@cyclonedx/cdxgen 9.4.0 → 9.6.0

package/README.md

@@ -2,13 +2,13 @@
 
 ![cdxgen logo](cdxgen.png)
 
-cdxgen is a cli tool and a library to create a valid and compliant [CycloneDX][cyclonedx-homepage] Software Bill-of-Materials (SBOM) containing an aggregate of all project dependencies for c/c++, node.js, php, python, ruby, rust, java, .Net, dart, haskell, elixir, and Go projects in JSON format. CycloneDX 1.5 is a lightweight SBOM specification that is easily created, human and machine-readable, and simple to parse.
+cdxgen is a cli tool, library, [REPL](./ADVANCED.md) and server to create a valid and compliant [CycloneDX][cyclonedx-homepage] Software Bill-of-Materials (SBOM) containing an aggregate of all project dependencies for c/c++, node.js, php, python, ruby, rust, java, .Net, dart, haskell, elixir, and Go projects in JSON format. CycloneDX 1.5 is a lightweight SBOM specification that is easily created, human and machine-readable, and simple to parse.
 
-When used with plugins, cdxgen could generate an SBoM for Linux docker images and even VMs running Linux or Windows operating system.
+When used with plugins, cdxgen could generate an SBoM for Linux docker images and even VMs running Linux or Windows operating system. cdxgen also includes a tool called `evinse` that can generate component evidences for some languages.
 
 NOTE:
 
-CycloneDX 1.5 specification is brand new and unsupported by many downstream tools. Use version 8.6.0 for 1.4 compatibility or pass the argument `--spec-version 1.4`.
+CycloneDX 1.5 specification is new and unsupported by many downstream tools. Use version 8.6.0 for 1.4 compatibility or pass the argument `--spec-version 1.4`.
 
 ## Why cdxgen?
 
@@ -93,7 +93,7 @@ sudo npm install -g @cyclonedx/cdxgen@8.6.0
 Deno install is also supported.
 
 ```shell
-deno install --allow-read --allow-env --allow-run --allow-sys=uid,systemMemoryInfo --allow-write --allow-net -n cdxgen "npm:@cyclonedx/cdxgen"
+deno install --allow-read --allow-env --allow-run --allow-sys=uid,systemMemoryInfo --allow-write --allow-net -n cdxgen "npm:@cyclonedx/cdxgen/cdxgen"
 ```
 
 You can also use the cdxgen container image
@@ -282,39 +282,42 @@ cdxgen can retain the dependency tree under the `dependencies` attribute for a s
 - pnpm-lock.yaml
 - Maven (pom.xml)
 - Gradle
+- Scala SBT
 - Python (requirements.txt, setup.py, pyproject.toml, poetry.lock)
 
 ## Environment variables
 
-| Variable                     | Description                                                                                                                 |
-| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
-| CDXGEN_DEBUG_MODE            | Set to `debug` to enable debug messages                                                                                     |
-| GITHUB_TOKEN                 | Specify GitHub token to prevent traffic shaping while querying license and repo information                                 |
-| MVN_CMD                      | Set to override maven command                                                                                               |
-| MVN_ARGS                     | Set to pass additional arguments such as profile or settings to maven                                                       |
-| MAVEN_HOME                   | Specify maven home                                                                                                          |
-| GRADLE_CACHE_DIR             | Specify gradle cache directory. Useful for class name resolving                                                             |
-| GRADLE_MULTI_PROJECT_MODE    | Unused. Automatically handled                                                                                               |
-| GRADLE_ARGS                  | Set to pass additional arguments such as profile or settings to gradle (all tasks). Eg: --configuration runtimeClassPath    |
-| GRADLE_ARGS_PROPERTIES       | Set to pass additional arguments only to the `gradle properties` task, used for collecting metadata about the project       |
-| GRADLE_ARGS_DEPENDENCIES     | Set to pass additional arguments only to the `gradle dependencies` task, used for listing actual project dependencies       |
-| GRADLE_HOME                  | Specify gradle home                                                                                                         |
-| GRADLE_CMD                   | Set to override gradle command                                                                                              |
-| GRADLE_DEPENDENCY_TASK       | By default cdxgen use the task "dependencies" to collect packages. Set to override the task name.                           |
-| SBT_CACHE_DIR                | Specify sbt cache directory. Useful for class name resolving                                                                |
-| FETCH_LICENSE                | Set this variable to `true` or `1` to fetch license information from the registry. npm and golang                           |
-| USE_GOSUM                    | Set to `true` or `1` to generate BOMs for golang projects using go.sum as the dependency source of truth, instead of go.mod |
-| CDXGEN_TIMEOUT_MS            | Default timeout for known execution involving maven, gradle or sbt                                                          |
-| CDXGEN_SERVER_TIMEOUT_MS     | Default timeout in server mode                                                                                              |
-| BAZEL_TARGET                 | Bazel target to build. Default :all (Eg: //java-maven)                                                                      |
-| CLJ_CMD                      | Set to override the clojure cli command                                                                                     |
-| LEIN_CMD                     | Set to override the leiningen command                                                                                       |
-| SBOM_SIGN_ALGORITHM          | Signature algorithm. Some valid values are RS256, RS384, RS512, PS256, PS384, PS512, ES256 etc                              |
-| SBOM_SIGN_PRIVATE_KEY        | Private key to use for signing                                                                                              |
-| SBOM_SIGN_PUBLIC_KEY         | Optional. Public key to include in the SBoM signature                                                                       |
-| CDX_MAVEN_PLUGIN             | CycloneDX Maven plugin to use. Default "org.cyclonedx:cyclonedx-maven-plugin:2.7.8"                                         |
-| CDX_MAVEN_GOAL               | CycloneDX Maven plugin goal to use. Default makeAggregateBom. Other options: makeBom, makePackageBom                        |
-| CDX_MAVEN_INCLUDE_TEST_SCOPE | Whether test scoped dependencies should be included from Maven projects, Default: true                                      |
+| Variable                     | Description                                                                                                                          |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
+| CDXGEN_DEBUG_MODE            | Set to `debug` to enable debug messages                                                                                              |
+| GITHUB_TOKEN                 | Specify GitHub token to prevent traffic shaping while querying license and repo information                                          |
+| MVN_CMD                      | Set to override maven command                                                                                                        |
+| MVN_ARGS                     | Set to pass additional arguments such as profile or settings to maven                                                                |
+| MAVEN_HOME                   | Specify maven home                                                                                                                   |
+| GRADLE_CACHE_DIR             | Specify gradle cache directory. Useful for class name resolving                                                                      |
+| GRADLE_MULTI_PROJECT_MODE    | Unused. Automatically handled                                                                                                        |
+| GRADLE_ARGS                  | Set to pass additional arguments such as profile or settings to gradle (all tasks). Eg: --configuration runtimeClassPath             |
+| GRADLE_ARGS_PROPERTIES       | Set to pass additional arguments only to the `gradle properties` task, used for collecting metadata about the project                |
+| GRADLE_ARGS_DEPENDENCIES     | Set to pass additional arguments only to the `gradle dependencies` task, used for listing actual project dependencies                |
+| GRADLE_HOME                  | Specify gradle home                                                                                                                  |
+| GRADLE_CMD                   | Set to override gradle command                                                                                                       |
+| GRADLE_DEPENDENCY_TASK       | By default cdxgen use the task "dependencies" to collect packages. Set to override the task name.                                    |
+| SBT_CACHE_DIR                | Specify sbt cache directory. Useful for class name resolving                                                                         |
+| FETCH_LICENSE                | Set this variable to `true` or `1` to fetch license information from the registry. npm and golang                                    |
+| USE_GOSUM                    | Set to `true` or `1` to generate BOMs for golang projects using go.sum as the dependency source of truth, instead of go.mod          |
+| CDXGEN_TIMEOUT_MS            | Default timeout for known execution involving maven, gradle or sbt                                                                   |
+| CDXGEN_SERVER_TIMEOUT_MS     | Default timeout in server mode                                                                                                       |
+| BAZEL_TARGET                 | Bazel target to build. Default :all (Eg: //java-maven)                                                                               |
+| CLJ_CMD                      | Set to override the clojure cli command                                                                                              |
+| LEIN_CMD                     | Set to override the leiningen command                                                                                                |
+| SBOM_SIGN_ALGORITHM          | Signature algorithm. Some valid values are RS256, RS384, RS512, PS256, PS384, PS512, ES256 etc                                       |
+| SBOM_SIGN_PRIVATE_KEY        | Private key to use for signing                                                                                                       |
+| SBOM_SIGN_PUBLIC_KEY         | Optional. Public key to include in the SBoM signature                                                                                |
+| CDX_MAVEN_PLUGIN             | CycloneDX Maven plugin to use. Default "org.cyclonedx:cyclonedx-maven-plugin:2.7.8"                                                  |
+| CDX_MAVEN_GOAL               | CycloneDX Maven plugin goal to use. Default makeAggregateBom. Other options: makeBom, makePackageBom                                 |
+| CDX_MAVEN_INCLUDE_TEST_SCOPE | Whether test scoped dependencies should be included from Maven projects, Default: true                                               |
+| ASTGEN_IGNORE_DIRS           | Comma separated list of directories to ignore while analyzing using babel. The environment variable is also used by atom and astgen. |
+| ASTGEN_IGNORE_FILE_PATTERN   | Ignore regex to use                                                                                                                  |
 
 ## Plugins
 
@@ -373,6 +376,10 @@ cdxgen -t os
 
 This feature is powered by osquery which is [installed](https://github.com/cyclonedx/cdxgen-plugins-bin/blob/main/build.sh#L8) along with the binary plugins. cdxgen would opportunistically try to detect as many components, apps and extensions as possible using the [default queries](queries.json). The process would take several minutes and result in an SBoM file with thousands of components.
 
+## Generating component evidence
+
+See [evinse mode](./ADVANCED.md) in the advanced documentation.
+
 ## SBoM signing
 
 cdxgen can sign the generated SBoM json file to increase authenticity and non-repudiation capabilities. To enable this, set the following environment variables.
@@ -385,7 +392,16 @@ To generate test public/private key pairs, you can run cdxgen by passing the arg
 
 ![SBoM signing](sbom-sign.jpg)
 
-### Verifying the signature (Node.js example)
+### Verifying the signature
+
+Use the bundled `cdx-verify` command which supports verifying a single signature added at the bom level.
+
+```shell
+npm install -g @cyclonedx/cdxgen
+cdx-verify -i bom.json --public-key public.key
+```
+
+### Custom verification tool (Node.js example)
 
 There are many [libraries](https://jwt.io/#libraries-io) available to validate JSON Web Tokens. Below is a javascript example.
 
@@ -410,7 +426,7 @@ if (validationResult) {
 
 ## Automatic services detection
 
-cdxgen could automatically detect names of services from YAML manifests such as docker-compose or Kubernetes or Skaffold manifests. These would be populated under the `services` attribute in the generated SBoM. Please help improve this feature by filing issues for any inaccurate detection.
+cdxgen can automatically detect names of services from YAML manifests such as docker-compose or Kubernetes or Skaffold manifests. These would be populated under the `services` attribute in the generated SBoM. With [evinse](./ADVANCED.md), additional services could be detected by parsing common annotations from the source code.
 
 ## Conversion to SPDX format
 
@@ -443,50 +459,6 @@ const bomNSData = await createBom(filePath, options);
 const dbody = await submitBom(args, bomNSData.bomJson);
 ```
 
-## Interactive mode
-
-`cdxi` is a new interactive REPL server to interactively create, import and search an SBoM. All the exported functions from cdxgen and node.js could be used in this mode. In addition, several custom commands are defined.
-
-### Custom commands
-
-| Command   | Description                                                                                                                                                                                                    |
-| --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| .create   | Create an SBoM from a path                                                                                                                                                                                     |
-| .import   | Import an existing SBoM from a path. Any SBoM in CycloneDX format is supported.                                                                                                                                |
-| .search   | Search the given string in the components name, group, purl and description                                                                                                                                    |
-| .sort     | Sort the components based on the given attribute. Eg: .sort name to sort by name. Accepts full jsonata [order by](http://docs.jsonata.org/path-operators#order-by-) clause too. Eg: `.sort components^(>name)` |
-| .query    | Pass a raw query in [jsonata](http://docs.jsonata.org/) format                                                                                                                                                 |
-| .print    | Print the SBoM as a table                                                                                                                                                                                      |
-| .tree     | Print the dependency tree if available                                                                                                                                                                         |
-| .validate | Validate the SBoM                                                                                                                                                                                              |
-| .exit     | To exit the shell                                                                                                                                                                                              |
-| .save     | To save the modified SBoM to a new file                                                                                                                                                                        |
-| .update   | Update components based on query expression. Use syntax `\| query \| new object \|`. See example.                                                                                                              |
-
-### Sample REPL usage
-
-Start the REPL server.
-
-```shell
-cdxi
-```
-
-Below are some example commands to create an SBoM for a spring application and perform searches and queries.
-
-```
-.create /mnt/work/vuln-spring
-.print
-.search spring
-.query components[name ~> /spring/ and scope = "required"]
-.sort name
-.sort components^(>name)
-.update | components[name ~> /spring/] | {'publisher': "foo"} |
-```
-
-### REPL History
-
-Repl history will get persisted under `$HOME/.config/.cdxgen` directory. To override this location, use the environment variable `CDXGEN_REPL_HISTORY`.
-
 ## Node.js >= 20 permission model
 
 Refer to the [permissions document](./docs/PERMISSIONS.md)

package/analyzer.js

@@ -1,29 +1,38 @@
 import { parse } from "@babel/parser";
-import babelTraverse from "@babel/traverse";
+import traverse from "@babel/traverse";
 import { join } from "path";
 import { readdirSync, statSync, readFileSync } from "fs";
-import { basename, resolve, isAbsolute } from "path";
+import { basename, resolve, isAbsolute, relative } from "path";
 
-const IGNORE_DIRS = [
-  "node_modules",
-  "venv",
-  "docs",
-  "test",
-  "tests",
-  "e2e",
-  "examples",
-  "cypress",
-  "site-packages",
-  "typings",
-  "api_docs",
-  "dev_docs",
-  "types",
-  "mock",
-  "mocks"
-];
+const IGNORE_DIRS = process.env.ASTGEN_IGNORE_DIRS
+  ? process.env.ASTGEN_IGNORE_DIRS.split(",")
+  : [
+      "node_modules",
+      "venv",
+      "docs",
+      "test",
+      "tests",
+      "e2e",
+      "examples",
+      "cypress",
+      "site-packages",
+      "typings",
+      "api_docs",
+      "dev_docs",
+      "types",
+      "mock",
+      "mocks",
+      "jest-cache",
+      "eslint-rules",
+      "codemods",
+      "flow-typed",
+      "i18n",
+      "__tests__"
+    ];
 
 const IGNORE_FILE_PATTERN = new RegExp(
-  "(conf|test|spec|mock|\\.d)\\.(js|ts|tsx)$",
+  process.env.ASTGEN_IGNORE_FILE_PATTERN ||
+    "(conf|config|test|spec|mock|\\.d)\\.(js|ts|tsx)$",
   "i"
 );
 
@@ -33,7 +42,7 @@ const getAllFiles = (dir, extn, files, result, regex) => {
   regex = regex || new RegExp(`\\${extn}$`);
 
   for (let i = 0; i < files.length; i++) {
-    if (IGNORE_FILE_PATTERN.test(files[i])) {
+    if (IGNORE_FILE_PATTERN.test(files[i]) || files[i].startsWith(".")) {
       continue;
     }
     const file = join(dir, files[i]);
@@ -64,6 +73,7 @@ const babelParserOptions = {
   sourceType: "unambiguous",
   allowImportExportEverywhere: true,
   allowAwaitOutsideFunction: true,
+  allowNewTargetOutsideFunction: true,
   allowReturnOutsideFunction: true,
   allowSuperOutsideMethod: true,
   errorRecovery: true,
@@ -86,48 +96,95 @@ const babelParserOptions = {
  * Filter only references to (t|jsx?) or (less|scss) files for now.
  * Opt to use our relative paths.
  */
-const setFileRef = (allImports, file, pathway) => {
+const setFileRef = (allImports, src, file, pathnode, specifiers = []) => {
+  const pathway = pathnode.value || pathnode.name;
+  const sourceLoc = pathnode.loc?.start;
+  if (!pathway) {
+    return;
+  }
+  const fileRelativeLoc = relative(src, file);
   // remove unexpected extension imports
   if (/\.(svg|png|jpg|d\.ts)/.test(pathway)) {
     return;
   }
-
+  const importedModules = specifiers
+    .map((s) => s.imported?.name)
+    .filter((v) => v !== undefined);
+  const occurrence = {
+    importedAs: pathway,
+    importedModules,
+    isExternal: true,
+    fileName: fileRelativeLoc,
+    lineNumber: sourceLoc && sourceLoc.line ? sourceLoc.line : undefined,
+    columnNumber: sourceLoc && sourceLoc.column ? sourceLoc.column : undefined
+  };
   // replace relative imports with full path
-  let module = pathway;
+  let moduleFullPath = pathway;
+  let wasAbsolute = false;
   if (/\.\//g.test(pathway) || /\.\.\//g.test(pathway)) {
-    module = resolve(file, "..", pathway);
-  }
-
-  // initialise or increase reference count for file
-  if (Object.prototype.hasOwnProperty.call(allImports, module)) {
-    allImports[module] = allImports[module] + 1;
-  } else {
-    allImports[module] = 1;
+    moduleFullPath = resolve(file, "..", pathway);
+    if (isAbsolute(moduleFullPath)) {
+      moduleFullPath = relative(src, moduleFullPath);
+      wasAbsolute = true;
+    }
+    occurrence.isExternal = false;
   }
-
+  allImports[moduleFullPath] = allImports[moduleFullPath] || new Set();
+  allImports[moduleFullPath].add(occurrence);
   // Handle module package name
   // Eg: zone.js/dist/zone will be referred to as zone.js in package.json
-  if (!isAbsolute(module) && module.includes("/")) {
-    const modPkg = module.split("/")[0];
-    if (Object.prototype.hasOwnProperty.call(allImports, modPkg)) {
-      allImports[modPkg] = allImports[modPkg] + 1;
-    } else {
-      allImports[modPkg] = 1;
-    }
+  if (!wasAbsolute && moduleFullPath.includes("/")) {
+    const modPkg = moduleFullPath.split("/")[0];
+    allImports[modPkg] = allImports[modPkg] || new Set();
+    allImports[modPkg].add(occurrence);
+  }
+};
+
+const vueCleaningRegex = /<\/*script.*>|<style[\s\S]*style>|<\/*br>/gi;
+const vueTemplateRegex = /(<template.*>)([\s\S]*)(<\/template>)/gi;
+const vueCommentRegex = /<!--[\s\S]*?-->/gi;
+const vueBindRegex = /(:\[)([\s\S]*?)(\])/gi;
+const vuePropRegex = /\s([.:@])([a-zA-Z]*?=)/gi;
+
+const fileToParseableCode = (file) => {
+  let code = readFileSync(file, "utf-8");
+  if (file.endsWith(".vue") || file.endsWith(".svelte")) {
+    code = code
+      .replace(vueCommentRegex, function (match) {
+        return match.replaceAll(/\S/g, " ");
+      })
+      .replace(vueCleaningRegex, function (match) {
+        return match.replaceAll(/\S/g, " ").substring(1) + ";";
+      })
+      .replace(vueBindRegex, function (match, grA, grB, grC) {
+        return grA.replaceAll(/\S/g, " ") + grB + grC.replaceAll(/\S/g, " ");
+      })
+      .replace(vuePropRegex, function (match, grA, grB) {
+        return " " + grA.replace(/[.:@]/g, " ") + grB;
+      })
+      .replace(vueTemplateRegex, function (match, grA, grB, grC) {
+        return grA + grB.replaceAll("{{", "{ ").replaceAll("}}", " }") + grC;
+      });
   }
+  return code;
 };
 
 /**
  * Check AST tree for any (j|tsx?) files and set a file
  * references for any import, require or dynamic import files.
  */
-const parseFileASTTree = (file, allImports) => {
-  const ast = parse(readFileSync(file, "utf-8"), babelParserOptions);
-  babelTraverse(ast, {
-    // Used for all ES6 import statements
+const parseFileASTTree = (src, file, allImports) => {
+  const ast = parse(fileToParseableCode(file), babelParserOptions);
+  traverse.default(ast, {
     ImportDeclaration: (path) => {
       if (path && path.node) {
-        setFileRef(allImports, file, path.node.source.value);
+        setFileRef(
+          allImports,
+          src,
+          file,
+          path.node.source,
+          path.node.specifiers
+        );
       }
     },
     // For require('') statements
@@ -138,23 +195,29 @@ const parseFileASTTree = (file, allImports) => {
         path.node.name === "require" &&
         path.parent.type === "CallExpression"
       ) {
-        setFileRef(allImports, file, path.parent.arguments[0].value);
+        setFileRef(allImports, src, file, path.parent.arguments[0]);
       }
     },
     // Use for dynamic imports like routes.jsx
     CallExpression: (path) => {
       if (path && path.node && path.node.callee.type === "Import") {
-        setFileRef(allImports, file, path.node.arguments[0].value);
+        setFileRef(allImports, src, file, path.node.arguments[0]);
       }
     },
     // Use for export barrells
     ExportAllDeclaration: (path) => {
-      setFileRef(allImports, file, path.node.source.value);
+      setFileRef(allImports, src, file, path.node.source);
     },
     ExportNamedDeclaration: (path) => {
       // ensure there is a path export
       if (path && path.node && path.node.source) {
-        setFileRef(allImports, file, path.node.source.value);
+        setFileRef(
+          allImports,
+          src,
+          file,
+          path.node.source,
+          path.node.specifiers
+        );
       }
     }
   });
@@ -167,8 +230,12 @@ const getAllSrcJSAndTSFiles = (src) =>
   Promise.all([
     getAllFiles(src, ".js"),
     getAllFiles(src, ".jsx"),
+    getAllFiles(src, ".cjs"),
+    getAllFiles(src, ".mjs"),
     getAllFiles(src, ".ts"),
-    getAllFiles(src, ".tsx")
+    getAllFiles(src, ".tsx"),
+    getAllFiles(src, ".vue"),
+    getAllFiles(src, ".svelte")
   ]);
 
 /**
@@ -182,7 +249,7 @@ export const findJSImports = async (src) => {
     const srcFiles = promiseMap.flatMap((d) => d);
     for (const file of srcFiles) {
       try {
-        parseFileASTTree(file, allImports);
+        parseFileASTTree(src, file, allImports);
       } catch (err) {
         errFiles.push(file);
       }

package/bin/cdxgen.js

@@ -313,13 +313,30 @@ const checkPermissions = (filePath) => {
             }
           }
           try {
+            // Sign the individual components
+            // Let's leave the services unsigned for now since it might require additional cleansing
+            const bomJsonUnsignedObj = JSON.parse(jsonPayload);
+            for (const comp of bomJsonUnsignedObj.components) {
+              const compSignature = jws.sign({
+                header: { alg },
+                payload: comp,
+                privateKey: privateKeyToUse
+              });
+              const compSignatureBlock = {
+                algorithm: alg,
+                value: compSignature
+              };
+              if (jwkPublicKey) {
+                compSignatureBlock.publicKey = jwkPublicKey;
+              }
+              comp.signature = compSignatureBlock;
+            }
             const signature = jws.sign({
               header: { alg },
-              payload: jsonPayload,
+              payload: JSON.stringify(bomJsonUnsignedObj, null, 2),
               privateKey: privateKeyToUse
             });
             if (signature) {
-              const bomJsonUnsignedObj = JSON.parse(jsonPayload);
               const signatureBlock = {
                 algorithm: alg,
                 value: signature

package/bin/evinse.js

@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+
+// Evinse (Evinse Verification Is Nearly SBoM Evidence)
+import yargs from "yargs";
+import { hideBin } from "yargs/helpers";
+import { join } from "node:path";
+import fs from "node:fs";
+import { homedir, platform as _platform } from "node:os";
+import process from "node:process";
+import { analyzeProject, createEvinseFile, prepareDB } from "../evinser.js";
+import { validateBom } from "../validator.js";
+import { printCallStack, printOccurrences, printServices } from "../display.js";
+
+const isWin = _platform() === "win32";
+const isMac = _platform() === "darwin";
+let ATOM_DB = join(homedir(), ".local", "share", ".atomdb");
+if (isWin) {
+  ATOM_DB = join(homedir(), "AppData", "Local", ".atomdb");
+} else if (isMac) {
+  ATOM_DB = join(homedir(), "Library", "Application Support", ".atomdb");
+}
+
+if (!process.env.ATOM_DB && !fs.existsSync(ATOM_DB)) {
+  try {
+    fs.mkdirSync(ATOM_DB, { recursive: true });
+  } catch (e) {
+    // ignore
+  }
+}
+const args = yargs(hideBin(process.argv))
+  .option("input", {
+    alias: "i",
+    description: "Input SBoM file. Default bom.json",
+    default: "bom.json"
+  })
+  .option("output", {
+    alias: "o",
+    description: "Output file. Default bom.evinse.json",
+    default: "bom.evinse.json"
+  })
+  .option("language", {
+    alias: "l",
+    description: "Application language",
+    default: "java",
+    choices: ["java", "jar", "javascript", "python", "android", "cpp"]
+  })
+  .option("db-path", {
+    description: `Atom slices DB path. Default ${ATOM_DB}`,
+    default: process.env.ATOM_DB || ATOM_DB
+  })
+  .option("force", {
+    description: "Force creation of the database",
+    default: false,
+    type: "boolean"
+  })
+  .option("skip-maven-collector", {
+    description:
+      "Skip collecting jars from maven and gradle caches. Can speedup re-runs if the data was cached previously.",
+    default: false,
+    type: "boolean"
+  })
+  .option("with-deep-jar-collector", {
+    description:
+      "Enable collection of all jars from maven cache directory. Useful to improve the recall for callstack evidence.",
+    default: false,
+    type: "boolean"
+  })
+  .option("annotate", {
+    description: "Include contents of atom slices as annotations",
+    default: false,
+    type: "boolean"
+  })
+  .option("with-data-flow", {
+    description: "Enable inter-procedural data-flow slicing.",
+    default: false,
+    type: "boolean"
+  })
+  .option("usages-slices-file", {
+    description: "Use an existing usages slices file.",
+    default: "usages.slices.json"
+  })
+  .option("data-flow-slices-file", {
+    description: "Use an existing data-flow slices file.",
+    default: "data-flow.slices.json"
+  })
+  .option("print", {
+    alias: "p",
+    type: "boolean",
+    description: "Print the evidences as table"
+  })
+  .scriptName("evinse")
+  .version()
+  .help("h").argv;
+
+const evinseArt = `
+███████╗██╗   ██╗██╗███╗   ██╗███████╗███████╗
+██╔════╝██║   ██║██║████╗  ██║██╔════╝██╔════╝
+█████╗  ██║   ██║██║██╔██╗ ██║███████╗█████╗  
+██╔══╝  ╚██╗ ██╔╝██║██║╚██╗██║╚════██║██╔══╝  
+███████╗ ╚████╔╝ ██║██║ ╚████║███████║███████╗
+╚══════╝  ╚═══╝  ╚═╝╚═╝  ╚═══╝╚══════╝╚══════╝
+`;
+
+console.log(evinseArt);
+(async () => {
+  // First, prepare the database by cataloging jars and other libraries
+  const dbObjMap = await prepareDB(args);
+  if (dbObjMap) {
+    // Analyze the project using atom. Convert package namespaces to purl using the db
+    const sliceArtefacts = await analyzeProject(dbObjMap, args);
+    // Create the SBoM with Evidence
+    const bomJson = createEvinseFile(sliceArtefacts, args);
+    // Validate our final SBoM
+    if (!validateBom(bomJson)) {
+      process.exit(1);
+    }
+    if (args.print) {
+      printOccurrences(bomJson);
+      printCallStack(bomJson);
+      printServices(bomJson);
+    }
+  }
+})();