type: CreationInfo
spec version: 3.0.1
created by: SPDXRef-gnrtd2
created using: syft-[not provided] (additionalToolSPDXRef-gnrtd3)
created: 2026-07-04T04:28:12Z

type: CreationInfo
spec version: 3.0.1
created by: SPDXRef-gnrtd0
created using: syft-[not provided] (additionalToolSPDXRef-gnrtd1)
created: 2026-07-04T04:28:12Z

spdx id: https://anchore.com/syft/dir/repo/openeuler/openEuler-24.03-LTS-SP4/everything/aarch64-074b704b-0eaf-4bcb-89c3-8ea4fa68b0fd-specv3/SPDXRef-gnrtd20919
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd20920
from: cdi-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd21187
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd21188
from: jakarta-server-pages-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20230
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd20231
from: glassfish-servlet-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22175
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd22176
from: apache-commons-digester
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20981
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd20982
from: glassfish-jsp-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22172
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd22173
from: apache-commons-digester
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2762
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd2763
from: java-1.8.0-openjdk-headless
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2924
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd2925
from: java-11-openjdk-headless
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd48025
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd48026
from: glassfish-ejb-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd53453
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd10431
from: hibernate-jpa-2.1-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20914
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd20915
from: jakarta-el-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd26410
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd26411
from: bean-validation-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd59398
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd59399
from: jboss-jstl-1.2-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76074
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd76075
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd23883
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd23884
from: glassfish-annotation-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76077
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd76078
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20233
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd20234
from: glassfish-servlet-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd17686
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd17687
from: atinject
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd48028
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd48029
from: glassfish-ejb-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20219
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd20220
from: jakarta-servlet
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20984
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd20985
from: glassfish-jsp-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2927
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd2928
from: java-11-openjdk-headless
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd17683
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd17684
from: atinject
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd26407
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd26408
from: bean-validation-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd23886
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd23887
from: glassfish-annotation-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20917
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd20918
from: jakarta-el-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2759
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd2760
from: java-1.8.0-openjdk-headless
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20922
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd20923
from: cdi-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd21190
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd21191
from: jakarta-server-pages-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd53455
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd10431
from: hibernate-jpa-2.1-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2693
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd546
from: javapackages-filesystem
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20222
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd20223
from: jakarta-servlet
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2695
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd546
from: javapackages-filesystem
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd59401
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd59402
from: jboss-jstl-1.2-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76060
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: bean-validation-api
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76062
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: cdi-api
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76073
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: java-1.8.0-openjdk-headless
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76070
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: jakarta-el-api
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76067
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: glassfish-jsp-api
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76071
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: jakarta-server-pages-api
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76068
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: glassfish-servlet-api
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76072
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: jakarta-servlet
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76061
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: java-11-openjdk-headless
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76069
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: hibernate-jpa-2.1-api
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76065
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: jboss-jstl-1.2-api
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76063
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: javapackages-filesystem
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76064
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: glassfish-annotation-api
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76059
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: atinject
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76058
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: apache-commons-digester
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76066
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: glassfish-ejb-api
from: mojarra
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd48029
type: simplelicensing_LicenseExpression
simplelicensing license expression: CDDL-1.1 or GPLv2 with exceptions
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd17684
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2763
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20982
type: simplelicensing_LicenseExpression
simplelicensing license expression: (CDDL-1.1 or GPLv2 with exceptions) and ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd26408
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd23887
type: simplelicensing_LicenseExpression
simplelicensing license expression: (GPL-2.0-with-classpath-exception OR CDDL-1.1)
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76075
type: simplelicensing_LicenseExpression
simplelicensing license expression: CDDL-1.0 or GPLv2 with exceptions
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2925
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA-MD
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd17687
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd59402
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0 and (CDDL-1.1 or GPLv2 with exceptions)
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20923
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2760
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20920
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd21191
type: simplelicensing_LicenseExpression
simplelicensing license expression: (EPL-2.0 or GPLv2 with exceptions) and ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd59399
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0 and (CDDL-1.1 or GPLv2 with exceptions)
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd10431
type: simplelicensing_LicenseExpression
simplelicensing license expression: EPL-1.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20223
type: simplelicensing_LicenseExpression
simplelicensing license expression: (EPL-2.0 or GPLv2 with exceptions) and ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd546
type: simplelicensing_LicenseExpression
simplelicensing license expression: BSD-3-Clause
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20231
type: simplelicensing_LicenseExpression
simplelicensing license expression: ((GPL-2.0-with-classpath-exception OR CDDL-1.1) AND Apache-2.0)
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20918
type: simplelicensing_LicenseExpression
simplelicensing license expression: EPL-2.0 or GPLv2 with exceptions
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22176
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2928
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA-MD
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20234
type: simplelicensing_LicenseExpression
simplelicensing license expression: ((GPL-2.0-with-classpath-exception OR CDDL-1.1) AND Apache-2.0)
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd21188
type: simplelicensing_LicenseExpression
simplelicensing license expression: (EPL-2.0 or GPLv2 with exceptions) and ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20220
type: simplelicensing_LicenseExpression
simplelicensing license expression: (EPL-2.0 or GPLv2 with exceptions) and ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22173
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd26411
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20915
type: simplelicensing_LicenseExpression
simplelicensing license expression: EPL-2.0 or GPLv2 with exceptions
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76078
type: simplelicensing_LicenseExpression
simplelicensing license expression: CDDL-1.0 or GPLv2 with exceptions
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20985
type: simplelicensing_LicenseExpression
simplelicensing license expression: (CDDL-1.1 or GPLv2 with exceptions) and ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd23884
type: simplelicensing_LicenseExpression
simplelicensing license expression: (GPL-2.0-with-classpath-exception OR CDDL-1.1)
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd48026
type: simplelicensing_LicenseExpression
simplelicensing license expression: CDDL-1.1 or GPLv2 with exceptions
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2926
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20221
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22174
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20921
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2694
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd21189
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd23885
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd59400
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd26409
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2761
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd53454
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20983
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76076
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd17685
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20916
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd48027
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20232
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2692
type: software_Package
supplied by: SPDXRef-gnrtd2694
software download location: NOASSERTION
summary: Filesystem layout for java packages
software package version: 0:5.3.0-6.oe2403sp4
software home page: https://github.com/fedora-java/javapackages
description: The javapackages-filesystem package contains some basic directories into which Java packages install their content.
name: javapackages-filesystem
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2629
type: software_Package
supplied by: SPDXRef-gnrtd2761
name: java-1.8.0-openjdk-headless
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: OpenJDK Headless Runtime Environment 8
software package version: 1:1.8.0.492.b09-5.oe2403sp4
software home page: http://openjdk.java.net/
description: The OpenJDK runtime environment 8 without audio and video support.
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22166
type: software_Package
supplied by: SPDXRef-gnrtd22174
name: apache-commons-digester
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: XML to Java object mapping module
software package version: 0:2.1-1.oe2403sp4
software home page: http://commons.apache.org/digester/
description: Many projects read XML configuration files to provide initialization of various Java objects within the system. There are several ways of doing this, and the Digester component was designed to provide a common implementation that can be used in many different projects
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/commons-digester/commons-digester@2.1
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.commons/commons-digester@2.1
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20226
type: software_Package
supplied by: SPDXRef-gnrtd20232
name: glassfish-servlet-api
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: API of Java Servlet
software package version: 0:3.1.0-17.oe2403sp4
software home page: http://servlet-spec.java.net
description: Java Servlets is a JCP Standard technology for interacting with the web on the Java EE platform. It is the foundation web specification in the Java Enterprise Platform. Developers can build web applications using the Servlet API to interact with the request/response workflow. This package provides some classes and interfaces which define and describe the contracts between a servlet class and the runtime environment provided for an instance of such a class.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.servlet/servlet-api@3.1.0
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.servlet/javax.servlet-api@3.1.0
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.geronimo.specs/geronimo-servlet_3.0_spec@3.1.0
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.eclipse.jetty.orbit/javax.servlet@3.1.0
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20894
type: software_Package
supplied by: SPDXRef-gnrtd20921
name: cdi-api
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: API for CDI
software package version: 0:1.2-10.oe2403sp4
software home page: http://seamframework.org/Weld
description: Contexts and Dependency Injection for Java EE which is called APIs for JSR-299.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.enterprise/cdi-api@1.2
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd76057
type: software_Package
supplied by: SPDXRef-gnrtd76076
name: mojarra
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: JSF Reference Implementation
software package version: 0:2.2.13-3.oe2403sp4
software home page: http://javaserverfaces.java.net
description: JvaServer(TM) Faces technology simplifies building user interfaces for JavaServer applications. Developers of various skill levels can quickly build web applications by: assembling reusable UI components in a page; connecting these components to an application data source; and wiring client-generated events to server-side event handlers.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.faces/javax.faces-api@2.2.13
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/com.sun.faces/jsf-impl@2.2.13
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.glassfish/javax.faces@2.2.13
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/com.sun.faces/jsf-api@2.2.13
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd59390
type: software_Package
supplied by: SPDXRef-gnrtd59400
name: jboss-jstl-1.2-api
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: JSP Standard Template Library 1.2 API
software package version: 0:1.1.4-2.oe2403sp4
software home page: https://github.com/jboss/jboss-jstl-api_spec
description: Java Server Pages Standard Template Library 1.2 API.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.jboss.spec.javax.servlet.jstl/jboss-jstl-api_1.2_spec@1.1.4.Final
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20215
type: software_Package
supplied by: SPDXRef-gnrtd20221
name: jakarta-servlet
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Server-side API for handling HTTP requests and responses
software package version: 0:5.0.0-4.oe2403sp4
software home page: https://github.com/eclipse-ee4j/servlet-api
description: Jakarta Servlet defines a server-side API for handling HTTP requests and responses.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/jakarta.servlet/jakarta.servlet-api@5.0.0
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.servlet/javax.servlet-api@5.0.0
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.servlet/servlet-api@5.0.0
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2834
type: software_Package
supplied by: SPDXRef-gnrtd2926
name: java-11-openjdk-headless
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: OpenJDK Headless Runtime Environment 11
software package version: 1:11.0.31.11-5.oe2403sp4
software home page: http://openjdk.java.net/
description: The OpenJDK runtime environment 11 without audio and video support.
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd26403
type: software_Package
supplied by: SPDXRef-gnrtd26409
name: bean-validation-api
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Bean Validation API (JSR 349)
software package version: 0:1.1.0-13.oe2403sp4
software home page: https://github.com/beanvalidation/beanvalidation-api/
description: This module includes Bean Validation (JSR-349) API.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.validation/validation-api@1.1.0.Final
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd17679
type: software_Package
supplied by: SPDXRef-gnrtd17685
name: atinject
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Java API for JSR-330 Dependency Injection
software package version: 0:1-31.oe2403sp4
software home page: https://github.com/svn2github/atinject/
description: AtInject is the Java API build by the JSR-330.It's a set of API aiming to standardize an extensible dependency injection paradigm, as those provided by Guice, Spring or Plexus projects.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.inject/javax.inject@1
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd23879
type: software_Package
supplied by: SPDXRef-gnrtd23885
name: glassfish-annotation-api
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Java(TM) Specification APIs
software package version: 0:1.2-17.oe2403sp4
software home page: http://glassfish.java.net/
description: This package is a general annotations API for the Java platform (JSR 250).
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.annotation/javax.annotation-api@1.2
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20974
type: software_Package
supplied by: SPDXRef-gnrtd20983
name: glassfish-jsp-api
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Glassfish J2EE JSP API specification
software package version: 0:2.3.3-3.oe2403sp4
software home page: https://github.com/javaee/javaee-jsp-api
description: This project provides a container independent specification of JSP 2.2.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.servlet/jsp-api@2.3.4.SNAPSHOT
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.servlet.jsp/javax.servlet.jsp-api@2.3.4.SNAPSHOT
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd21183
type: software_Package
supplied by: SPDXRef-gnrtd21189
name: jakarta-server-pages-api
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Jakarta Server Pages (JSP) API
software package version: 0:2.3.6-1.oe2403sp4
software home page: https://github.com/eclipse-ee4j/jsp-api
description: Jakarta Server Pages provides a container-independent implementation of the JSP API. This package contains the API only.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.servlet.jsp/javax.servlet.jsp-api@2.3.6
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.servlet.jsp/jsp-api@2.3.6
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.servlet/jsp-api@2.3.6
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/jakarta.servlet.jsp/jakarta.servlet.jsp-api@2.3.6
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd48011
type: software_Package
supplied by: SPDXRef-gnrtd48027
name: glassfish-ejb-api
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Java EJB 3.2 API Design Specification
software package version: 0:3.2.2-3.oe2403sp4
software home page: https://java.net/projects/ejb-spec/
description: Project GlassFish Enterprise JavaBean API.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.ejb/javax.ejb-api@3.2.2
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd53449
type: software_Package
supplied by: SPDXRef-gnrtd53454
name: hibernate-jpa-2.1-api
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Java Persistence 2.1 API
software package version: 0:1.0.0-8.oe2403sp4
software home page: http://www.hibernate.org/
description: Java Persistence 2.1 API
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.hibernate.javax.persistence/hibernate-jpa-2.1-api@1.0.0.Final
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20910
type: software_Package
supplied by: SPDXRef-gnrtd20916
name: jakarta-el-api
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Jakarta Expression Language API
software package version: 0:4.0.0-4.oe2403sp4
software home page: https://github.com/jakartaee/expression-language
description: Jakarta Expression Language provides a specification document, API, reference implementation and TCK that describes an expression language for Java applications. This package contains only the API.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.el/javax.el-api@4.0.0
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/jakarta.el/jakarta.el-api@4.0.0
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.el/el-api@4.0.0
  external ref type: other
creation info: _:creationInfo_0

spdx id: additionalToolSPDXRef-gnrtd3
type: Tool
name: syft-[not provided]
creation info: _:creationInfo_1

spdx id: additionalToolSPDXRef-gnrtd1
type: Tool
name: syft-[not provided]
creation info: _:creationInfo_0