@cyclonedx/cdxgen 9.0.1 → 9.1.1

package/utils.js

@@ -48,6 +48,7 @@ import { satisfies, coerce, maxSatisfying, clean, valid } from "semver";
 import StreamZip from "node-stream-zip";
 import { parseEDNString } from "edn-data";
 import { PackageURL } from "packageurl-js";
+import { getTreeWithPlugin } from "./piptree.js";
 
 const selfPJson = JSON.parse(readFileSync(join(dirName, "package.json")));
 const _version = selfPJson.version;
@@ -195,7 +196,7 @@ export function getLicenses(pkg, format = "xml") {
  * the text to the license text object and stop.
  */
 export function addLicenseText(pkg, l, licenseContent, format = "xml") {
-  let licenseFilenames = [
+  const licenseFilenames = [
     "LICENSE",
     "License",
     "license",
@@ -206,7 +207,7 @@ export function addLicenseText(pkg, l, licenseContent, format = "xml") {
     "Notice",
     "notice"
   ];
-  let licenseContentTypes = {
+  const licenseContentTypes = {
     "text/plain": "",
     "text/txt": ".txt",
     "text/markdown": ".md",
@@ -219,7 +220,7 @@ export function addLicenseText(pkg, l, licenseContent, format = "xml") {
       for (const [licenseContentType, fileExtension] of Object.entries(
         licenseContentTypes
       )) {
-        let licenseFilepath = `${pkg.realPath}/${licenseFilename}${licenseName}${fileExtension}`;
+        const licenseFilepath = `${pkg.realPath}/${licenseFilename}${licenseName}${fileExtension}`;
         if (existsSync(licenseFilepath)) {
           licenseContent.text = readLicenseText(
             licenseFilepath,
@@ -242,16 +243,16 @@ export function readLicenseText(
   licenseContentType,
   format = "xml"
 ) {
-  let licenseText = readFileSync(licenseFilepath, "utf8");
+  const licenseText = readFileSync(licenseFilepath, "utf8");
   if (licenseText) {
     if (format === "xml") {
-      let licenseContentText = { "#cdata": licenseText };
+      const licenseContentText = { "#cdata": licenseText };
       if (licenseContentType !== "text/plain") {
         licenseContentText["@content-type"] = licenseContentType;
       }
       return licenseContentText;
     } else {
-      let licenseContentText = { content: licenseText };
+      const licenseContentText = { content: licenseText };
       if (licenseContentType !== "text/plain") {
         licenseContentText["contentType"] = licenseContentType;
       }
@@ -315,7 +316,7 @@ const _getDepPkgList = async function (
   depKeys,
   pkg
 ) {
-  let pkgDependencies =
+  const pkgDependencies =
     pkg.lockfileVersion && pkg.lockfileVersion >= 3
       ? pkg.packages
       : pkg.dependencies;
@@ -326,7 +327,7 @@ const _getDepPkgList = async function (
       if (k === "") {
         continue;
       }
-      let name = k;
+      const name = k;
       const version = pkgDependencies[name].version;
       const purl = new PackageURL(
         "npm",
@@ -337,7 +338,7 @@ const _getDepPkgList = async function (
         null
       );
       const purlString = decodeURIComponent(purl.toString());
-      let scope = pkgDependencies[name].dev === true ? "optional" : undefined;
+      const scope = pkgDependencies[name].dev === true ? "optional" : undefined;
       const apkg = {
         name: name.replace("node_modules/", ""),
         version,
@@ -348,7 +349,20 @@ const _getDepPkgList = async function (
             name: "SrcFile",
             value: pkgLockFile
           }
-        ]
+        ],
+        evidence: {
+          identity: {
+            field: "purl",
+            confidence: 1,
+            methods: [
+              {
+                technique: "manifest-analysis",
+                confidence: 1,
+                value: pkgLockFile
+              }
+            ]
+          }
+        }
       };
       pkgList.push(apkg);
       if (pkgDependencies[name].dependencies) {
@@ -422,7 +436,20 @@ export const parsePkgJson = async (pkgJsonFile) => {
             name: "SrcFile",
             value: pkgJsonFile
           }
-        ]
+        ],
+        evidence: {
+          identity: {
+            field: "purl",
+            confidence: 1,
+            methods: [
+              {
+                technique: "manifest-analysis",
+                confidence: 1,
+                value: pkgJsonFile
+              }
+            ]
+          }
+        }
       });
     } catch (err) {
       // continue regardless of error
@@ -446,8 +473,8 @@ export const parsePkgJson = async (pkgJsonFile) => {
  */
 export const parsePkgLock = async (pkgLockFile) => {
   let pkgList = [];
-  let dependenciesList = [];
-  let depKeys = {};
+  const dependenciesList = [];
+  const depKeys = {};
   let rootPkg = {};
   if (existsSync(pkgLockFile)) {
     const lockData = JSON.parse(readFileSync(pkgLockFile, "utf8"));
@@ -652,7 +679,20 @@ export const parseYarnLock = async function (yarnLockFile) {
                 name: "SrcFile",
                 value: yarnLockFile
               }
-            ]
+            ],
+            evidence: {
+              identity: {
+                field: "purl",
+                confidence: 1,
+                methods: [
+                  {
+                    technique: "manifest-analysis",
+                    confidence: 1,
+                    value: yarnLockFile
+                  }
+                ]
+              }
+            }
           });
           // Reset all the variables
           group = "";
@@ -766,7 +806,7 @@ export const parseNodeShrinkwrap = async function (swFile) {
   if (existsSync(swFile)) {
     const lockData = JSON.parse(readFileSync(swFile, "utf8"));
     const pkgKeys = Object.keys(lockData);
-    for (var k in pkgKeys) {
+    for (const k in pkgKeys) {
       const fullName = pkgKeys[k];
       const integrity = lockData[fullName];
       const parts = fullName.split("@");
@@ -779,7 +819,7 @@ export const parseNodeShrinkwrap = async function (swFile) {
           version = parts[1];
         } else if (parts.length === 3) {
           if (parts[0] === "") {
-            let gnameparts = parts[1].split("/");
+            const gnameparts = parts[1].split("/");
             group = gnameparts[0];
             name = gnameparts[1];
           } else {
@@ -798,7 +838,20 @@ export const parseNodeShrinkwrap = async function (swFile) {
                 name: "SrcFile",
                 value: swFile
               }
-            ]
+            ],
+            evidence: {
+              identity: {
+                field: "purl",
+                confidence: 1,
+                methods: [
+                  {
+                    technique: "manifest-analysis",
+                    confidence: 1,
+                    value: swFile
+                  }
+                ]
+              }
+            }
           });
         }
       }
@@ -874,7 +927,7 @@ export const parsePnpmLock = async function (pnpmLock, parentComponent = null) {
     }
     const packages = yamlObj.packages;
     const pkgKeys = Object.keys(packages);
-    for (var k in pkgKeys) {
+    for (const k in pkgKeys) {
       // Eg: @babel/code-frame/7.10.1
       // In lockfileVersion 6, /@babel/code-frame@7.18.6
       let fullName = pkgKeys[k].replace("/@", "@");
@@ -885,7 +938,7 @@ export const parsePnpmLock = async function (pnpmLock, parentComponent = null) {
       const parts = fullName.split("/");
       const integrity = packages[pkgKeys[k]].resolution.integrity;
       const deps = packages[pkgKeys[k]].dependencies || [];
-      let scope = packages[pkgKeys[k]].dev === true ? "optional" : undefined;
+      const scope = packages[pkgKeys[k]].dev === true ? "optional" : undefined;
       if (parts && parts.length) {
         let name = "";
         let version = "";
@@ -952,7 +1005,20 @@ export const parsePnpmLock = async function (pnpmLock, parentComponent = null) {
                 name: "SrcFile",
                 value: pnpmLock
               }
-            ]
+            ],
+            evidence: {
+              identity: {
+                field: "purl",
+                confidence: 1,
+                methods: [
+                  {
+                    technique: "manifest-analysis",
+                    confidence: 1,
+                    value: pnpmLock
+                  }
+                ]
+              }
+            }
           });
         }
       }
@@ -998,7 +1064,20 @@ export const parseBowerJson = async (bowerJsonFile) => {
             name: "SrcFile",
             value: bowerJsonFile
           }
-        ]
+        ],
+        evidence: {
+          identity: {
+            field: "purl",
+            confidence: 1,
+            methods: [
+              {
+                technique: "manifest-analysis",
+                confidence: 1,
+                value: bowerJsonFile
+              }
+            ]
+          }
+        }
       });
     } catch (err) {
       // continue regardless of error
@@ -1049,7 +1128,7 @@ export const parseMinJs = async (minJsFile) => {
             : pkgNameVer.split(" ");
           if (tmpB && tmpB.length > 1) {
             // Fix #223 - lowercase parsed package name
-            let name = tmpB[0].replace(/ /g, "-").trim().toLowerCase();
+            const name = tmpB[0].replace(/ /g, "-").trim().toLowerCase();
             if (
               ["copyright", "author", "licensed"].includes(name.toLowerCase())
             ) {
@@ -1066,7 +1145,20 @@ export const parseMinJs = async (minJsFile) => {
                     name: "SrcFile",
                     value: minJsFile
                   }
-                ]
+                ],
+                evidence: {
+                  identity: {
+                    field: "purl",
+                    confidence: 0.25,
+                    methods: [
+                      {
+                        technique: "filename",
+                        confidence: 0.25,
+                        value: minJsFile
+                      }
+                    ]
+                  }
+                }
               });
             }
             return;
@@ -1111,7 +1203,7 @@ export const parsePom = function (pomFile) {
     } else if (dependencies && !Array.isArray(dependencies)) {
       dependencies = [dependencies];
     }
-    for (let adep of dependencies) {
+    for (const adep of dependencies) {
       const version = adep.version;
       let versionStr = undefined;
       if (version && version._ && version._.indexOf("$") == -1) {
@@ -1127,7 +1219,20 @@ export const parsePom = function (pomFile) {
                 name: "SrcFile",
                 value: pomFile
               }
-            ]
+            ],
+            evidence: {
+              identity: {
+                field: "purl",
+                confidence: 1,
+                methods: [
+                  {
+                    technique: "manifest-analysis",
+                    confidence: 1,
+                    value: pomFile
+                  }
+                ]
+              }
+            }
           });
       }
     }
@@ -1150,7 +1255,7 @@ export const parseMavenTree = function (rawOutput) {
   const tmpA = rawOutput.split("\n");
   let last_level = 0;
   let last_purl = "";
-  let stack = [];
+  const stack = [];
   tmpA.forEach((l) => {
     if (!includeMavenTestScope && l.trim().endsWith(":test")) {
       return;
@@ -1314,7 +1419,7 @@ export const parseGradleDep = function (
       ) {
         last_level = 1;
         if (rline.startsWith("+--- project :")) {
-          let tmpProj = rline.split("+--- project :");
+          const tmpProj = rline.split("+--- project :");
           last_project_purl = `pkg:maven/${tmpProj[1].trim()}@${rootProjectVersion}?type=jar`;
           stack = [last_project_purl];
           last_purl = last_project_purl;
@@ -1481,17 +1586,17 @@ export const parseLeinDep = function (rawOutput) {
 
 export const parseLeinMap = function (node, keys_cache, deps) {
   if (node["map"]) {
-    for (let n of node["map"]) {
+    for (const n of node["map"]) {
       if (n.length === 2) {
         const rootNode = n[0];
-        let psym = rootNode[0].sym;
-        let version = rootNode[1];
+        const psym = rootNode[0].sym;
+        const version = rootNode[1];
         let group = dirname(psym);
         if (group === ".") {
           group = "";
         }
-        let name = basename(psym);
-        let cacheKey = group + "-" + name + "-" + version;
+        const name = basename(psym);
+        const cacheKey = group + "-" + name + "-" + version;
         if (!keys_cache[cacheKey]) {
           keys_cache[cacheKey] = true;
           deps.push({ group, name, version });
@@ -1524,7 +1629,7 @@ export const parseGradleProjects = function (rawOutput) {
       } else if (l.includes("--- Project")) {
         const tmpB = l.split("Project ");
         if (tmpB && tmpB.length > 1) {
-          let projName = tmpB[1].split(" ")[0].replace(/'/g, "");
+          const projName = tmpB[1].split(" ")[0].replace(/'/g, "");
           // Include all projects including test projects
           if (projName.startsWith(":")) {
             projects.add(projName);
@@ -1533,7 +1638,7 @@ export const parseGradleProjects = function (rawOutput) {
       } else if (l.includes("--- project ")) {
         const tmpB = l.split("--- project ");
         if (tmpB && tmpB.length > 1) {
-          let projName = tmpB[1];
+          const projName = tmpB[1];
           if (projName.startsWith(":")) {
             projects.add(projName);
           }
@@ -1554,7 +1659,7 @@ export const parseGradleProjects = function (rawOutput) {
  */
 export const parseGradleProperties = function (rawOutput) {
   let rootProject = "root";
-  let projects = new Set();
+  const projects = new Set();
   const metadata = { group: "", version: "latest", properties: [] };
   if (typeof rawOutput === "string") {
     const tmpA = rawOutput.split("\n");
@@ -1616,11 +1721,7 @@ export const executeGradleProperties = function (dir, rootPath, subProject) {
     "plain",
     "--build-cache"
   ];
-  let gradleCmd = getGradleCommand(dir, rootPath);
-  if (process.env.GRADLE_ARGS) {
-    const addArgs = process.env.GRADLE_ARGS.split(" ");
-    gradlePropertiesArgs = gradlePropertiesArgs.concat(addArgs);
-  }
+  const gradleCmd = getGradleCommand(dir, rootPath);
   console.log(
     "Executing",
     gradleCmd,
@@ -1764,7 +1865,7 @@ export const parseKVDep = function (rawOutput) {
  * @param {string} name License full name
  */
 export const findLicenseId = function (name) {
-  for (let l of licenseMapping) {
+  for (const l of licenseMapping) {
     if (l.names.includes(name)) {
       return l.exp;
     }
@@ -1781,8 +1882,8 @@ export const findLicenseId = function (name) {
  */
 export const guessLicenseId = function (content) {
   content = content.replace(/\n/g, " ");
-  for (let l of licenseMapping) {
-    for (let j in l.names) {
+  for (const l of licenseMapping) {
+    for (const j in l.names) {
       if (content.toUpperCase().indexOf(l.names[j].toUpperCase()) > -1) {
         return l.exp;
       }
@@ -1817,7 +1918,7 @@ export const getMvnMetadata = async function (pkgList) {
     if (p.group.indexOf("android") !== -1) {
       urlPrefix = ANDROID_MAVEN;
     }
-    let groupPart = p.group.replace(/\./g, "/");
+    const groupPart = p.group.replace(/\./g, "/");
     // Querying maven requires a valid group name
     if (!groupPart || groupPart === "") {
       cdepList.push(p);
@@ -1900,7 +2001,7 @@ export const parsePyRequiresDist = function (dist_string) {
     name = tmpA[0];
   } else if (tmpA.length > 1) {
     name = tmpA[0];
-    let tmpVersion = tmpA[1];
+    const tmpVersion = tmpA[1];
     version = tmpVersion.split(",")[0].replace(/[();=&glt><]/g, "");
   }
   return {
@@ -1919,7 +2020,7 @@ export const guessPypiMatchingVersion = (versionsList, versionSpecifiers) => {
   versionSpecifiers = versionSpecifiers.replace(/,/g, " ").split(";")[0];
   // Iterate in the reverse order
   for (let i = versionsList.length - 1; i > 0; i--) {
-    let rv = versionsList[i];
+    const rv = versionsList[i];
     if (satisfies(coerce(rv), versionSpecifiers, true)) {
       return rv;
     }
@@ -1939,7 +2040,7 @@ export const getPyMetadata = async function (pkgList, fetchDepsInfo) {
     return pkgList;
   }
   const PYPI_URL = "https://pypi.org/pypi/";
-  let cdepList = [];
+  const cdepList = [];
   for (const p of pkgList) {
     if (!p || !p.name) {
       continue;
@@ -1973,7 +2074,7 @@ export const getPyMetadata = async function (pkgList, fetchDepsInfo) {
       p.description = body.info.summary;
       p.license = findLicenseId(body.info.license);
       if (body.info.home_page) {
-        if (body.info.home_page.indexOf("git") > -1) {
+        if (body.info.home_page.includes("git")) {
           p.repository = { url: body.info.home_page };
         } else {
           p.homepage = { url: body.info.home_page };
@@ -2003,11 +2104,39 @@ export const getPyMetadata = async function (pkgList, fetchDepsInfo) {
             Object.keys(body.releases || {}),
             versionSpecifiers
           );
+          // Indicate the confidence with our guess
+          p.evidence = {
+            identity: {
+              field: "version",
+              confidence: 0.75,
+              methods: [
+                {
+                  technique: "manifest-analysis",
+                  confidence: 0.75,
+                  value: `Version specifiers: ${versionSpecifiers}`
+                }
+              ]
+            }
+          };
         }
         // If we have reached here, it means we have not solved the version
         // So assume latest
         if (!p.version) {
           p.version = body.info.version;
+          // Indicate the low confidence
+          p.evidence = {
+            identity: {
+              field: "version",
+              confidence: 0.5,
+              methods: [
+                {
+                  technique: "source-code-analysis",
+                  confidence: 0.5,
+                  value: `PyPI package: ${p.name}`
+                }
+              ]
+            }
+          };
         }
       } else if (p.version !== body.info.version) {
         if (!p.properties) {
@@ -2044,16 +2173,21 @@ export const getPyMetadata = async function (pkgList, fetchDepsInfo) {
           );
         }
         p.version = "latest";
+        // Indicate the low confidence
+        p.evidence = {
+          identity: {
+            field: "version",
+            confidence: 0,
+            methods: [
+              {
+                technique: "source-code-analysis",
+                confidence: 0,
+                value: `Module ${p.name}`
+              }
+            ]
+          }
+        };
       }
-      // Add a property to let the downstream tools know about this assumption
-      // FIXME: Do this correctly with 1.5
-      if (!p.properties) {
-        p.properties = [];
-      }
-      p.properties.push({
-        name: "cdx:pypi:pedigree",
-        value: "unknown"
-      });
       cdepList.push(p);
     }
   }
@@ -2099,7 +2233,7 @@ export const parsePiplockData = async function (lockData) {
       Object.keys(depBlock).forEach((p) => {
         const pkg = depBlock[p];
         if (Object.prototype.hasOwnProperty.call(pkg, "version")) {
-          let versionStr = pkg.version.replace("==", "");
+          const versionStr = pkg.version.replace("==", "");
           pkgList.push({ name: p, version: versionStr });
         }
       });
@@ -2184,7 +2318,7 @@ export async function parseReqFile(reqData, fetchDepsInfo) {
           versionStr = null;
         }
         if (!tmpA[0].includes("=") && !tmpA[0].trim().includes(" ")) {
-          let name = tmpA[0].trim().replace(";", "");
+          const name = tmpA[0].trim().replace(";", "");
           if (!PYTHON_STD_MODULES.includes(name)) {
             pkgList.push({
               name,
@@ -2194,8 +2328,8 @@ export async function parseReqFile(reqData, fetchDepsInfo) {
           }
         }
       } else if (l.includes("<") && l.includes(">")) {
-        let tmpA = l.split(">");
-        let name = tmpA[0].trim().replace(";", "");
+        const tmpA = l.split(">");
+        const name = tmpA[0].trim().replace(";", "");
         const versionSpecifiers = l.replace(name, "");
         if (!PYTHON_STD_MODULES.includes(name)) {
           pkgList.push({
@@ -2216,7 +2350,7 @@ export async function parseReqFile(reqData, fetchDepsInfo) {
           tmpA = tmpA.split("#")[0];
         }
         if (!tmpA[0].trim().includes(" ")) {
-          let name = tmpA[0].trim().replace(";", "");
+          const name = tmpA[0].trim().replace(";", "");
           const versionSpecifiers = l.replace(name, "");
           if (!PYTHON_STD_MODULES.includes(name)) {
             pkgList.push({
@@ -2237,9 +2371,9 @@ export async function parseReqFile(reqData, fetchDepsInfo) {
           l = l.split("#")[0];
         }
         l = l.trim();
-        let tmpA = l.split(/(<|>)/);
+        const tmpA = l.split(/(<|>)/);
         if (tmpA && tmpA.length === 3) {
-          let name = tmpA[0].trim().replace(";", "");
+          const name = tmpA[0].trim().replace(";", "");
           const versionSpecifiers = l.replace(name, "");
           if (!PYTHON_STD_MODULES.includes(name)) {
             pkgList.push({
@@ -2255,7 +2389,7 @@ export async function parseReqFile(reqData, fetchDepsInfo) {
             });
           }
         } else if (!l.includes(" ")) {
-          let name = l.replace(";", "");
+          const name = l.replace(";", "");
           const versionSpecifiers = l.replace(name, "");
           if (!PYTHON_STD_MODULES.includes(name)) {
             pkgList.push({
@@ -2286,6 +2420,7 @@ export async function parseReqFile(reqData, fetchDepsInfo) {
  */
 export const getPyModules = async (src, epkgList) => {
   const allImports = {};
+  const dependenciesList = [];
   const modList = findAppModules(src, "python");
   const pyDefaultModules = new Set(PYTHON_STD_MODULES);
   const filteredModList = modList.filter(
@@ -2323,7 +2458,13 @@ export const getPyModules = async (src, epkgList) => {
     pkgList = pkgList.filter((p) => !pkgMaps.includes(p.name));
   }
   pkgList = await getPyMetadata(pkgList, true);
-  return { allImports, pkgList };
+  for (const p of pkgList) {
+    dependenciesList.push({
+      ref: `pkg:pypi/${p.name}@${p.version}`.toLowerCase(),
+      dependsOn: []
+    });
+  }
+  return { allImports, pkgList, dependenciesList };
 };
 
 /**
@@ -2429,7 +2570,7 @@ export const getRepoLicense = async function (repoUrl, repoMetadata) {
     const group = repoMetadata.group;
     const name = repoMetadata.name;
     if (group && name) {
-      for (let akLic of knownLicenses) {
+      for (const akLic of knownLicenses) {
         if (akLic.group === "." && akLic.name === name) {
           return akLic.license;
         } else if (
@@ -2471,7 +2612,7 @@ export const getGoPkgLicense = async function (repoMetadata) {
       }
       const licenseIds = licenses.split(", ");
       const licList = [];
-      for (let id of licenseIds) {
+      for (const id of licenseIds) {
         const alicense = {
           id: id
         };
@@ -2554,23 +2695,33 @@ export const parseGoModData = async function (goModData, gosumMap) {
     if (!isModReplacement) {
       // Add group, name and version component properties for required modules
       const version = tmpA[1];
-      let gosumHash = gosumMap[`${tmpA[0]}/${version}`];
+      const gosumHash = gosumMap[`${tmpA[0]}/${version}`];
       // The hash for this version was not found in go.sum, so skip as it is most likely being replaced.
       if (gosumHash === undefined) {
         continue;
       }
-      let component = await getGoPkgComponent("", tmpA[0], version, gosumHash);
+      const component = await getGoPkgComponent(
+        "",
+        tmpA[0],
+        version,
+        gosumHash
+      );
       pkgComponentsList.push(component);
     } else {
       // Add group, name and version component properties for replacement modules
       const version = tmpA[3];
 
-      let gosumHash = gosumMap[`${tmpA[2]}/${version}`];
+      const gosumHash = gosumMap[`${tmpA[2]}/${version}`];
       // The hash for this version was not found in go.sum, so skip.
       if (gosumHash === undefined) {
         continue;
       }
-      let component = await getGoPkgComponent("", tmpA[2], version, gosumHash);
+      const component = await getGoPkgComponent(
+        "",
+        tmpA[2],
+        version,
+        gosumHash
+      );
       pkgComponentsList.push(component);
     }
   }
@@ -2590,7 +2741,7 @@ export const parseGoListDep = async function (rawOutput, gosumMap) {
     const deps = [];
     const keys_cache = {};
     const pkgs = rawOutput.split("\n");
-    for (let l of pkgs) {
+    for (const l of pkgs) {
       const verArr = l.trim().replace(new RegExp("[\"']", "g"), "").split(" ");
 
       if (verArr && verArr.length === 5) {
@@ -2599,8 +2750,8 @@ export const parseGoListDep = async function (rawOutput, gosumMap) {
         if (!keys_cache[key]) {
           keys_cache[key] = key;
           const version = verArr[1];
-          let gosumHash = gosumMap[`${verArr[0]}/${version}`];
-          let component = await getGoPkgComponent(
+          const gosumHash = gosumMap[`${verArr[0]}/${version}`];
+          const component = await getGoPkgComponent(
             "",
             verArr[0],
             version,
@@ -2655,7 +2806,7 @@ export const parseGosumData = async function (gosumData) {
     return pkgList;
   }
   const pkgs = gosumData.split("\n");
-  for (let l of pkgs) {
+  for (const l of pkgs) {
     // look for lines containing go.mod
     if (l.indexOf("go.mod") > -1) {
       const tmpA = l.split(" ");
@@ -2693,7 +2844,7 @@ export const parseGopkgData = async function (gopkgData) {
   }
   let pkg = null;
   const pkgs = gopkgData.split("\n");
-  for (let l of pkgs) {
+  for (const l of pkgs) {
     let key = null;
     let value = null;
     if (l.indexOf("[[projects]]") > -1) {
@@ -2741,7 +2892,7 @@ export const parseGoVersionData = async function (buildInfoData) {
     return pkgList;
   }
   const pkgs = buildInfoData.split("\n");
-  for (let i in pkgs) {
+  for (const i in pkgs) {
     const l = pkgs[i].trim().replace(/\t/g, " ");
     if (!l.startsWith("dep")) {
       continue;
@@ -2755,7 +2906,7 @@ export const parseGoVersionData = async function (buildInfoData) {
     if (tmpA.length == 4) {
       hash = tmpA[tmpA.length - 1].replace("h1:", "sha256-");
     }
-    let component = await getGoPkgComponent("", name, tmpA[2].trim(), hash);
+    const component = await getGoPkgComponent("", name, tmpA[2].trim(), hash);
     pkgList.push(component);
   }
   return pkgList;
@@ -2958,7 +3109,7 @@ export const getDartMetadata = async function (pkgList) {
       });
       if (res && res.body) {
         const versions = res.body.versions;
-        for (let v of versions) {
+        for (const v of versions) {
           if (p.version === v.version) {
             const pubspec = v.pubspec;
             p.description = pubspec.description;
@@ -2982,7 +3133,7 @@ export const getDartMetadata = async function (pkgList) {
 };
 
 export const parseCargoTomlData = async function (cargoData) {
-  let pkgList = [];
+  const pkgList = [];
   if (!cargoData) {
     return pkgList;
   }
@@ -3031,7 +3182,7 @@ export const parseCargoTomlData = async function (cargoData) {
         pkgList.push(pkg);
       }
       pkg = undefined;
-      let tmpA = l.split(" = ");
+      const tmpA = l.split(" = ");
       let tmpB = undefined;
       let name = tmpA[0];
       let version = undefined;
@@ -3179,7 +3330,7 @@ export const parsePubLockData = async function (pubLockData) {
   }
 };
 
-export const parsePubYamlData = async function (pubYamlData) {
+export const parsePubYamlData = function (pubYamlData) {
   const pkgList = [];
   let yamlObj = undefined;
   try {
@@ -3199,7 +3350,7 @@ export const parsePubYamlData = async function (pubYamlData) {
   return pkgList;
 };
 
-export const parseHelmYamlData = async function (helmData) {
+export const parseHelmYamlData = function (helmData) {
   const pkgList = [];
   let yamlObj = undefined;
   try {
@@ -3211,7 +3362,7 @@ export const parseHelmYamlData = async function (helmData) {
     return pkgList;
   }
   if (yamlObj.name && yamlObj.version) {
-    let pkg = {
+    const pkg = {
       name: yamlObj.name,
       description: yamlObj.description || "",
       version: yamlObj.version
@@ -3223,7 +3374,7 @@ export const parseHelmYamlData = async function (helmData) {
   }
   if (yamlObj.dependencies) {
     for (const hd of yamlObj.dependencies) {
-      let pkg = {
+      const pkg = {
         name: hd.name,
         version: hd.version // This could have * so not precise
       };
@@ -3238,7 +3389,7 @@ export const parseHelmYamlData = async function (helmData) {
       for (const key of Object.keys(yamlObj.entries[he])) {
         const hd = yamlObj.entries[he][key];
         if (hd.name && hd.version) {
-          let pkg = {
+          const pkg = {
             name: hd.name,
             version: hd.version,
             description: hd.description || ""
@@ -3327,7 +3478,7 @@ export const recurseImageNameLookup = (keyValueObj, pkgList, imgList) => {
   return imgList;
 };
 
-export const parseContainerSpecData = async function (dcData) {
+export const parseContainerSpecData = function (dcData) {
   const pkgList = [];
   const imgList = [];
   if (!dcData.includes("image") && !dcData.includes("kind")) {
@@ -3397,7 +3548,7 @@ export const parseContainerSpecData = async function (dcData) {
 export const identifyFlow = function (processingObj) {
   let flow = "unknown";
   if (processingObj.sinkId) {
-    let sinkId = processingObj.sinkId.toLowerCase();
+    const sinkId = processingObj.sinkId.toLowerCase();
     if (sinkId.endsWith("write")) {
       flow = "inbound";
     } else if (sinkId.endsWith("read")) {
@@ -3427,7 +3578,7 @@ export const parsePrivadoFile = function (f) {
     return servlist;
   }
   const jsonData = JSON.parse(pData);
-  let aservice = {
+  const aservice = {
     "x-trust-boundary": false,
     properties: [],
     data: [],
@@ -3472,9 +3623,9 @@ export const parsePrivadoFile = function (f) {
     // Find endpoints
     if (jsonData.collections) {
       const endpoints = [];
-      for (let c of jsonData.collections) {
-        for (let occ of c.collections) {
-          for (let e of occ.occurrences) {
+      for (const c of jsonData.collections) {
+        for (const occ of c.collections) {
+          for (const e of occ.occurrences) {
             if (e.endPoint) {
               endpoints.push(e.endPoint);
             }
@@ -3485,7 +3636,7 @@ export const parsePrivadoFile = function (f) {
     }
     // Capture violations
     if (jsonData.violations) {
-      for (let v of jsonData.violations) {
+      for (const v of jsonData.violations) {
         aservice.properties.push({
           name: "privado_violations",
           value: v.policyId
@@ -3505,7 +3656,7 @@ export const parsePrivadoFile = function (f) {
   return servlist;
 };
 
-export const parseOpenapiSpecData = async function (oaData) {
+export const parseOpenapiSpecData = function (oaData) {
   const servlist = [];
   if (!oaData) {
     return servlist;
@@ -3555,7 +3706,7 @@ export const parseOpenapiSpecData = async function (oaData) {
   return servlist;
 };
 
-export const parseCabalData = async function (cabalData) {
+export const parseCabalData = function (cabalData) {
   const pkgList = [];
   if (!cabalData) {
     return pkgList;
@@ -3582,7 +3733,7 @@ export const parseCabalData = async function (cabalData) {
   return pkgList;
 };
 
-export const parseMixLockData = async function (mixData) {
+export const parseMixLockData = function (mixData) {
   const pkgList = [];
   if (!mixData) {
     return pkgList;
@@ -3608,7 +3759,7 @@ export const parseMixLockData = async function (mixData) {
   return pkgList;
 };
 
-export const parseGitHubWorkflowData = async function (ghwData) {
+export const parseGitHubWorkflowData = function (ghwData) {
   const pkgList = [];
   const keys_cache = {};
   if (!ghwData) {
@@ -3650,7 +3801,7 @@ export const parseGitHubWorkflowData = async function (ghwData) {
   return pkgList;
 };
 
-export const parseCloudBuildData = async function (cbwData) {
+export const parseCloudBuildData = function (cbwData) {
   const pkgList = [];
   const keys_cache = {};
   if (!cbwData) {
@@ -3666,7 +3817,7 @@ export const parseCloudBuildData = async function (cbwData) {
         const tmpA = step.name.split(":");
         if (tmpA.length === 2) {
           let group = dirname(tmpA[0]);
-          let name = basename(tmpA[0]);
+          const name = basename(tmpA[0]);
           if (group === ".") {
             group = "";
           }
@@ -3687,7 +3838,7 @@ export const parseCloudBuildData = async function (cbwData) {
   return pkgList;
 };
 
-export const parseConanLockData = async function (conanLockData) {
+export const parseConanLockData = function (conanLockData) {
   const pkgList = [];
   if (!conanLockData) {
     return pkgList;
@@ -3697,7 +3848,7 @@ export const parseConanLockData = async function (conanLockData) {
     return pkgList;
   }
   const nodes = graphLock.graph_lock.nodes;
-  for (let nk of Object.keys(nodes)) {
+  for (const nk of Object.keys(nodes)) {
     if (nodes[nk].ref) {
       const tmpA = nodes[nk].ref.split("/");
       if (tmpA.length === 2) {
@@ -3708,7 +3859,7 @@ export const parseConanLockData = async function (conanLockData) {
   return pkgList;
 };
 
-export const parseConanData = async function (conanData) {
+export const parseConanData = function (conanData) {
   const pkgList = [];
   if (!conanData) {
     return pkgList;
@@ -3737,7 +3888,7 @@ export const parseLeiningenData = function (leinData) {
     leinData = "(defproject" + tmpArr[1];
   }
   const ednData = parseEDNString(leinData);
-  for (let k of Object.keys(ednData)) {
+  for (const k of Object.keys(ednData)) {
     if (k === "list") {
       ednData[k].forEach((jk) => {
         if (Array.isArray(jk)) {
@@ -3768,7 +3919,7 @@ export const parseEdnData = function (rawEdnData) {
   }
   const ednData = parseEDNString(rawEdnData);
   const pkgCache = {};
-  for (let k of Object.keys(ednData)) {
+  for (const k of Object.keys(ednData)) {
     if (k === "map") {
       ednData[k].forEach((jk) => {
         if (Array.isArray(jk)) {
@@ -3815,7 +3966,7 @@ export const parseEdnData = function (rawEdnData) {
 
 export const parseNupkg = async function (nupkgFile) {
   const pkgList = [];
-  let pkg = { group: "" };
+  const pkg = { group: "" };
   let nuspecData = await readZipEntry(nupkgFile, ".nuspec");
   // Remove byte order mark
   if (nuspecData.charCodeAt(0) === 0xfeff) {
@@ -3850,6 +4001,19 @@ export const parseNupkg = async function (nupkgFile) {
       value: nupkgFile
     }
   ];
+  pkg.evidence = {
+    identity: {
+      field: "purl",
+      confidence: 1,
+      methods: [
+        {
+          technique: "binary-analysis",
+          confidence: 1,
+          value: nupkgFile
+        }
+      ]
+    }
+  };
   pkgList.push(pkg);
   if (fetchLicenses) {
     return await getNugetMetadata(pkgList);
@@ -3875,9 +4039,9 @@ export const parseCsPkgData = async function (pkgData) {
     return pkgList;
   }
   packages = packages[0].package;
-  for (let i in packages) {
+  for (const i in packages) {
     const p = packages[i].$;
-    let pkg = { group: "" };
+    const pkg = { group: "" };
     pkg.name = p.id;
     pkg.version = p.version;
     pkgList.push(pkg);
@@ -3907,12 +4071,12 @@ export const parseCsProjData = async function (csProjData) {
   }
   const project = projects[0];
   if (project.ItemGroup && project.ItemGroup.length) {
-    for (let i in project.ItemGroup) {
+    for (const i in project.ItemGroup) {
       const item = project.ItemGroup[i];
       // .net core use PackageReference
-      for (let j in item.PackageReference) {
+      for (const j in item.PackageReference) {
         const pref = item.PackageReference[j].$;
-        let pkg = { group: "" };
+        const pkg = { group: "" };
         if (!pref.Include || pref.Include.includes(".csproj")) {
           continue;
         }
@@ -3921,9 +4085,9 @@ export const parseCsProjData = async function (csProjData) {
         pkgList.push(pkg);
       }
       // .net framework use Reference
-      for (let j in item.Reference) {
+      for (const j in item.Reference) {
         const pref = item.Reference[j].$;
-        let pkg = { group: "" };
+        const pkg = { group: "" };
         if (!pref.Include || pref.Include.includes(".csproj")) {
           continue;
         }
@@ -3953,7 +4117,7 @@ export const parseCsProjAssetsData = async function (csProjData) {
   if (!assetData || !assetData.libraries) {
     return pkgList;
   }
-  for (let alib of Object.keys(assetData.libraries)) {
+  for (const alib of Object.keys(assetData.libraries)) {
     // Skip os runtime packages
     if (alib.startsWith("runtime")) {
       continue;
@@ -3992,8 +4156,8 @@ export const parseCsPkgLockData = async function (csLockData) {
   if (!assetData || !assetData.dependencies) {
     return pkgList;
   }
-  for (let aversion of Object.keys(assetData.dependencies)) {
-    for (let alib of Object.keys(assetData.dependencies[aversion])) {
+  for (const aversion of Object.keys(assetData.dependencies)) {
+    for (const alib of Object.keys(assetData.dependencies[aversion])) {
       const libData = assetData.dependencies[aversion][alib];
       pkg = {
         group: "",
@@ -4135,15 +4299,15 @@ export const parseComposerLock = function (pkgLockFile) {
       return [];
     }
     if (lockData) {
-      let packages = {};
+      const packages = {};
       if (lockData["packages"]) {
         packages["required"] = lockData["packages"];
       }
       if (lockData["packages-dev"]) {
         packages["optional"] = lockData["packages-dev"];
       }
-      for (let compScope in packages) {
-        for (let i in packages[compScope]) {
+      for (const compScope in packages) {
+        for (const i in packages[compScope]) {
           const pkg = packages[compScope][i];
           // Be extra cautious. Potential fix for #236
           if (!pkg || !pkg.name || !pkg.version) {
@@ -4153,7 +4317,7 @@ export const parseComposerLock = function (pkgLockFile) {
           if (group === ".") {
             group = "";
           }
-          let name = basename(pkg.name);
+          const name = basename(pkg.name);
           pkgList.push({
             group: group,
             name: name,
@@ -4171,7 +4335,20 @@ export const parseComposerLock = function (pkgLockFile) {
                 name: "SrcFile",
                 value: pkgLockFile
               }
-            ]
+            ],
+            evidence: {
+              identity: {
+                field: "purl",
+                confidence: 1,
+                methods: [
+                  {
+                    technique: "manifest-analysis",
+                    confidence: 1,
+                    value: pkgLockFile
+                  }
+                ]
+              }
+            }
           });
         }
       }
@@ -4190,7 +4367,7 @@ export const parseSbtLock = function (pkgLockFile) {
   if (existsSync(pkgLockFile)) {
     const lockData = JSON.parse(readFileSync(pkgLockFile, "utf8"));
     if (lockData && lockData.dependencies) {
-      for (let pkg of lockData.dependencies) {
+      for (const pkg of lockData.dependencies) {
         const artifacts = pkg.artifacts || undefined;
         let integrity = "";
         if (artifacts && artifacts.length) {
@@ -4215,7 +4392,20 @@ export const parseSbtLock = function (pkgLockFile) {
               name: "SrcFile",
               value: pkgLockFile
             }
-          ]
+          ],
+          evidence: {
+            identity: {
+              field: "purl",
+              confidence: 1,
+              methods: [
+                {
+                  technique: "manifest-analysis",
+                  confidence: 1,
+                  value: pkgLockFile
+                }
+              ]
+            }
+          }
         });
       }
     }
@@ -4240,15 +4430,15 @@ export const convertOSQueryResults = function (
       if (res.version) {
         const version = res.version;
         let name = res.name || res.device_id;
-        let group = "";
-        let subpath = res.path || res.admindir || res.source;
-        let publisher = res.maintainer || res.creator;
+        const group = "";
+        const subpath = res.path || res.admindir || res.source;
+        const publisher = res.maintainer || res.creator;
         let scope = undefined;
-        let compScope = res.priority;
+        const compScope = res.priority;
         if (["required", "optional", "excluded"].includes(compScope)) {
           scope = compScope;
         }
-        let description =
+        const description =
           res.description ||
           res.arguments ||
           res.device ||
@@ -4293,7 +4483,7 @@ export const _swiftDepPkgList = (
   jsonData
 ) => {
   if (jsonData && jsonData.dependencies) {
-    for (let adep of jsonData.dependencies) {
+    for (const adep of jsonData.dependencies) {
       const urlOrPath = adep.url || adep.path;
       const apkg = {
         group: adep.identity || "",
@@ -4333,7 +4523,7 @@ export const _swiftDepPkgList = (
       // Handle the immediate dependencies before recursing
       if (adep.dependencies && adep.dependencies.length) {
         const deplist = [];
-        for (let cdep of adep.dependencies) {
+        for (const cdep of adep.dependencies) {
           const deppurl = new PackageURL(
             "swift",
             cdep.identity || "",
@@ -4380,7 +4570,7 @@ export const parseSwiftJsonTree = (rawOutput, pkgFile) => {
   }
   const pkgList = [];
   const dependenciesList = [];
-  let depKeys = {};
+  const depKeys = {};
   let rootPkg = {};
   let jsonData = {};
   try {
@@ -4475,7 +4665,20 @@ export const parseSwiftResolved = (resolvedFile) => {
               name: "SrcFile",
               value: resolvedFile
             }
-          ]
+          ],
+          evidence: {
+            identity: {
+              field: "purl",
+              confidence: 1,
+              methods: [
+                {
+                  technique: "manifest-analysis",
+                  confidence: 1,
+                  value: resolvedFile
+                }
+              ]
+            }
+          }
         };
         const repLocation = adep.location || adep.repositoryURL;
         if (repLocation) {
@@ -4497,7 +4700,7 @@ export const parseSwiftResolved = (resolvedFile) => {
  * @param {string} basePath Path to the maven project
  */
 export const collectMvnDependencies = function (mavenCmd, basePath) {
-  let tempDir = mkdtempSync(join(tmpdir(), "mvn-deps-"));
+  const tempDir = mkdtempSync(join(tmpdir(), "mvn-deps-"));
   console.log(
     `Executing 'mvn dependency:copy-dependencies -DoutputDirectory=${tempDir} -DexcludeTransitive=true -DincludeScope=runtime' in ${basePath}`
   );
@@ -4555,7 +4758,7 @@ export const collectJarNS = function (jarPath) {
   // Execute jar tvf to get class names
   const jarFiles = getAllFiles(jarPath, "**/*.jar");
   if (jarFiles && jarFiles.length) {
-    for (let jf of jarFiles) {
+    for (const jf of jarFiles) {
       const jarname = basename(jf);
       if (DEBUG_MODE) {
         console.log(`Executing 'jar tf ${jf}'`);
@@ -4659,7 +4862,7 @@ export { _encodeForPurl as encodeForPurl };
  * @return pkgList Package list
  */
 export const extractJarArchive = function (jarFile, tempDir) {
-  let pkgList = [];
+  const pkgList = [];
   let jarFiles = [];
   const fname = basename(jarFile);
   let pomname = undefined;
@@ -4674,7 +4877,7 @@ export const extractJarArchive = function (jarFile, tempDir) {
     copyFileSync(jarFile, join(tempDir, fname), constants.COPYFILE_FICLONE);
   }
   if (jarFile.endsWith(".war") || jarFile.endsWith(".hpi")) {
-    let jarResult = spawnSync("jar", ["-xf", join(tempDir, fname)], {
+    const jarResult = spawnSync("jar", ["-xf", join(tempDir, fname)], {
       encoding: "utf-8",
       cwd: tempDir
     });
@@ -4693,7 +4896,7 @@ export const extractJarArchive = function (jarFile, tempDir) {
     jarFiles = [join(tempDir, fname)];
   }
   if (jarFiles && jarFiles.length) {
-    for (let jf of jarFiles) {
+    for (const jf of jarFiles) {
       pomname = jf.replace(".jar", ".pom");
       const jarname = basename(jf);
       // Ignore test jars
@@ -4703,7 +4906,7 @@ export const extractJarArchive = function (jarFile, tempDir) {
       ) {
         continue;
       }
-      let manifestDir = join(tempDir, "META-INF");
+      const manifestDir = join(tempDir, "META-INF");
       const manifestFile = join(manifestDir, "MANIFEST.MF");
       let jarResult = {
         status: 1
@@ -4732,32 +4935,42 @@ export const extractJarArchive = function (jarFile, tempDir) {
             jarMetadata["Bundle-Vendor"] ||
             jarMetadata["Automatic-Module-Name"] ||
             "";
+          let version =
+            jarMetadata["Bundle-Version"] ||
+            jarMetadata["Implementation-Version"] ||
+            jarMetadata["Specification-Version"];
+          if (version && version.includes(" ")) {
+            version = version.split(" ")[0];
+          }
           let name = "";
+          // Prefer jar filename to construct name and version
+          if (!name || !version || name === "" || version === "") {
+            const tmpA = jarname.split("-");
+            if (tmpA && tmpA.length > 1) {
+              const lastPart = tmpA[tmpA.length - 1];
+              if (!version || version === "") {
+                version = lastPart.replace(".jar", "");
+              }
+              if (!name || name === "") {
+                name = jarname.replace("-" + lastPart, "") || "";
+              }
+            } else {
+              name = jarname.replace(".jar", "");
+            }
+          }
           if (
+            !name.length &&
             jarMetadata["Bundle-Name"] &&
             !jarMetadata["Bundle-Name"].includes(" ")
           ) {
             name = jarMetadata["Bundle-Name"];
           } else if (
+            !name.length &&
             jarMetadata["Implementation-Title"] &&
             !jarMetadata["Implementation-Title"].includes(" ")
           ) {
             name = jarMetadata["Implementation-Title"];
           }
-          let version =
-            jarMetadata["Bundle-Version"] ||
-            jarMetadata["Implementation-Version"] ||
-            jarMetadata["Specification-Version"];
-          if (version && version.includes(" ")) {
-            version = version.split(" ")[0];
-          }
-          if (!name && group) {
-            name = basename(group.replace(/\./g, "/"));
-            if (!group.startsWith("javax")) {
-              group = dirname(group.replace(/\./g, "/"));
-              group = group.replace(/\//g, ".");
-            }
-          }
           // Sometimes the group might already contain the name
           // Eg: group: org.checkerframework.checker.qual name: checker-qual
           if (name && group && !group.startsWith("javax")) {
@@ -4773,21 +4986,6 @@ export const extractJarArchive = function (jarFile, tempDir) {
               );
             }
           }
-          // Fallback to parsing jar filename
-          if (!name || !version || name === "" || version === "") {
-            const tmpA = jarname.split("-");
-            if (tmpA && tmpA.length > 1) {
-              const lastPart = tmpA[tmpA.length - 1];
-              if (!version || version === "") {
-                version = lastPart.replace(".jar", "");
-              }
-              if (!name || name === "") {
-                name = jarname.replace("-" + lastPart, "") || "";
-              }
-            } else {
-              name = jarname.replace(".jar", "");
-            }
-          }
           // Patch the group string
           for (const aprefix in vendorAliases) {
             if (name && name.startsWith(aprefix)) {
@@ -4796,10 +4994,27 @@ export const extractJarArchive = function (jarFile, tempDir) {
             }
           }
           if (name && version) {
+            // If group and name are the same we only need the name
+            if (group == name) {
+              group = "";
+            }
             pkgList.push({
               group: group === "." ? "" : encodeForPurl(group || "") || "",
               name: name ? encodeForPurl(name) : "",
               version,
+              evidence: {
+                identity: {
+                  field: "purl",
+                  confidence: 0.5,
+                  methods: [
+                    {
+                      technique: "filename",
+                      confidence: 0.5,
+                      value: jarname
+                    }
+                  ]
+                }
+              },
               properties: [
                 {
                   name: "SrcFile",
@@ -4841,8 +5056,8 @@ export const extractJarArchive = function (jarFile, tempDir) {
 export const determineSbtVersion = function (projectPath) {
   const buildPropFile = join(projectPath, "project", "build.properties");
   if (existsSync(buildPropFile)) {
-    let properties = propertiesReader(buildPropFile);
-    let property = properties.get("sbt.version");
+    const properties = propertiesReader(buildPropFile);
+    const property = properties.get("sbt.version");
     if (property != null && valid(property)) {
       return property;
     }
@@ -4864,7 +5079,7 @@ export const determineSbtVersion = function (projectPath) {
  */
 export const addPlugin = function (projectPath, plugin) {
   const pluginsFile = sbtPluginsPath(projectPath);
-  var originalPluginsFile = null;
+  let originalPluginsFile = null;
   if (existsSync(pluginsFile)) {
     originalPluginsFile = pluginsFile + ".cdxgen";
     copyFileSync(pluginsFile, originalPluginsFile, constants.COPYFILE_FICLONE);
@@ -4997,6 +5212,12 @@ export const getMavenCommand = (srcPath, rootPath) => {
   let findMavenFile = "mvnw";
   if (platform() == "win32") {
     findMavenFile = "mvnw.bat";
+    if (
+      !existsSync(join(srcPath, findMavenFile)) &&
+      existsSync(join(srcPath, "mvnw.cmd"))
+    ) {
+      findMavenFile = "mvnw.cmd";
+    }
   }
 
   if (existsSync(join(srcPath, findMavenFile))) {
@@ -5071,6 +5292,16 @@ export const executeAtom = (src, args) => {
     timeout: TIMEOUT_MS,
     env
   });
+  if (
+    result.stderr &&
+    result.stderr.includes(
+      "has been compiled by a more recent version of the Java Runtime"
+    )
+  ) {
+    console.log(
+      "Atom requires Java 17 or above. Please install a suitable version and re-run cdxgen to improve the SBoM accuracy.\nAlternatively, use the cdxgen container image."
+    );
+  }
   if (DEBUG_MODE) {
     if (result.stdout) {
       console.log(result.stdout);
@@ -5118,17 +5349,62 @@ export const findAppModules = function (src, language) {
   return retList;
 };
 
+const flattenDeps = (
+  dependsOn,
+  dependenciesList,
+  pkgList,
+  reqOrSetupFile,
+  t
+) => {
+  for (const d of t.dependencies) {
+    const pkgRef = `pkg:pypi/${d.name}@${d.version}`
+      .replace(/_/g, "-")
+      .toLowerCase();
+    dependsOn.push(pkgRef);
+    dependenciesList.push({ ref: pkgRef, dependsOn: [] });
+    pkgList.push({
+      name: d.name,
+      version: d.version,
+      properties: [
+        {
+          name: "SrcFile",
+          value: reqOrSetupFile
+        }
+      ],
+      evidence: {
+        identity: {
+          field: "purl",
+          confidence: 1,
+          methods: [
+            {
+              technique: "manifest-analysis",
+              confidence: 1,
+              value: reqOrSetupFile
+            }
+          ]
+        }
+      }
+    });
+    // Recurse and flatten
+    if (d.dependencies && d.dependencies) {
+      flattenDeps(dependsOn, dependenciesList, pkgList, reqOrSetupFile, d);
+    }
+  }
+};
+
 /**
- * Execute pip freeze by creating a virtual env in a temp directory
+ * Execute pip freeze by creating a virtual env in a temp directory and construct the dependency tree
  *
  * @param {string} basePath Base path
  * @param {string} reqOrSetupFile Requirements or setup.py file
+ * @param {string} tempVenvDir Temp venv dir
  * @returns List of packages from the virtual env
  */
-export const executePipFreezeInVenv = async (basePath, reqOrSetupFile) => {
-  let pkgList = [];
+export const getPipFrozenTree = (basePath, reqOrSetupFile, tempVenvDir) => {
+  const pkgList = [];
+  const rootList = [];
+  const dependenciesList = [];
   let result = undefined;
-  const tempDir = mkdtempSync(join(tmpdir(), "cdxgen-venv-"));
   const env = {
     ...process.env
   };
@@ -5138,16 +5414,22 @@ export const executePipFreezeInVenv = async (basePath, reqOrSetupFile) => {
    * By checking the environment variable "VIRTUAL_ENV" we decide whether to create an env or not
    */
   if (!process.env.VIRTUAL_ENV) {
-    result = spawnSync(PYTHON_CMD, ["-m", "venv", tempDir]);
+    result = spawnSync(PYTHON_CMD, ["-m", "venv", tempVenvDir]);
     if (result.status !== 0 || result.error) {
       if (DEBUG_MODE) {
-        console.log(result.stderr);
+        console.log("Virtual env creation has failed");
+        if (!result.stderr) {
+          console.log(
+            "Ensure the virtualenv package is installed using pip. `python -m pip install virtualenv`"
+          );
+        }
       }
     } else {
-      env.VIRTUAL_ENV = tempDir;
-      env.PATH = `${join(tempDir, "bin")}${_delimiter}${
-        process.env.PATH || ""
-      }`;
+      env.VIRTUAL_ENV = tempVenvDir;
+      env.PATH = `${join(
+        tempVenvDir,
+        platform() == "win32" ? "Scripts" : "bin"
+      )}${_delimiter}${process.env.PATH || ""}`;
     }
   }
   /**
@@ -5156,8 +5438,8 @@ export const executePipFreezeInVenv = async (basePath, reqOrSetupFile) => {
    * This step is accurate but not reproducible since the resulting list could differ based on various factors
    * such as the version of python, pip, os, pypi.org availability (and weather?)
    */
-  if (tempDir === env.VIRTUAL_ENV) {
-    let pipInstallArgs = [
+  if (tempVenvDir === env.VIRTUAL_ENV && reqOrSetupFile) {
+    const pipInstallArgs = [
       "-m",
       "pip",
       "install",
@@ -5197,6 +5479,7 @@ export const executePipFreezeInVenv = async (basePath, reqOrSetupFile) => {
       }
       if (!versionRelatedError && DEBUG_MODE) {
         console.log("args used:", pipInstallArgs);
+        console.log(result.stdout, result.stderr);
         console.log(
           "Possible build errors detected. The resulting list in the SBoM would therefore be incomplete.\nTry installing any missing build tools or development libraries to improve the accuracy."
         );
@@ -5215,43 +5498,42 @@ export const executePipFreezeInVenv = async (basePath, reqOrSetupFile) => {
         console.log("- Check if any git submodules have to be initialized.");
       }
     }
+  }
+  // Bug #375. Attempt pip freeze on existing and new virtual environments
+  if (env.VIRTUAL_ENV && env.VIRTUAL_ENV.length) {
     /**
      * At this point, the previous attempt to do a pip install might have failed and we might have an unclean virtual environment with an incomplete list
      * The position taken by cdxgen is "Some SBoM is better than no SBoM", so we proceed to collecting the dependencies that got installed with pip freeze
      */
-    let pipFreezeArgs = [
-      "-m",
-      "pip",
-      "freeze",
-      "-l",
-      "--exclude-editable",
-      "--disable-pip-version-check"
-    ];
-    if (
-      !reqOrSetupFile.endsWith("setup.py") &&
-      !reqOrSetupFile.endsWith("pyproject.toml")
-    ) {
-      pipFreezeArgs.push("-r");
-      pipFreezeArgs.push(resolve(reqOrSetupFile));
+    if (DEBUG_MODE) {
+      console.log(
+        "About to construct the pip dependency tree. Please wait ..."
+      );
     }
-    result = spawnSync(PYTHON_CMD, pipFreezeArgs, {
-      cwd: basePath,
-      encoding: "utf-8",
-      timeout: TIMEOUT_MS,
-      env
-    });
-    if (result.status === 0 && result.stdout) {
-      // We now a list from pip freeze that could be parsed to obtain a list
-      // We need to iterate that this list is not reproducible and could vary based on the environment
-      const reqData = Buffer.from(result.stdout).toString();
-      const dlist = await parseReqFile(reqData, false);
-      if (dlist && dlist.length) {
-        pkgList = pkgList.concat(dlist);
-      }
-    } else if (result.status !== 0 || result.error) {
-      if (DEBUG_MODE) {
-        console.log(result.stderr, "args used:", pipFreezeArgs);
+    const tree = getTreeWithPlugin(env, PYTHON_CMD, basePath);
+    if (DEBUG_MODE && !tree.length) {
+      console.log(
+        "Dependency tree generation has failed. Please check for any errors or version incompatibilities reported in the logs."
+      );
+    }
+    for (const t of tree) {
+      if (!t.version.length) {
+        continue;
       }
+      pkgList.push({
+        name: t.name.replace(/_/g, "-"),
+        version: t.version
+      });
+      rootList.push({
+        name: t.name.replace(/_/g, "-"),
+        version: t.version
+      });
+      const dependsOn = [];
+      flattenDeps(dependsOn, dependenciesList, pkgList, reqOrSetupFile, t);
+      dependenciesList.push({
+        ref: `pkg:pypi/${t.name}@${t.version}`.replace(/_/g, "-").toLowerCase(),
+        dependsOn
+      });
     }
   } else {
     if (DEBUG_MODE) {
@@ -5260,11 +5542,11 @@ export const executePipFreezeInVenv = async (basePath, reqOrSetupFile) => {
       );
     }
   }
-  // Clean up
-  if (tempDir && tempDir.startsWith(tmpdir()) && rmSync) {
-    rmSync(tempDir, { recursive: true, force: true });
-  }
-  return pkgList;
+  return {
+    pkgList,
+    rootList,
+    dependenciesList
+  };
 };
 
 // taken from a very old package https://github.com/keithamus/parse-packagejson-name/blob/master/index.js