reduce nesting

will make it easier to add more stringent checking to EL6 version

(cherry picked from commit 9832f8a598e29ffe7e7f577d82c44ab06933986c)
only look for deps in the package.json in the toplevel module dir

this is only needed on EL6 because the fileattrs magic in RPM does
this for us in modern Fedora