type: CreationInfo
spec version: 3.0.1
created by: SPDXRef-gnrtd2
created using: syft-[not provided] (additionalToolSPDXRef-gnrtd3)
created: 2026-07-04T04:28:12Z

type: CreationInfo
spec version: 3.0.1
created by: SPDXRef-gnrtd0
created using: syft-[not provided] (additionalToolSPDXRef-gnrtd1)
created: 2026-07-04T04:28:12Z

spdx id: https://anchore.com/syft/dir/repo/openeuler/openEuler-24.03-LTS-SP4/everything/aarch64-074b704b-0eaf-4bcb-89c3-8ea4fa68b0fd-specv3/SPDXRef-gnrtd20005
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd20006
from: antlr-tool
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22175
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd22176
from: apache-commons-digester
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20123
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd20124
from: jakarta-oro
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd59381
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd59382
from: jboss-jsp-2.3-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd23088
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd23089
from: apache-commons-validator
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd23091
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd23092
from: apache-commons-validator
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22172
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd22173
from: apache-commons-digester
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22181
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd22182
from: apache-commons-chain
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2924
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd2925
from: java-11-openjdk-headless
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2762
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd2763
from: java-1.8.0-openjdk-headless
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20071
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd20072
from: apache-commons-logging
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112898
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd112899
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd60218
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd60219
from: tomcat-taglibs-standard
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd60215
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd60216
from: tomcat-taglibs-standard
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20075
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd20076
from: bsf
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20068
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd20069
from: apache-commons-logging
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20008
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd20009
from: antlr-tool
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22138
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd22139
from: apache-commons-beanutils
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22178
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd22179
from: apache-commons-chain
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2927
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd2928
from: java-11-openjdk-headless
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22141
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd22142
from: apache-commons-beanutils
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2759
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd2760
from: java-1.8.0-openjdk-headless
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112895
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd112896
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20078
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd20079
from: bsf
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20120
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd20121
from: jakarta-oro
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2693
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd546
from: javapackages-filesystem
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd59378
type: Relationship
relationship type: hasConcludedLicense
to: SPDXRef-gnrtd59379
from: jboss-jsp-2.3-api
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2695
type: Relationship
relationship type: hasDeclaredLicense
to: SPDXRef-gnrtd546
from: javapackages-filesystem
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112888
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: javapackages-filesystem
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112894
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: apache-commons-logging
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112892
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: bsf
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112883
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: antlr-tool
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112882
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: apache-commons-chain
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112891
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: apache-commons-validator
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112893
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: apache-commons-digester
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112887
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: java-11-openjdk-headless
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112885
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: apache-commons-beanutils
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112886
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: tomcat-taglibs-standard
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112890
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: java-1.8.0-openjdk-headless
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112889
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: jakarta-oro
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112884
type: LifecycleScopedRelationship
relationship type: dependsOn
scope: build
completeness: noAssertion
to: jboss-jsp-2.3-api
from: struts
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20076
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2763
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22142
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22179
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd60216
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20009
type: simplelicensing_LicenseExpression
simplelicensing license expression: public domain
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd59379
type: simplelicensing_LicenseExpression
simplelicensing license expression: GPLv2 with exceptions or ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2925
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA-MD
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22182
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20079
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2760
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd59382
type: simplelicensing_LicenseExpression
simplelicensing license expression: GPLv2 with exceptions or ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20072
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd23089
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd546
type: simplelicensing_LicenseExpression
simplelicensing license expression: BSD-3-Clause
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20121
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 1.1
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd23092
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22176
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2928
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA-MD
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20006
type: simplelicensing_LicenseExpression
simplelicensing license expression: public domain
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22173
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112896
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20124
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 1.1
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20069
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd60219
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112899
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22139
type: simplelicensing_LicenseExpression
simplelicensing license expression: ASL 2.0
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22180
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20070
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20122
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2926
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd23090
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2694
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22174
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20077
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd60217
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2761
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112897
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20007
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd59380
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22140
type: Organization
name: http://openeuler.org
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2629
type: software_Package
supplied by: SPDXRef-gnrtd2761
name: java-1.8.0-openjdk-headless
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: OpenJDK Headless Runtime Environment 8
software package version: 1:1.8.0.492.b09-5.oe2403sp4
software home page: http://openjdk.java.net/
description: The OpenJDK runtime environment 8 without audio and video support.
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2692
type: software_Package
supplied by: SPDXRef-gnrtd2694
software download location: NOASSERTION
summary: Filesystem layout for java packages
software package version: 0:5.3.0-6.oe2403sp4
software home page: https://github.com/fedora-java/javapackages
description: The javapackages-filesystem package contains some basic directories into which Java packages install their content.
name: javapackages-filesystem
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20061
type: software_Package
supplied by: SPDXRef-gnrtd20077
name: bsf
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Bean Scripting Framework
software package version: 0:2.4.0-32.oe2403sp4
software home page: http://commons.apache.org/bsf/
description: Bean Scripting Framework (BSF) is a set of Java classes which provides scripting language support within Java applications, and access to Java objects and methods from scripting languages. The two primary components of BSF are the BSFManager and the BSFEngine. The BSFManager handles all scripting execution engines running under its control, and maintains the object registry that permits scripts access to Java objects. By creating an instance of the BSFManager class, a Java application can gain access to scripting services. The BSFEngine provides an interface that must be implemented for a language to be used by BSF. This interface provides an abstraction of the scripting language's capabilities that permits generic handling of script execution and object registration within the execution context of the scripting language engine. An application can instantiate a single BSFManager, and execute several different scripting languages identically via the BSFEngine interface. Furthermore, all of the scripting languages handled by the BSFManager are aware of the objects registered with that BSFManager, and the execution state of those scripting languages is maintained for the lifetime of the BSFManager.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.bsf/bsf@2.4.0
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/bsf/bsf@2.4.0
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22166
type: software_Package
supplied by: SPDXRef-gnrtd22174
name: apache-commons-digester
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: XML to Java object mapping module
software package version: 0:2.1-1.oe2403sp4
software home page: http://commons.apache.org/digester/
description: Many projects read XML configuration files to provide initialization of various Java objects within the system. There are several ways of doing this, and the Digester component was designed to provide a common implementation that can be used in many different projects
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/commons-digester/commons-digester@2.1
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.commons/commons-digester@2.1
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd23080
type: software_Package
supplied by: SPDXRef-gnrtd23090
name: apache-commons-validator
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Apache Commons Validator
software package version: 0:1.7-1.oe2403sp4
software home page: http://commons.apache.org/validator/
description: A common issue when receiving data either electronically or from user input is verifying the integrity of the data. This work is repetitive and becomes even more complicated when different sets of validation rules need to be applied to the same set of data based on locale for example. Error messages may also vary by locale. This package attempts to address some of these issues and speed development and maintenance of validation rules.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.commons/commons-validator@1.7
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/commons-validator/commons-validator@1.7
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22132
type: software_Package
supplied by: SPDXRef-gnrtd22140
name: apache-commons-beanutils
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Java utility methods for accessing and modifying the properties of arbitrary JavaBeans
software package version: 0:1.9.4-4.oe2403sp4
software home page: http://commons.apache.org/beanutils
description: The scope of this package is to create a package of Java utility methods for accessing and modifying the properties of arbitrary JavaBeans. No dependencies outside of the JDK are required, so the use of this package is very lightweight.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/commons-beanutils/commons-beanutils-core@1.9.4
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.commons/commons-beanutils@1.9.4
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.commons/commons-beanutils-bean-collections@1.9.4
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.commons/commons-beanutils-core@1.9.4
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/commons-beanutils/commons-beanutils@1.9.4
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/commons-beanutils/commons-beanutils-bean-collections@1.9.4
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd2834
type: software_Package
supplied by: SPDXRef-gnrtd2926
name: java-11-openjdk-headless
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: OpenJDK Headless Runtime Environment 11
software package version: 1:11.0.31.11-5.oe2403sp4
software home page: http://openjdk.java.net/
description: The OpenJDK runtime environment 11 without audio and video support.
external ref:
  type: ExternalRef
  comment: v2_refCategory=EXTERNAL_MANAGER;v2_refType=checksum
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd22150
type: software_Package
supplied by: SPDXRef-gnrtd22180
name: apache-commons-chain
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: An implementation of the GoF Chain of Responsibility pattern
software package version: 0:1.2-2.oe2403sp4
software home page: http://commons.apache.org/chain/
description: A popular technique for organizing the execution of complex processing flows is the "Chain of Responsibility" pattern, as described (among many other places) in the classic "Gang of Four" design patterns book. Although the fundamental API contracts required to implement this design pattern are extremely simple, it is useful to have a base API that facilitates using the pattern, and (more importantly) encouraging composition of command implementations from multiple diverse sources. Towards that end, the Chain API models a computation as a series of "commands" that can be combined into a "chain". The API for a command consists of a single method (execute()), which is passed a "context" parameter containing the dynamic state of the computation, and whose return value is a boolean that determines whether or not processing for the current chain has been completed (true), or whether processing should be delegated to the next command in the chain (false).
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/commons-chain/commons-chain@1.2
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20116
type: software_Package
supplied by: SPDXRef-gnrtd20122
name: jakarta-oro
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Provide compatible regular expressions
software package version: 0:2.0.8-26.oe2403sp4
software home page: http://jakarta.apache.org/oro
description: The Jakarta-ORO Java classes are a set of text-processing Java classes that provide Perl5 compatible regular expressions, AWK-like regular expressions, glob expressions, and utility classes for performing substitutions, splits, filtering filenames, etc. This library is the successor to the OROMatcher, AwkTools, PerlTools, and TextTools libraries originally from ORO, Inc. Despite little activity in the form of new development initiatives, issue reports, questions, and suggestions are responded to quickly.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/oro/oro@2.0.8
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd59372
type: software_Package
supplied by: SPDXRef-gnrtd59380
name: jboss-jsp-2.3-api
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: JavaServer Pages 2.3 API (JSP)
software package version: 0:1.0.3-1.oe2403sp4
software home page: https://github.com/jboss/jboss-jsp-api_spec
description: JSR-000245: JavaServer Pages 2.3
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.jboss.spec.javax.servlet.jsp/jboss-jsp-api_2.3_spec@1.0.3.Final
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd19999
type: software_Package
supplied by: SPDXRef-gnrtd20007
name: antlr-tool
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: A parser generator that uses LL(*) for parsing
software package version: 0:2.7.7-60.oe2403sp4
software home page: http://www.antlr2.org/
description: ANTLR (ANother Tool for Language Recognition) is a powerful parser generator for reading, processing, executing, or translating structured text or binary files.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/antlr/antlrall@2.7.7
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/antlr/antlr@2.7.7
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd60211
type: software_Package
supplied by: SPDXRef-gnrtd60217
name: tomcat-taglibs-standard
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Apache Standard Taglib,Javadoc for tomcat-taglibs-standard
software package version: 0:1.2.5-7.oe2403sp4
software home page: http://tomcat.apache.org/taglibs/
description: An implementation of the JSP Standard Tag Library (JSTL).
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.taglibs/taglibs-standard-compat@1.2.5
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/javax.servlet/jstl@1.2.5
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.taglibs/taglibs-standard-jstlel@1.2.5
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.taglibs/taglibs-build-tools@1.2.5
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.eclipse.jetty.orbit/org.apache.taglibs.standard.glassfish@1.2.5
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.taglibs/taglibs-standard-impl@1.2.5
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.taglibs/taglibs-standard-spec@1.2.5
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.eclipse.jetty.orbit/javax.servlet.jsp.jstl@1.2.5
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd112881
type: software_Package
supplied by: SPDXRef-gnrtd112897
name: struts
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Web application framework
software package version: 0:1.3.10-1.oe2403sp4
software home page: http://struts.apache.org/
description: Welcome to the Struts Framework! The goal of this project is to provide an open source framework useful in building web applications with Java Servlet and JavaServer Pages (JSP) technology. Struts encourages application architectures based on the Model-View-Controller (MVC) design paradigm, colloquially known as Model 2 in discussions on various servlet and JSP related mailing lists. Struts includes the following primary areas of functionality: A controller servlet that dispatches requests to appropriate Action classes provided by the application developer. JSP custom tag libraries, and associated support in the controller servlet, that assists developers in creating interactive form-based applications. Utility classes to support XML parsing, automatic population of JavaBeans properties based on the Java reflection APIs, and internationalization of prompts and messages.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.struts/struts-mailreader-dao@1.3.10
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.struts/struts-faces@1.3.10
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.struts/struts-taglib@1.3.10
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.struts/struts-core@1.3.10
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.struts/struts-tiles@1.3.10
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.struts/struts-scripting@1.3.10
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.struts/struts-extras@1.3.10
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.struts/struts-el@1.3.10
  external ref type: other
creation info: _:creationInfo_0

spdx id: SPDXRef-gnrtd20064
type: software_Package
supplied by: SPDXRef-gnrtd20070
name: apache-commons-logging
software source info: acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2
software download location: NOASSERTION
summary: Apache Commons Logging
software package version: 0:1.2-17.oe2403sp4
software home page: http://commons.apache.org/logging
description: The commons-logging package provides a simple, component-oriented interface (org.apache.commons.logging.Log) and a wrapper for the logging system. The user can choose which system to use. A few basic implementations are also provided to allow users to use the package independently. commons-logging was heavily influenced by Avalon's Logkit and Log4J. The commons-logging abstraction is meant to minimize the differences between the two, and to allow a developer to not tie himself to a particular logging implementation.
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.commons/commons-logging@1.2
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.commons/commons-logging-adapters@1.2
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/commons-logging/commons-logging-api@1.1
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/org.apache.commons/commons-logging-api@1.1
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/apache/commons-logging-api@1.1
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/apache/commons-logging@1.2
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/commons-logging/commons-logging-adapters@1.2
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/commons-logging/commons-logging@1.2
  external ref type: other
external ref:
  type: ExternalRef
  comment: v2_refCategory=PROVIDE_MANAGER;v2_refType=purl
  locator: pkg:maven/apache/commons-logging-adapters@1.2
  external ref type: other
creation info: _:creationInfo_0

spdx id: additionalToolSPDXRef-gnrtd3
type: Tool
name: syft-[not provided]
creation info: _:creationInfo_1

spdx id: additionalToolSPDXRef-gnrtd1
type: Tool
name: syft-[not provided]
creation info: _:creationInfo_0