBom = async (path, options) => {
   // If USE_GOSUM is false, generate BOM components using go.mod.
   const gosumMap = {};
   if (gosumFiles.length) {
-    for (let f of gosumFiles) {
+    for (const f of gosumFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
@@ -2303,7 +2292,7 @@ const createGoBom = async (path, options) => {
     let shouldManuallyParse = false;
     // Use the go list -deps and go mod why commands to generate a good quality BoM for non-docker invocations
     if (!["docker", "oci", "os"].includes(options.projectType)) {
-      for (let f of gomodFiles) {
+      for (const f of gomodFiles) {
         const basePath = dirname(f);
         // Ignore vendor packages
         if (basePath.includes("/vendor/") || basePath.includes("/build/")) {
@@ -2349,11 +2338,11 @@ const createGoBom = async (path, options) => {
         );
       }
       // Using go mod why detect required packages
-      for (let apkg of pkgList) {
+      for (const apkg of pkgList) {
         if (circuitBreak) {
           break;
         }
-        let pkgFullName = `${apkg.name}`;
+        const pkgFullName = `${apkg.name}`;
         if (apkg.scope === "required") {
           allImports[pkgFullName] = true;
           continue;
@@ -2375,7 +2364,7 @@ const createGoBom = async (path, options) => {
           const mstdout = mresult.stdout;
           if (mstdout) {
             const cmdOutput = Buffer.from(mstdout).toString();
-            let whyPkg = parseGoModWhy(cmdOutput);
+            const whyPkg = parseGoModWhy(cmdOutput);
             if (whyPkg == pkgFullName) {
               allImports[pkgFullName] = true;
             }
@@ -2399,7 +2388,7 @@ const createGoBom = async (path, options) => {
         "Manually parsing go.mod files. The resultant BoM would be incomplete."
       );
     }
-    for (let f of gomodFiles) {
+    for (const f of gomodFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
@@ -2414,7 +2403,7 @@ const createGoBom = async (path, options) => {
       filename: gomodFiles.join(", ")
     });
   } else if (gopkgLockFiles.length) {
-    for (let f of gopkgLockFiles) {
+    for (const f of gopkgLockFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
@@ -2440,7 +2429,7 @@ const createGoBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createRustBom = async (path, options) => {
+export const createRustBom = async (path, options) => {
   let pkgList = [];
   // Is this a binary file
   let maybeBinary = false;
@@ -2457,8 +2446,8 @@ const createRustBom = async (path, options) => {
     }
     // Since this pkg list is derived from the binary mark them as used.
     const allImports = {};
-    for (let mpkg of pkgList) {
-      let pkgFullName = `${mpkg.group}/${mpkg.name}`;
+    for (const mpkg of pkgList) {
+      const pkgFullName = `${mpkg.group}/${mpkg.name}`;
       allImports[pkgFullName] = true;
     }
     return buildBomNSData(options, pkgList, "cargo", {
@@ -2476,9 +2465,9 @@ const createRustBom = async (path, options) => {
     (options.multiProject ? "**/" : "") + "Cargo.toml"
   );
   const cargoMode = cargoFiles.length;
-  let cargoLockMode = cargoLockFiles.length;
+  const cargoLockMode = cargoLockFiles.length;
   if (cargoMode && !cargoLockMode) {
-    for (let f of cargoFiles) {
+    for (const f of cargoFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
@@ -2499,7 +2488,7 @@ const createRustBom = async (path, options) => {
     (options.multiProject ? "**/" : "") + "Cargo.lock"
   );
   if (cargoLockFiles.length) {
-    for (let f of cargoLockFiles) {
+    for (const f of cargoLockFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
@@ -2523,7 +2512,7 @@ const createRustBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createDartBom = async (path, options) => {
+export const createDartBom = async (path, options) => {
   const pubFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "pubspec.lock"
@@ -2534,7 +2523,7 @@ const createDartBom = async (path, options) => {
   );
   let pkgList = [];
   if (pubFiles.length) {
-    for (let f of pubFiles) {
+    for (const f of pubFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
@@ -2549,12 +2538,12 @@ const createDartBom = async (path, options) => {
       filename: pubFiles.join(", ")
     });
   } else if (pubSpecYamlFiles.length) {
-    for (let f of pubSpecYamlFiles) {
+    for (const f of pubSpecYamlFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
       const pubYamlData = readFileSync(f, { encoding: "utf-8" });
-      const dlist = await parsePubYamlData(pubYamlData);
+      const dlist = parsePubYamlData(pubYamlData);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
       }
@@ -2574,7 +2563,7 @@ const createDartBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createCppBom = async (path, options) => {
+export const createCppBom = async (path, options) => {
   const conanLockFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "conan.lock"
@@ -2585,12 +2574,12 @@ const createCppBom = async (path, options) => {
   );
   let pkgList = [];
   if (conanLockFiles.length) {
-    for (let f of conanLockFiles) {
+    for (const f of conanLockFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
       const conanLockData = readFileSync(f, { encoding: "utf-8" });
-      const dlist = await parseConanLockData(conanLockData);
+      const dlist = parseConanLockData(conanLockData);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
       }
@@ -2600,12 +2589,12 @@ const createCppBom = async (path, options) => {
       filename: conanLockFiles.join(", ")
     });
   } else if (conanFiles.length) {
-    for (let f of conanFiles) {
+    for (const f of conanFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
       const conanData = readFileSync(f, { encoding: "utf-8" });
-      const dlist = await parseConanData(conanData);
+      const dlist = parseConanData(conanData);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
       }
@@ -2625,7 +2614,7 @@ const createCppBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createClojureBom = async (path, options) => {
+export const createClojureBom = (path, options) => {
   const ednFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "deps.edn"
@@ -2640,7 +2629,7 @@ const createClojureBom = async (path, options) => {
     if (process.env.LEIN_ARGS) {
       LEIN_ARGS = process.env.LEIN_ARGS.split(" ");
     }
-    for (let f of leinFiles) {
+    for (const f of leinFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
@@ -2690,7 +2679,7 @@ const createClojureBom = async (path, options) => {
     if (process.env.CLJ_ARGS) {
       CLJ_ARGS = process.env.CLJ_ARGS.split(" ");
     }
-    for (let f of ednFiles) {
+    for (const f of ednFiles) {
       const basePath = dirname(f);
       console.log("Executing", CLJ_CMD, CLJ_ARGS.join(" "), "in", basePath);
       const result = spawnSync(CLJ_CMD, CLJ_ARGS, {
@@ -2743,19 +2732,19 @@ const createClojureBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createHaskellBom = async (path, options) => {
+export const createHaskellBom = async (path, options) => {
   const cabalFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "cabal.project.freeze"
   );
   let pkgList = [];
   if (cabalFiles.length) {
-    for (let f of cabalFiles) {
+    for (const f of cabalFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
       const cabalData = readFileSync(f, { encoding: "utf-8" });
-      const dlist = await parseCabalData(cabalData);
+      const dlist = parseCabalData(cabalData);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
       }
@@ -2774,19 +2763,19 @@ const createHaskellBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createElixirBom = async (path, options) => {
+export const createElixirBom = async (path, options) => {
   const mixFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "mix.lock"
   );
   let pkgList = [];
   if (mixFiles.length) {
-    for (let f of mixFiles) {
+    for (const f of mixFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
       const mixData = readFileSync(f, { encoding: "utf-8" });
-      const dlist = await parseMixLockData(mixData);
+      const dlist = parseMixLockData(mixData);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
       }
@@ -2805,16 +2794,16 @@ const createElixirBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createGitHubBom = async (path, options) => {
+export const createGitHubBom = async (path, options) => {
   const ghactionFiles = getAllFiles(path, ".github/workflows/" + "*.yml");
   let pkgList = [];
   if (ghactionFiles.length) {
-    for (let f of ghactionFiles) {
+    for (const f of ghactionFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
       const ghwData = readFileSync(f, { encoding: "utf-8" });
-      const dlist = await parseGitHubWorkflowData(ghwData);
+      const dlist = parseGitHubWorkflowData(ghwData);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
       }
@@ -2833,16 +2822,16 @@ const createGitHubBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createCloudBuildBom = async (path, options) => {
+export const createCloudBuildBom = async (path, options) => {
   const cbFiles = getAllFiles(path, "cloudbuild.yml");
   let pkgList = [];
   if (cbFiles.length) {
-    for (let f of cbFiles) {
+    for (const f of cbFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
       const cbwData = readFileSync(f, { encoding: "utf-8" });
-      const dlist = await parseCloudBuildData(cbwData);
+      const dlist = parseCloudBuildData(cbwData);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
       }
@@ -2861,7 +2850,7 @@ const createCloudBuildBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createOSBom = async (path, options) => {
+export const createOSBom = (path, options) => {
   console.warn(
     "About to generate SBoM for the current OS installation. This would take several minutes ..."
   );
@@ -2893,7 +2882,7 @@ const createOSBom = async (path, options) => {
     allLayersDir: options.allLayersExplodedDir,
     allLayersExplodedDir: options.allLayersExplodedDir
   };
-  let pkgPathList = [];
+  const pkgPathList = [];
   if (options.deep) {
     getPkgPathList(exportData, undefined);
   }
@@ -2906,15 +2895,15 @@ const createOSBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createJenkinsBom = async (path, options) => {
+export const createJenkinsBom = async (path, options) => {
   let pkgList = [];
   const hpiFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "*.hpi"
   );
-  let tempDir = mkdtempSync(join(tmpdir(), "hpi-deps-"));
+  const tempDir = mkdtempSync(join(tmpdir(), "hpi-deps-"));
   if (hpiFiles.length) {
-    for (let f of hpiFiles) {
+    for (const f of hpiFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
@@ -2926,7 +2915,7 @@ const createJenkinsBom = async (path, options) => {
   }
   const jsFiles = getAllFiles(tempDir, "**/*.js");
   if (jsFiles.length) {
-    for (let f of jsFiles) {
+    for (const f of jsFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
@@ -2954,19 +2943,19 @@ const createJenkinsBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createHelmBom = async (path, options) => {
+export const createHelmBom = async (path, options) => {
   let pkgList = [];
   const yamlFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "*.yaml"
   );
   if (yamlFiles.length) {
-    for (let f of yamlFiles) {
+    for (const f of yamlFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
       const helmData = readFileSync(f, { encoding: "utf-8" });
-      const dlist = await parseHelmYamlData(helmData);
+      const dlist = parseHelmYamlData(helmData);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
       }
@@ -2985,7 +2974,7 @@ const createHelmBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createSwiftBom = async (path, options) => {
+export const createSwiftBom = (path, options) => {
   const swiftFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "Package*.swift"
@@ -2997,9 +2986,9 @@ const createSwiftBom = async (path, options) => {
   let pkgList = [];
   let dependencies = [];
   let parentComponent = {};
-  let completedPath = [];
+  const completedPath = [];
   if (pkgResolvedFiles.length) {
-    for (let f of pkgResolvedFiles) {
+    for (const f of pkgResolvedFiles) {
       if (!parentComponent || !Object.keys(parentComponent).length) {
         parentComponent = createDefaultParentComponent(f);
       }
@@ -3013,7 +3002,7 @@ const createSwiftBom = async (path, options) => {
     }
   }
   if (swiftFiles.length) {
-    for (let f of swiftFiles) {
+    for (const f of swiftFiles) {
       const basePath = dirname(f);
       if (completedPath.includes(basePath)) {
         continue;
@@ -3071,16 +3060,16 @@ const createSwiftBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createContainerSpecLikeBom = async (path, options) => {
+export const createContainerSpecLikeBom = async (path, options) => {
   let services = [];
-  let ociSpecs = [];
+  const ociSpecs = [];
   let components = [];
   let componentsXmls = [];
-  let parentComponent = {};
+  const parentComponent = {};
   let dependencies = [];
-  let doneimages = [];
-  let doneservices = [];
-  let origProjectType = options.projectType;
+  const doneimages = [];
+  const doneservices = [];
+  const origProjectType = options.projectType;
   let dcFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "*.yml"
@@ -3093,7 +3082,7 @@ const createContainerSpecLikeBom = async (path, options) => {
     path,
     (options.multiProject ? "**/" : "") + "open*.json"
   );
-  let oapiYamlFiles = getAllFiles(
+  const oapiYamlFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "open*.yaml"
   );
@@ -3107,18 +3096,18 @@ const createContainerSpecLikeBom = async (path, options) => {
   const privadoFiles = getAllFiles(path, ".privado/" + "*.json");
   // parse yaml manifest files
   if (dcFiles.length) {
-    for (let f of dcFiles) {
+    for (const f of dcFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
       const dcData = readFileSync(f, { encoding: "utf-8" });
-      const imglist = await parseContainerSpecData(dcData);
+      const imglist = parseContainerSpecData(dcData);
       if (imglist && imglist.length) {
         if (DEBUG_MODE) {
           console.log("Images identified in", f, "are", imglist);
         }
         for (const img of imglist) {
-          let commonProperties = [
+          const commonProperties = [
             {
               name: "SrcFile",
               value: f
@@ -3239,12 +3228,12 @@ const createContainerSpecLikeBom = async (path, options) => {
   } // if
   // Parse openapi files
   if (oapiFiles.length) {
-    for (let af of oapiFiles) {
+    for (const af of oapiFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${af}`);
       }
       const oaData = readFileSync(af, { encoding: "utf-8" });
-      const servlist = await parseOpenapiSpecData(oaData);
+      const servlist = parseOpenapiSpecData(oaData);
       if (servlist && servlist.length) {
         // Inject SrcFile property
         for (const se of servlist) {
@@ -3265,14 +3254,14 @@ const createContainerSpecLikeBom = async (path, options) => {
       "Enriching your SBoM with information from privado.ai scan reports"
     );
     let rows = [["Classification", "Flow"]];
-    let config = {
+    const config = {
       header: {
         alignment: "center",
         content: "Data Privacy Insights from privado.ai"
       },
       columns: [{ width: 50 }, { width: 10 }]
     };
-    for (let f of privadoFiles) {
+    for (const f of privadoFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
@@ -3281,14 +3270,14 @@ const createContainerSpecLikeBom = async (path, options) => {
       if (servlist.length) {
         const aservice = servlist[0];
         if (aservice.data) {
-          for (let d of aservice.data) {
+          for (const d of aservice.data) {
             rows.push([d.classification, d.flow]);
           }
           console.log(table(rows, config));
         }
         if (aservice.endpoints) {
           rows = [["Leaky Endpoints"]];
-          for (let e of aservice.endpoints) {
+          for (const e of aservice.endpoints) {
             rows.push([e]);
           }
           console.log(
@@ -3350,7 +3339,7 @@ const createContainerSpecLikeBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createPHPBom = async (path, options) => {
+export const createPHPBom = (path, options) => {
   const composerJsonFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "composer.json"
@@ -3383,14 +3372,14 @@ const createPHPBom = async (path, options) => {
     if (DEBUG_MODE) {
       console.log("Parsing version", versionResult.stdout);
     }
-    let tmpV = undefined;
+    const tmpV = undefined;
     if (versionResult && versionResult.stdout) {
       versionResult.stdout.split(" ");
     }
     if (tmpV && tmpV.length > 1) {
       composerVersion = tmpV[1];
     }
-    for (let f of composerJsonFiles) {
+    for (const f of composerJsonFiles) {
       const basePath = dirname(f);
       let args = [];
       if (composerVersion && !composerVersion.startsWith("1")) {
@@ -3416,11 +3405,11 @@ const createPHPBom = async (path, options) => {
     (options.multiProject ? "**/" : "") + "composer.lock"
   );
   if (composerLockFiles.length) {
-    for (let f of composerLockFiles) {
+    for (const f of composerLockFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
-      let dlist = parseComposerLock(f);
+      const dlist = parseComposerLock(f);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
       }
@@ -3439,7 +3428,7 @@ const createPHPBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createRubyBom = async (path, options) => {
+export const createRubyBom = async (path, options) => {
   const gemFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "Gemfile"
@@ -3450,9 +3439,9 @@ const createRubyBom = async (path, options) => {
   );
   let pkgList = [];
   const gemFileMode = gemFiles.length;
-  let gemLockMode = gemLockFiles.length;
+  const gemLockMode = gemLockFiles.length;
   if (gemFileMode && !gemLockMode && options.installDeps) {
-    for (let f of gemFiles) {
+    for (const f of gemFiles) {
       const basePath = dirname(f);
       console.log("Executing 'bundle install' in", basePath);
       const result = spawnSync("bundle", ["install"], {
@@ -3473,11 +3462,11 @@ const createRubyBom = async (path, options) => {
     (options.multiProject ? "**/" : "") + "Gemfile.lock"
   );
   if (gemLockFiles.length) {
-    for (let f of gemLockFiles) {
+    for (const f of gemLockFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
-      let gemLockData = readFileSync(f, { encoding: "utf-8" });
+      const gemLockData = readFileSync(f, { encoding: "utf-8" });
       const dlist = await parseGemfileLockData(gemLockData);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
@@ -3497,8 +3486,9 @@ const createRubyBom = async (path, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createCsharpBom = async (path, options) => {
+export const createCsharpBom = async (path, options) => {
   let manifestFiles = [];
+  let pkgData = undefined;
   const csProjFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "*.csproj"
@@ -3522,7 +3512,7 @@ const createCsharpBom = async (path, options) => {
   let pkgList = [];
   if (nupkgFiles.length) {
     manifestFiles = manifestFiles.concat(nupkgFiles);
-    for (let nf of nupkgFiles) {
+    for (const nf of nupkgFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${nf}`);
       }
@@ -3535,11 +3525,11 @@ const createCsharpBom = async (path, options) => {
   // project.assets.json parsing
   if (projAssetsFiles.length) {
     manifestFiles = manifestFiles.concat(projAssetsFiles);
-    for (let af of projAssetsFiles) {
+    for (const af of projAssetsFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${af}`);
       }
-      let pkgData = readFileSync(af, { encoding: "utf-8" });
+      pkgData = readFileSync(af, { encoding: "utf-8" });
       const dlist = await parseCsProjAssetsData(pkgData);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
@@ -3548,11 +3538,11 @@ const createCsharpBom = async (path, options) => {
   } else if (pkgLockFiles.length) {
     manifestFiles = manifestFiles.concat(pkgLockFiles);
     // packages.lock.json from nuget
-    for (let af of pkgLockFiles) {
+    for (const af of pkgLockFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${af}`);
       }
-      let pkgData = readFileSync(af, { encoding: "utf-8" });
+      pkgData = readFileSync(af, { encoding: "utf-8" });
       const dlist = await parseCsPkgLockData(pkgData);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
@@ -3561,11 +3551,11 @@ const createCsharpBom = async (path, options) => {
   } else if (pkgConfigFiles.length) {
     manifestFiles = manifestFiles.concat(pkgConfigFiles);
     // packages.config parsing
-    for (let f of pkgConfigFiles) {
+    for (const f of pkgConfigFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
-      let pkgData = readFileSync(f, { encoding: "utf-8" });
+      pkgData = readFileSync(f, { encoding: "utf-8" });
       // Remove byte order mark
       if (pkgData.charCodeAt(0) === 0xfeff) {
         pkgData = pkgData.slice(1);
@@ -3578,7 +3568,7 @@ const createCsharpBom = async (path, options) => {
   } else if (csProjFiles.length) {
     manifestFiles = manifestFiles.concat(csProjFiles);
     // .csproj parsing
-    for (let f of csProjFiles) {
+    for (const f of csProjFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
@@ -3602,9 +3592,9 @@ const createCsharpBom = async (path, options) => {
   return {};
 };
 
-const mergeDependencies = (dependencies, newDependencies) => {
+export const mergeDependencies = (dependencies, newDependencies) => {
   const deps_map = {};
-  let combinedDeps = dependencies.concat(newDependencies || []);
+  const combinedDeps = dependencies.concat(newDependencies || []);
   for (const adep of combinedDeps) {
     if (!deps_map[adep.ref]) {
       deps_map[adep.ref] = new Set();
@@ -3613,7 +3603,7 @@ const mergeDependencies = (dependencies, newDependencies) => {
       deps_map[adep.ref].add(eachDepends);
     }
   }
-  let retlist = [];
+  const retlist = [];
   for (const akey of Object.keys(deps_map)) {
     retlist.push({
       ref: akey,
@@ -3622,13 +3612,11 @@ const mergeDependencies = (dependencies, newDependencies) => {
   }
   return retlist;
 };
-const _mergeDependencies = mergeDependencies;
-export { _mergeDependencies as mergeDependencies };
 
-const trimComponents = (components, format) => {
+export const trimComponents = (components, format) => {
   const keyCache = {};
   const filteredComponents = [];
-  for (let comp of components) {
+  for (const comp of components) {
     if (format === "xml" && comp.component) {
       if (!keyCache[comp.component.purl]) {
         keyCache[comp.component.purl] = true;
@@ -3643,10 +3631,8 @@ const trimComponents = (components, format) => {
   }
   return filteredComponents;
 };
-const _trimComponents = trimComponents;
-export { _trimComponents as trimComponents };
 
-const dedupeBom = (
+export const dedupeBom = (
   options,
   components,
   componentsXmls,
@@ -3694,8 +3680,6 @@ const dedupeBom = (
     }
   };
 };
-const _dedupeBom = dedupeBom;
-export { _dedupeBom as dedupeBom };
 
 /**
  * Function to create bom string for all languages
@@ -3703,7 +3687,7 @@ export { _dedupeBom as dedupeBom };
  * @param pathList list of to the project
  * @param options Parse options from the cli
  */
-const createMultiXBom = async (pathList, options) => {
+export const createMultiXBom = async (pathList, options) => {
   let components = [];
   let dependencies = [];
   let componentsXmls = [];
@@ -3741,7 +3725,7 @@ const createMultiXBom = async (pathList, options) => {
       );
     }
   }
-  for (let path of pathList) {
+  for (const path of pathList) {
     if (DEBUG_MODE) {
       console.log("Scanning", path);
     }
@@ -3830,7 +3814,7 @@ const createMultiXBom = async (pathList, options) => {
         listComponents(options, {}, bomData.bomJson.components, "cargo", "xml")
       );
     }
-    bomData = await createPHPBom(path, options);
+    bomData = createPHPBom(path, options);
     if (bomData && bomData.bomJson && bomData.bomJson.components) {
       if (DEBUG_MODE) {
         console.log(
@@ -3954,7 +3938,7 @@ const createMultiXBom = async (pathList, options) => {
         listComponents(options, {}, bomData.bomJson.components, "conan", "xml")
       );
     }
-    bomData = await createClojureBom(path, options);
+    bomData = createClojureBom(path, options);
     if (bomData && bomData.bomJson && bomData.bomJson.components) {
       if (DEBUG_MODE) {
         console.log(
@@ -4014,7 +3998,7 @@ const createMultiXBom = async (pathList, options) => {
         )
       );
     }
-    bomData = await createSwiftBom(path, options);
+    bomData = createSwiftBom(path, options);
     if (
       bomData &&
       bomData.bomJson &&
@@ -4035,30 +4019,23 @@ const createMultiXBom = async (pathList, options) => {
         listComponents(options, {}, bomData.bomJson.components, "swift", "xml")
       );
     }
-    // jar scanning is quite slow so this is limited to only deep scans
-    if (options.deep) {
-      bomData = createJarBom(path, options);
-      if (bomData && bomData.bomJson && bomData.bomJson.components) {
-        if (DEBUG_MODE) {
-          console.log(
-            `Found ${bomData.bomJson.components.length} jar packages at ${path}`
-          );
-        }
-        components = components.concat(bomData.bomJson.components);
-        dependencies = dependencies.concat(bomData.bomJson.dependencies);
-        if (!parentComponent || !Object.keys(parentComponent).length) {
-          parentComponent = bomData.parentComponent;
-        }
-        componentsXmls = componentsXmls.concat(
-          listComponents(
-            options,
-            {},
-            bomData.bomJson.components,
-            "maven",
-            "xml"
-          )
+    // Jar scanning is enabled by default
+    // See #330
+    bomData = createJarBom(path, options);
+    if (bomData && bomData.bomJson && bomData.bomJson.components) {
+      if (DEBUG_MODE) {
+        console.log(
+          `Found ${bomData.bomJson.components.length} jar packages at ${path}`
         );
       }
+      components = components.concat(bomData.bomJson.components);
+      dependencies = dependencies.concat(bomData.bomJson.dependencies);
+      if (!parentComponent || !Object.keys(parentComponent).length) {
+        parentComponent = bomData.parentComponent;
+      }
+      componentsXmls = componentsXmls.concat(
+        listComponents(options, {}, bomData.bomJson.components, "maven", "xml")
+      );
     }
   } // for
   if (options.lastWorkingDir && options.lastWorkingDir !== "") {
@@ -4094,7 +4071,7 @@ const createMultiXBom = async (pathList, options) => {
  * @param path to the project
  * @param options Parse options from the cli
  */
-const createXBom = async (path, options) => {
+export const createXBom = async (path, options) => {
   try {
     accessSync(path, constants.R_OK);
   } catch (err) {
@@ -4115,12 +4092,12 @@ const createXBom = async (path, options) => {
     (options.multiProject ? "**/" : "") + "pom.xml"
   );
   // gradle
-  let gradleFiles = getAllFiles(
+  const gradleFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "build.gradle*"
   );
   // scala sbt
-  let sbtFiles = getAllFiles(
+  const sbtFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "{build.sbt,Build.scala}*"
   );
@@ -4192,7 +4169,7 @@ const createXBom = async (path, options) => {
     (options.multiProject ? "**/" : "") + "composer.lock"
   );
   if (composerJsonFiles.length || composerLockFiles.length) {
-    return await createPHPBom(path, options);
+    return createPHPBom(path, options);
   }
 
   // Ruby
@@ -4271,7 +4248,7 @@ const createXBom = async (path, options) => {
     (options.multiProject ? "**/" : "") + "project.clj"
   );
   if (ednFiles.length || leinFiles.length) {
-    return await createClojureBom(path, options);
+    return createClojureBom(path, options);
   }
 
   // GitHub actions
@@ -4338,7 +4315,7 @@ const createXBom = async (path, options) => {
     (options.multiProject ? "**/" : "") + "Package.resolved"
   );
   if (swiftFiles.length || pkgResolvedFiles.length) {
-    return await createSwiftBom(path, options);
+    return createSwiftBom(path, options);
   }
 };
 
@@ -4474,20 +4451,20 @@ export const createBom = async (path, options) => {
       return await createJavaBom(path, options);
     case "jar":
       options.multiProject = true;
-      return await createJarBom(path, options);
+      return createJarBom(path, options);
     case "gradle-index":
     case "gradle-cache":
       options.multiProject = true;
-      return await createJarBom(GRADLE_CACHE_DIR, options);
+      return createJarBom(GRADLE_CACHE_DIR, options);
     case "sbt-index":
     case "sbt-cache":
       options.multiProject = true;
-      return await createJarBom(SBT_CACHE_DIR, options);
+      return createJarBom(SBT_CACHE_DIR, options);
     case "maven-index":
     case "maven-cache":
     case "maven-repo":
       options.multiProject = true;
-      return await createJarBom(join(homedir(), ".m2", "repository"), options);
+      return createJarBom(join(homedir(), ".m2", "repository"), options);
     case "nodejs":
     case "js":
     case "javascript":
@@ -4510,7 +4487,7 @@ export const createBom = async (path, options) => {
       return await createRustBom(path, options);
     case "php":
       options.multiProject = true;
-      return await createPHPBom(path, options);
+      return createPHPBom(path, options);
     case "ruby":
       options.multiProject = true;
       return await createRubyBom(path, options);
@@ -4545,7 +4522,7 @@ export const createBom = async (path, options) => {
     case "clj":
     case "leiningen":
       options.multiProject = true;
-      return await createClojureBom(path, options);
+      return createClojureBom(path, options);
     case "github":
     case "actions":
       options.multiProject = true;
@@ -4587,7 +4564,7 @@ export const createBom = async (path, options) => {
       return await createCloudBuildBom(path, options);
     case "swift":
       options.multiProject = true;
-      return await createSwiftBom(path, options);
+      return createSwiftBom(path, options);
     default:
       // In recurse mode return multi-language Bom
       // https://github.com/cyclonedx/cdxgen/issues/95
@@ -4606,7 +4583,7 @@ export const createBom = async (path, options) => {
  * @param bomContents BOM Json
  */
 export async function submitBom(args, bomContents) {
-  let serverUrl = args.serverUrl.replace(/\/$/, "") + "/api/v1/bom";
+  const serverUrl = args.serverUrl.replace(/\/$/, "") + "/api/v1/bom";
   let encodedBomContents = Buffer.from(JSON.stringify(bomContents)).toString(
     "base64"
   );
@@ -4681,3 +4658,38 @@ export async function submitBom(args, bomContents) {
     }
   }
 }
+
+/**
+ * Validate the generated bom using jsonschema
+ *
+ * @param {object} bomJson content
+ */
+export const validateBom = (bomJson) => {
+  if (!bomJson) {
+    return true;
+  }
+  const schema = JSON.parse(
+    readFileSync(join(dirName, "data", "bom-1.5.schema.json"))
+  );
+  const defsSchema = JSON.parse(
+    readFileSync(join(dirName, "data", "jsf-0.82.schema.json"))
+  );
+  const spdxSchema = JSON.parse(
+    readFileSync(join(dirName, "data", "spdx.schema.json"))
+  );
+  const ajv = new Ajv({
+    schemas: [schema, defsSchema, spdxSchema],
+    strict: false,
+    logger: false
+  });
+  addFormats(ajv);
+  const validate = ajv.getSchema(
+    "http://cyclonedx.org/schema/bom-1.5.schema.json"
+  );
+  const isValid = validate(bomJson);
+  if (!isValid) {
+    console.log(validate.errors);
+    return false;
+  }
+  return true;
+};