From 26d4ac1a885ef61480a557b63d2ccbf288265a64 Mon Sep 17 00:00:00 2001
From: John Kjell <john@testifysec.com>
Date: Tue, 11 Jun 2024 10:46:37 -0500
Subject: [PATCH] Feat/SBOM attestor (#268)

* feat(sbom-attestor): add SBOM attestor for SPDX and CycloneDX formats

---------
Signed-off-by: John Kjell <john@testifysec.com>
Co-authored-by: Cole <cole@testifysec.com>
Co-authored-by: Tom Meadows <tom@tmlabs.co.uk>
---
 .github/workflows/verify-licence.yml          |    2 +-
 .gitignore                                    |    1 +
 attestation/product/product.go                |   78 +-
 attestation/product/product_test.go           |    4 +-
 .../boms/cyclonedx-json/alpine.cyclonedx.json | 1436 ++++++++
 .../boms/cyclonedx-xml/alpine.cyclonedx.xml   |  585 +++
 .../sbom/boms/spdx-2.2/alpine.spdx-2-2.json   | 3167 +++++++++++++++++
 .../sbom/boms/spdx-2.3/alpine.spdx-2-3.json   | 3167 +++++++++++++++++
 attestation/sbom/sbom.go                      |  151 +
 attestation/sbom/sbom_test.go                 |  160 +
 go.mod                                        |    3 +-
 go.sum                                        |    6 +-
 imports.go                                    |    1 +
 schemagen/sbom.json                           |   17 +
 14 files changed, 8719 insertions(+), 59 deletions(-)
 create mode 100644 attestation/sbom/boms/cyclonedx-json/alpine.cyclonedx.json
 create mode 100644 attestation/sbom/boms/cyclonedx-xml/alpine.cyclonedx.xml
 create mode 100644 attestation/sbom/boms/spdx-2.2/alpine.spdx-2-2.json
 create mode 100644 attestation/sbom/boms/spdx-2.3/alpine.spdx-2-3.json
 create mode 100644 attestation/sbom/sbom.go
 create mode 100644 attestation/sbom/sbom_test.go
 create mode 100644 schemagen/sbom.json

diff --git a/.github/workflows/verify-licence.yml b/.github/workflows/verify-licence.yml
index 268c71ac..1b0c027c 100644
--- a/.github/workflows/verify-licence.yml
+++ b/.github/workflows/verify-licence.yml
@@ -40,4 +40,4 @@ jobs:
         - name: Check license headers
           run: |
             set -e
-            addlicense --check -l apache -c 'The Witness Contributors' -v *
+            addlicense --check -l apache -c 'The Witness Contributors' --ignore "**/*.xml" -v *
diff --git a/.gitignore b/.gitignore
index ee0fbb12..fb433ca1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,4 @@ test/log
 .idea/
 profile.cov
 .vscode/
+.aider*
diff --git a/attestation/product/product.go b/attestation/product/product.go
index e1899986..cb26cefd 100644
--- a/attestation/product/product.go
+++ b/attestation/product/product.go
@@ -15,14 +15,11 @@
 package product
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
-	"io"
-	"mime"
-	"net/http"
-	"os"
-	"path/filepath"
 
+	"github.com/gabriel-vasile/mimetype"
 	"github.com/gobwas/glob"
 	"github.com/in-toto/go-witness/attestation"
 	"github.com/in-toto/go-witness/attestation/file"
@@ -118,17 +115,13 @@ type Attestor struct {
 	compiledExcludeGlob glob.Glob
 }
 
-func fromDigestMap(digestMap map[string]cryptoutil.DigestSet) map[string]attestation.Product {
+func fromDigestMap(workingDir string, digestMap map[string]cryptoutil.DigestSet) map[string]attestation.Product {
 	products := make(map[string]attestation.Product)
 	for fileName, digestSet := range digestMap {
-		mimeType := "unknown"
-		f, err := os.OpenFile(fileName, os.O_RDONLY, 0666)
-		if err == nil {
-			mimeType, err = getFileContentType(f)
-			if err != nil {
-				mimeType = "unknown"
-			}
-			f.Close()
+		filePath := workingDir + fileName
+		mimeType, err := getFileContentType(filePath)
+		if err != nil {
+			mimeType = "unknown"
 		}
 
 		products[fileName] = attestation.Product{
@@ -192,7 +185,7 @@ func (a *Attestor) Attest(ctx *attestation.AttestationContext) error {
 		return err
 	}
 
-	a.products = fromDigestMap(products)
+	a.products = fromDigestMap(ctx.WorkingDir(), products)
 	return nil
 }
 
@@ -231,47 +224,26 @@ func (a *Attestor) Subjects() map[string]cryptoutil.DigestSet {
 	return subjects
 }
 
-func getFileContentType(file *os.File) (string, error) {
-	// Read up to 512 bytes from the file.
-	buffer := make([]byte, 512)
-	_, err := file.Read(buffer)
-	if err != nil && err != io.EOF {
-		return "", err
-	}
+func getFileContentType(fileName string) (string, error) {
+	// Add SPDX JSON detector
+	mimetype.Lookup("application/json").Extend(func(buf []byte, limit uint32) bool {
+		return bytes.HasPrefix(buf, []byte(`{"spdxVersion": "SPDX-`))
+	}, "application/spdx+json", ".spdx.json")
 
-	// Try to detect the content type using http.DetectContentType().
-	contentType := http.DetectContentType(buffer)
-
-	// If the content type is application/octet-stream, try to detect the content type using a file signature.
-	if contentType == "application/octet-stream" {
-		// Try to match the file signature to a content type.
-		if signature, _ := getFileSignature(buffer); signature != "application/octet-stream" {
-			contentType = signature
-		} else if extension := filepath.Ext(file.Name()); extension != "" {
-			contentType = mime.TypeByExtension(extension)
-		}
-	}
+	// Add CycloneDx JSON detector
+	mimetype.Lookup("application/json").Extend(func(buf []byte, limit uint32) bool {
+		return bytes.HasPrefix(buf, []byte(`{"$schema": "http://cyclonedx.org/schema/bom-`))
+	}, "application/vnd.cyclonedx+json", ".cdx.json")
 
-	return contentType, nil
-}
+	// Add CycloneDx XML detector
+	mimetype.Lookup("text/xml").Extend(func(buf []byte, limit uint32) bool {
+		return bytes.HasPrefix(buf, []byte(`<?xml version="1.0" encoding="UTF-8"?><bom xmlns="http://cyclonedx.org/schema/bom/`))
+	}, "application/vnd.cyclonedx+xml", ".cdx.xml")
 
-// getFileSignature tries to match the file signature to a content type.
-func getFileSignature(buffer []byte) (string, error) {
-	// Create a new buffer with a length of 512 bytes and copy the data from the input buffer into the new buffer to prevent out of bounds errors.
-	newBuffer := make([]byte, 512)
-	copy(newBuffer, buffer)
-
-	var signature string
-	switch {
-	// https://en.wikipedia.org/wiki/List_of_file_signatures
-	case buffer[257] == 0x75 && buffer[258] == 0x73 && buffer[259] == 0x74 && buffer[260] == 0x61 && buffer[261] == 0x72:
-		signature = "application/x-tar"
-	case buffer[0] == 0x25 && buffer[1] == 0x50 && buffer[2] == 0x44 && buffer[3] == 0x46 && buffer[4] == 0x2D:
-		signature = "application/pdf"
-	default:
-		// If the file signature is not recognized, return application/octet-stream by default
-		signature = "application/octet-stream"
+	contentType, err := mimetype.DetectFile(fileName)
+	if err != nil {
+		return "", err
 	}
 
-	return signature, nil
+	return contentType.String(), nil
 }
diff --git a/attestation/product/product_test.go b/attestation/product/product_test.go
index 4923081f..d20dfee3 100644
--- a/attestation/product/product_test.go
+++ b/attestation/product/product_test.go
@@ -34,7 +34,7 @@ func TestFromDigestMap(t *testing.T) {
 	assert.NoError(t, err)
 	testDigestSet := make(map[string]cryptoutil.DigestSet)
 	testDigestSet["test"] = testDigest
-	result := fromDigestMap(testDigestSet)
+	result := fromDigestMap("", testDigestSet)
 	assert.Len(t, result, 1)
 	digest := result["test"].Digest
 	assert.True(t, digest.Equal(testDigest))
@@ -126,7 +126,7 @@ func TestGetFileContentType(t *testing.T) {
 	// Run the test cases.
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			contentType, err := getFileContentType(test.file)
+			contentType, err := getFileContentType(test.file.Name())
 			require.NoError(t, err)
 			require.Equal(t, test.expected, contentType)
 		})
diff --git a/attestation/sbom/boms/cyclonedx-json/alpine.cyclonedx.json b/attestation/sbom/boms/cyclonedx-json/alpine.cyclonedx.json
new file mode 100644
index 00000000..fe9fb524
--- /dev/null
+++ b/attestation/sbom/boms/cyclonedx-json/alpine.cyclonedx.json
@@ -0,0 +1,1436 @@
+{"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "serialNumber": "urn:uuid:298c0a86-0bed-4b0b-9b85-72711f394bc7",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2024-06-08T00:27:22-05:00",
+    "tools": {
+      "components": [
+        {
+          "type": "application",
+          "author": "anchore",
+          "name": "syft",
+          "version": "1.5.0"
+        }
+      ]
+    },
+    "component": {
+      "bom-ref": "9c7969cf463a5d0e",
+      "type": "container",
+      "name": "alpine",
+      "version": "sha256:1c3b93ed450e26eac89b471d6d140e2f99488f489739b8b8ea5e8202dd086f82"
+    }
+  },
+  "components": [
+    {
+      "bom-ref": "pkg:apk/alpine/alpine-baselayout@3.6.5-r0?arch=aarch64&distro=alpine-3.20.0&package-id=21e54be9d7ca763c",
+      "type": "library",
+      "publisher": "Natanael Copa <ncopa@alpinelinux.org>",
+      "name": "alpine-baselayout",
+      "version": "3.6.5-r0",
+      "description": "Alpine base dir structure and init scripts",
+      "licenses": [
+        {
+          "license": {
+            "id": "GPL-2.0-only"
+          }
+        }
+      ],
+      "cpe": "cpe:2.3:a:alpine-baselayout:alpine-baselayout:3.6.5-r0:*:*:*:*:*:*:*",
+      "purl": "pkg:apk/alpine/alpine-baselayout@3.6.5-r0?arch=aarch64&distro=alpine-3.20.0",
+      "externalReferences": [
+        {
+          "url": "https://git.alpinelinux.org/cgit/aports/tree/main/alpine-baselayout",
+          "type": "distribution"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "apk-db-cataloger"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "apk"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "apk-db-entry"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine-baselayout:alpine_baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine_baselayout:alpine-baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine_baselayout:alpine_baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine:alpine-baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine:alpine_baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/lib/apk/db/installed"
+        },
+        {
+          "name": "syft:metadata:gitCommitOfApkPort",
+          "value": "66187892e05b03a41d08e9acabd19b7576a1c875"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "315392"
+        },
+        {
+          "name": "syft:metadata:originPackage",
+          "value": "alpine-baselayout"
+        },
+        {
+          "name": "syft:metadata:pullChecksum",
+          "value": "Q1R9ZP0tsvI8T8g9RLcTlCnsFt8l4="
+        },
+        {
+          "name": "syft:metadata:pullDependencies:0",
+          "value": "alpine-baselayout-data=3.6.5-r0"
+        },
+        {
+          "name": "syft:metadata:pullDependencies:1",
+          "value": "/bin/sh"
+        },
+        {
+          "name": "syft:metadata:size",
+          "value": "8504"
+        }
+      ]
+    },
+    {
+      "bom-ref": "pkg:apk/alpine/alpine-baselayout-data@3.6.5-r0?arch=aarch64&upstream=alpine-baselayout&distro=alpine-3.20.0&package-id=9ff96f942d2401f2",
+      "type": "library",
+      "publisher": "Natanael Copa <ncopa@alpinelinux.org>",
+      "name": "alpine-baselayout-data",
+      "version": "3.6.5-r0",
+      "description": "Alpine base dir structure and init scripts",
+      "licenses": [
+        {
+          "license": {
+            "id": "GPL-2.0-only"
+          }
+        }
+      ],
+      "cpe": "cpe:2.3:a:alpine-baselayout-data:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*",
+      "purl": "pkg:apk/alpine/alpine-baselayout-data@3.6.5-r0?arch=aarch64&upstream=alpine-baselayout&distro=alpine-3.20.0",
+      "externalReferences": [
+        {
+          "url": "https://git.alpinelinux.org/cgit/aports/tree/main/alpine-baselayout",
+          "type": "distribution"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "apk-db-cataloger"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "apk"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "apk-db-entry"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine-baselayout-data:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine_baselayout_data:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine_baselayout_data:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine-baselayout:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine-baselayout:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine_baselayout:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine_baselayout:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/lib/apk/db/installed"
+        },
+        {
+          "name": "syft:metadata:gitCommitOfApkPort",
+          "value": "66187892e05b03a41d08e9acabd19b7576a1c875"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "77824"
+        },
+        {
+          "name": "syft:metadata:originPackage",
+          "value": "alpine-baselayout"
+        },
+        {
+          "name": "syft:metadata:pullChecksum",
+          "value": "Q1CBqmrtqbjIw3pkxXZ5Thkf2kPxg="
+        },
+        {
+          "name": "syft:metadata:size",
+          "value": "11219"
+        }
+      ]
+    },
+    {
+      "bom-ref": "pkg:apk/alpine/alpine-keys@2.4-r1?arch=aarch64&distro=alpine-3.20.0&package-id=0e5100e3d266a135",
+      "type": "library",
+      "publisher": "Natanael Copa <ncopa@alpinelinux.org>",
+      "name": "alpine-keys",
+      "version": "2.4-r1",
+      "description": "Public keys for Alpine Linux packages",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "cpe": "cpe:2.3:a:alpine-keys:alpine-keys:2.4-r1:*:*:*:*:*:*:*",
+      "purl": "pkg:apk/alpine/alpine-keys@2.4-r1?arch=aarch64&distro=alpine-3.20.0",
+      "externalReferences": [
+        {
+          "url": "https://alpinelinux.org",
+          "type": "distribution"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "apk-db-cataloger"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "apk"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "apk-db-entry"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine-keys:alpine_keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine_keys:alpine-keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine_keys:alpine_keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine:alpine-keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:alpine:alpine_keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/lib/apk/db/installed"
+        },
+        {
+          "name": "syft:metadata:gitCommitOfApkPort",
+          "value": "aab68f8c9ab434a46710de8e12fb3206e2930a59"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "159744"
+        },
+        {
+          "name": "syft:metadata:originPackage",
+          "value": "alpine-keys"
+        },
+        {
+          "name": "syft:metadata:pullChecksum",
+          "value": "Q16gIk8kJZbjkxpQzH7qUET//mk4g="
+        },
+        {
+          "name": "syft:metadata:size",
+          "value": "13905"
+        }
+      ]
+    },
+    {
+      "bom-ref": "pkg:apk/alpine/apk-tools@2.14.4-r0?arch=aarch64&distro=alpine-3.20.0&package-id=78c55d64ab350462",
+      "type": "library",
+      "publisher": "Natanael Copa <ncopa@alpinelinux.org>",
+      "name": "apk-tools",
+      "version": "2.14.4-r0",
+      "description": "Alpine Package Keeper - package manager for alpine",
+      "licenses": [
+        {
+          "license": {
+            "id": "GPL-2.0-only"
+          }
+        }
+      ],
+      "cpe": "cpe:2.3:a:apk-tools:apk-tools:2.14.4-r0:*:*:*:*:*:*:*",
+      "purl": "pkg:apk/alpine/apk-tools@2.14.4-r0?arch=aarch64&distro=alpine-3.20.0",
+      "externalReferences": [
+        {
+          "url": "https://gitlab.alpinelinux.org/alpine/apk-tools",
+          "type": "distribution"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "apk-db-cataloger"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "apk"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "apk-db-entry"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:apk-tools:apk_tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:apk_tools:apk-tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:apk_tools:apk_tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:apk:apk-tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:apk:apk_tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/lib/apk/db/installed"
+        },
+        {
+          "name": "syft:metadata:gitCommitOfApkPort",
+          "value": "d435c805af8af4171438da3ec3429c094aac4c6e"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "380928"
+        },
+        {
+          "name": "syft:metadata:originPackage",
+          "value": "apk-tools"
+        },
+        {
+          "name": "syft:metadata:provides:0",
+          "value": "so:libapk.so.2.14.0=2.14.0"
+        },
+        {
+          "name": "syft:metadata:provides:1",
+          "value": "cmd:apk=2.14.4-r0"
+        },
+        {
+          "name": "syft:metadata:pullChecksum",
+          "value": "Q1u2ym9AxaPUuKkZt9wuzNXbihxKU="
+        },
+        {
+          "name": "syft:metadata:pullDependencies:0",
+          "value": "musl>=1.2.3_git20230424"
+        },
+        {
+          "name": "syft:metadata:pullDependencies:1",
+          "value": "ca-certificates-bundle"
+        },
+        {
+          "name": "syft:metadata:pullDependencies:2",
+          "value": "so:libc.musl-aarch64.so.1"
+        },
+        {
+          "name": "syft:metadata:pullDependencies:3",
+          "value": "so:libcrypto.so.3"
+        },
+        {
+          "name": "syft:metadata:pullDependencies:4",
+          "value": "so:libssl.so.3"
+        },
+        {
+          "name": "syft:metadata:pullDependencies:5",
+          "value": "so:libz.so.1"
+        },
+        {
+          "name": "syft:metadata:size",
+          "value": "127552"
+        }
+      ]
+    },
+    {
+      "bom-ref": "pkg:apk/alpine/busybox@1.36.1-r28?arch=aarch64&distro=alpine-3.20.0&package-id=4cea7ce2e2974c99",
+      "type": "library",
+      "publisher": "Sören Tempel <soeren+alpine@soeren-tempel.net>",
+      "name": "busybox",
+      "version": "1.36.1-r28",
+      "description": "Size optimized toolbox of many common UNIX utilities",
+      "licenses": [
+        {
+          "license": {
+            "id": "GPL-2.0-only"
+          }
+        }
+      ],
+      "cpe": "cpe:2.3:a:busybox:busybox:1.36.1-r28:*:*:*:*:*:*:*",
+      "purl": "pkg:apk/alpine/busybox@1.36.1-r28?arch=aarch64&distro=alpine-3.20.0",
+      "externalReferences": [
+        {
+          "url": "https://busybox.net/",
+          "type": "distribution"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "apk-db-cataloger"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "apk"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "apk-db-entry"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/lib/apk/db/installed"
+        },
+        {
+          "name": "syft:metadata:gitCommitOfApkPort",
+          "value": "4d9b7d8e9f37907d4ecf8e01e21854e95937e4a8"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "1040384"
+        },
+        {
+          "name": "syft:metadata:originPackage",
+          "value": "busybox"
+        },
+        {
+          "name": "syft:metadata:provides:0",
+          "value": "cmd:busybox=1.36.1-r28"
+        },
+        {
+          "name": "syft:metadata:pullChecksum",
+          "value": "Q1/eW7ympSUFCka5zq/gNIx8w6gWA="
+        },
+        {
+          "name": "syft:metadata:pullDependencies:0",
+          "value": "so:libc.musl-aarch64.so.1"
+        },
+        {
+          "name": "syft:metadata:size",
+          "value": "528988"
+        }
+      ]
+    },
+    {
+      "bom-ref": "pkg:apk/alpine/busybox-binsh@1.36.1-r28?arch=aarch64&upstream=busybox&distro=alpine-3.20.0&package-id=1fd95b4d43a9f438",
+      "type": "library",
+      "publisher": "Sören Tempel <soeren+alpine@soeren-tempel.net>",
+      "name": "busybox-binsh",
+      "version": "1.36.1-r28",
+      "description": "busybox ash /bin/sh",
+      "licenses": [
+        {
+          "license": {
+            "id": "GPL-2.0-only"
+          }
+        }
+      ],
+      "cpe": "cpe:2.3:a:busybox-binsh:busybox-binsh:1.36.1-r28:*:*:*:*:*:*:*",
+      "purl": "pkg:apk/alpine/busybox-binsh@1.36.1-r28?arch=aarch64&upstream=busybox&distro=alpine-3.20.0",
+      "externalReferences": [
+        {
+          "url": "https://busybox.net/",
+          "type": "distribution"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "apk-db-cataloger"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "apk"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "apk-db-entry"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:busybox-binsh:busybox_binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:busybox_binsh:busybox-binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:busybox_binsh:busybox_binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:busybox:busybox-binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:busybox:busybox_binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/lib/apk/db/installed"
+        },
+        {
+          "name": "syft:metadata:gitCommitOfApkPort",
+          "value": "4d9b7d8e9f37907d4ecf8e01e21854e95937e4a8"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "8192"
+        },
+        {
+          "name": "syft:metadata:originPackage",
+          "value": "busybox"
+        },
+        {
+          "name": "syft:metadata:provides:0",
+          "value": "/bin/sh"
+        },
+        {
+          "name": "syft:metadata:provides:1",
+          "value": "cmd:sh=1.36.1-r28"
+        },
+        {
+          "name": "syft:metadata:pullChecksum",
+          "value": "Q1tqUaZzPBng5354xPbhVrRigXNks="
+        },
+        {
+          "name": "syft:metadata:pullDependencies:0",
+          "value": "busybox=1.36.1-r28"
+        },
+        {
+          "name": "syft:metadata:size",
+          "value": "1489"
+        }
+      ]
+    },
+    {
+      "bom-ref": "pkg:apk/alpine/ca-certificates-bundle@20240226-r0?arch=aarch64&upstream=ca-certificates&distro=alpine-3.20.0&package-id=bf42440dd0b61727",
+      "type": "library",
+      "publisher": "Natanael Copa <ncopa@alpinelinux.org>",
+      "name": "ca-certificates-bundle",
+      "version": "20240226-r0",
+      "description": "Pre generated bundle of Mozilla certificates",
+      "licenses": [
+        {
+          "expression": "MPL-2.0 AND MIT"
+        }
+      ],
+      "cpe": "cpe:2.3:a:ca-certificates-bundle:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*",
+      "purl": "pkg:apk/alpine/ca-certificates-bundle@20240226-r0?arch=aarch64&upstream=ca-certificates&distro=alpine-3.20.0",
+      "externalReferences": [
+        {
+          "url": "https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/",
+          "type": "distribution"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "apk-db-cataloger"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "apk"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "apk-db-entry"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:ca-certificates-bundle:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:ca_certificates_bundle:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:ca_certificates_bundle:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:ca-certificates:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:ca-certificates:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:ca_certificates:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:ca_certificates:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:mozilla:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:mozilla:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:ca:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:ca:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/lib/apk/db/installed"
+        },
+        {
+          "name": "syft:metadata:gitCommitOfApkPort",
+          "value": "56fb003da0adcea3b59373ef6a633d0c5bfef3ac"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "241664"
+        },
+        {
+          "name": "syft:metadata:originPackage",
+          "value": "ca-certificates"
+        },
+        {
+          "name": "syft:metadata:provides:0",
+          "value": "ca-certificates-cacert=20240226-r0"
+        },
+        {
+          "name": "syft:metadata:pullChecksum",
+          "value": "Q1WTaxkM5GDX5n/oNq7cPedv59BKk="
+        },
+        {
+          "name": "syft:metadata:size",
+          "value": "130197"
+        }
+      ]
+    },
+    {
+      "bom-ref": "pkg:apk/alpine/libcrypto3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0&package-id=0cfcda1a242dfd13",
+      "type": "library",
+      "publisher": "Natanael Copa <ncopa@alpinelinux.org>",
+      "name": "libcrypto3",
+      "version": "3.3.0-r2",
+      "description": "Crypto library from openssl",
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "cpe": "cpe:2.3:a:libcrypto3:libcrypto3:3.3.0-r2:*:*:*:*:*:*:*",
+      "purl": "pkg:apk/alpine/libcrypto3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0",
+      "externalReferences": [
+        {
+          "url": "https://www.openssl.org/",
+          "type": "distribution"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "apk-db-cataloger"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "apk"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "apk-db-entry"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:libcrypto3:libcrypto:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:libcrypto:libcrypto3:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:libcrypto:libcrypto:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/lib/apk/db/installed"
+        },
+        {
+          "name": "syft:metadata:gitCommitOfApkPort",
+          "value": "6758e15d502acb632d3ed521a992f1308c6e2fd8"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "5095424"
+        },
+        {
+          "name": "syft:metadata:originPackage",
+          "value": "openssl"
+        },
+        {
+          "name": "syft:metadata:provides:0",
+          "value": "so:libcrypto.so.3=3"
+        },
+        {
+          "name": "syft:metadata:pullChecksum",
+          "value": "Q1PRU3l0tZ3GQKiTZb4AYtcoZNO2A="
+        },
+        {
+          "name": "syft:metadata:pullDependencies:0",
+          "value": "so:libc.musl-aarch64.so.1"
+        },
+        {
+          "name": "syft:metadata:size",
+          "value": "2227080"
+        }
+      ]
+    },
+    {
+      "bom-ref": "pkg:apk/alpine/libssl3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0&package-id=1bffb507b1b535bc",
+      "type": "library",
+      "publisher": "Natanael Copa <ncopa@alpinelinux.org>",
+      "name": "libssl3",
+      "version": "3.3.0-r2",
+      "description": "SSL shared libraries",
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "cpe": "cpe:2.3:a:libssl3:libssl3:3.3.0-r2:*:*:*:*:*:*:*",
+      "purl": "pkg:apk/alpine/libssl3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0",
+      "externalReferences": [
+        {
+          "url": "https://www.openssl.org/",
+          "type": "distribution"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "apk-db-cataloger"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "apk"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "apk-db-entry"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:libssl3:libssl:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:libssl:libssl3:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:libssl:libssl:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/lib/apk/db/installed"
+        },
+        {
+          "name": "syft:metadata:gitCommitOfApkPort",
+          "value": "6758e15d502acb632d3ed521a992f1308c6e2fd8"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "950272"
+        },
+        {
+          "name": "syft:metadata:originPackage",
+          "value": "openssl"
+        },
+        {
+          "name": "syft:metadata:provides:0",
+          "value": "so:libssl.so.3=3"
+        },
+        {
+          "name": "syft:metadata:pullChecksum",
+          "value": "Q1tT+BUWpaUligJVR/UsT5zI/elh0="
+        },
+        {
+          "name": "syft:metadata:pullDependencies:0",
+          "value": "libcrypto3=3.3.0-r2"
+        },
+        {
+          "name": "syft:metadata:pullDependencies:1",
+          "value": "so:libc.musl-aarch64.so.1"
+        },
+        {
+          "name": "syft:metadata:pullDependencies:2",
+          "value": "so:libcrypto.so.3"
+        },
+        {
+          "name": "syft:metadata:size",
+          "value": "362382"
+        }
+      ]
+    },
+    {
+      "bom-ref": "pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&distro=alpine-3.20.0&package-id=03e521237cbed45a",
+      "type": "library",
+      "publisher": "Natanael Copa <ncopa@alpinelinux.org>",
+      "name": "musl",
+      "version": "1.2.5-r0",
+      "description": "the musl c library (libc) implementation",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "cpe": "cpe:2.3:a:musl-libc:musl:1.2.5-r0:*:*:*:*:*:*:*",
+      "purl": "pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&distro=alpine-3.20.0",
+      "externalReferences": [
+        {
+          "url": "https://musl.libc.org/",
+          "type": "distribution"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "apk-db-cataloger"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "apk"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "apk-db-entry"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:musl_libc:musl:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:musl:musl:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/lib/apk/db/installed"
+        },
+        {
+          "name": "syft:metadata:gitCommitOfApkPort",
+          "value": "4fe5bdbe47b100daa6380f81c4c8ea3f99b61362"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "741376"
+        },
+        {
+          "name": "syft:metadata:originPackage",
+          "value": "musl"
+        },
+        {
+          "name": "syft:metadata:provides:0",
+          "value": "so:libc.musl-aarch64.so.1=1"
+        },
+        {
+          "name": "syft:metadata:pullChecksum",
+          "value": "Q1sdlDq9r9kKVIGZNgDX6mkPZMaHE="
+        },
+        {
+          "name": "syft:metadata:size",
+          "value": "415580"
+        }
+      ]
+    },
+    {
+      "bom-ref": "pkg:apk/alpine/musl-utils@1.2.5-r0?arch=aarch64&upstream=musl&distro=alpine-3.20.0&package-id=c84ae08b59df5c6e",
+      "type": "library",
+      "publisher": "Natanael Copa <ncopa@alpinelinux.org>",
+      "name": "musl-utils",
+      "version": "1.2.5-r0",
+      "description": "the musl c library (libc) implementation",
+      "licenses": [
+        {
+          "expression": "MIT AND BSD-2-Clause AND GPL-2.0-or-later"
+        }
+      ],
+      "cpe": "cpe:2.3:a:musl-utils:musl-utils:1.2.5-r0:*:*:*:*:*:*:*",
+      "purl": "pkg:apk/alpine/musl-utils@1.2.5-r0?arch=aarch64&upstream=musl&distro=alpine-3.20.0",
+      "externalReferences": [
+        {
+          "url": "https://musl.libc.org/",
+          "type": "distribution"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "apk-db-cataloger"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "apk"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "apk-db-entry"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:musl-utils:musl_utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:musl_utils:musl-utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:musl_utils:musl_utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:musl-libc:musl-utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:musl-libc:musl_utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:musl:musl-utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:musl:musl_utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/lib/apk/db/installed"
+        },
+        {
+          "name": "syft:metadata:gitCommitOfApkPort",
+          "value": "4fe5bdbe47b100daa6380f81c4c8ea3f99b61362"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "286720"
+        },
+        {
+          "name": "syft:metadata:originPackage",
+          "value": "musl"
+        },
+        {
+          "name": "syft:metadata:provides:0",
+          "value": "libc-utils=1.2.5-r0"
+        },
+        {
+          "name": "syft:metadata:provides:1",
+          "value": "cmd:getconf=1.2.5-r0"
+        },
+        {
+          "name": "syft:metadata:provides:2",
+          "value": "cmd:getent=1.2.5-r0"
+        },
+        {
+          "name": "syft:metadata:provides:3",
+          "value": "cmd:iconv=1.2.5-r0"
+        },
+        {
+          "name": "syft:metadata:provides:4",
+          "value": "cmd:ldconfig=1.2.5-r0"
+        },
+        {
+          "name": "syft:metadata:provides:5",
+          "value": "cmd:ldd=1.2.5-r0"
+        },
+        {
+          "name": "syft:metadata:pullChecksum",
+          "value": "Q1BQWUHHGLpcXMeRjKiOCeK7/RiWc="
+        },
+        {
+          "name": "syft:metadata:pullDependencies:0",
+          "value": "scanelf"
+        },
+        {
+          "name": "syft:metadata:pullDependencies:1",
+          "value": "so:libc.musl-aarch64.so.1"
+        },
+        {
+          "name": "syft:metadata:size",
+          "value": "39340"
+        }
+      ]
+    },
+    {
+      "bom-ref": "pkg:apk/alpine/scanelf@1.3.7-r2?arch=aarch64&upstream=pax-utils&distro=alpine-3.20.0&package-id=54f3623fdd8fb8d4",
+      "type": "library",
+      "publisher": "Natanael Copa <ncopa@alpinelinux.org>",
+      "name": "scanelf",
+      "version": "1.3.7-r2",
+      "description": "Scan ELF binaries for stuff",
+      "licenses": [
+        {
+          "license": {
+            "id": "GPL-2.0-only"
+          }
+        }
+      ],
+      "cpe": "cpe:2.3:a:scanelf:scanelf:1.3.7-r2:*:*:*:*:*:*:*",
+      "purl": "pkg:apk/alpine/scanelf@1.3.7-r2?arch=aarch64&upstream=pax-utils&distro=alpine-3.20.0",
+      "externalReferences": [
+        {
+          "url": "https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities",
+          "type": "distribution"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "apk-db-cataloger"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "apk"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "apk-db-entry"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/lib/apk/db/installed"
+        },
+        {
+          "name": "syft:metadata:gitCommitOfApkPort",
+          "value": "e65a4f2d0470e70d862ef2b5c412ecf2cb9ad0a6"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "147456"
+        },
+        {
+          "name": "syft:metadata:originPackage",
+          "value": "pax-utils"
+        },
+        {
+          "name": "syft:metadata:provides:0",
+          "value": "cmd:scanelf=1.3.7-r2"
+        },
+        {
+          "name": "syft:metadata:pullChecksum",
+          "value": "Q1aO0qnRrUwglfFuvEajfWlPUUAXk="
+        },
+        {
+          "name": "syft:metadata:pullDependencies:0",
+          "value": "so:libc.musl-aarch64.so.1"
+        },
+        {
+          "name": "syft:metadata:size",
+          "value": "33669"
+        }
+      ]
+    },
+    {
+      "bom-ref": "pkg:apk/alpine/ssl_client@1.36.1-r28?arch=aarch64&upstream=busybox&distro=alpine-3.20.0&package-id=6bbb10e52b8e7eb4",
+      "type": "library",
+      "publisher": "Sören Tempel <soeren+alpine@soeren-tempel.net>",
+      "name": "ssl_client",
+      "version": "1.36.1-r28",
+      "description": "EXternal ssl_client for busybox wget",
+      "licenses": [
+        {
+          "license": {
+            "id": "GPL-2.0-only"
+          }
+        }
+      ],
+      "cpe": "cpe:2.3:a:ssl-client:ssl-client:1.36.1-r28:*:*:*:*:*:*:*",
+      "purl": "pkg:apk/alpine/ssl_client@1.36.1-r28?arch=aarch64&upstream=busybox&distro=alpine-3.20.0",
+      "externalReferences": [
+        {
+          "url": "https://busybox.net/",
+          "type": "distribution"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "apk-db-cataloger"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "apk"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "apk-db-entry"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:ssl-client:ssl_client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:ssl_client:ssl-client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:ssl_client:ssl_client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:ssl:ssl-client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:ssl:ssl_client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/lib/apk/db/installed"
+        },
+        {
+          "name": "syft:metadata:gitCommitOfApkPort",
+          "value": "4d9b7d8e9f37907d4ecf8e01e21854e95937e4a8"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "81920"
+        },
+        {
+          "name": "syft:metadata:originPackage",
+          "value": "busybox"
+        },
+        {
+          "name": "syft:metadata:provides:0",
+          "value": "cmd:ssl_client=1.36.1-r28"
+        },
+        {
+          "name": "syft:metadata:pullChecksum",
+          "value": "Q1St6DKLiEYxalNRl8Kfj2PH1fZco="
+        },
+        {
+          "name": "syft:metadata:pullDependencies:0",
+          "value": "so:libc.musl-aarch64.so.1"
+        },
+        {
+          "name": "syft:metadata:pullDependencies:1",
+          "value": "so:libcrypto.so.3"
+        },
+        {
+          "name": "syft:metadata:pullDependencies:2",
+          "value": "so:libssl.so.3"
+        },
+        {
+          "name": "syft:metadata:size",
+          "value": "5084"
+        }
+      ]
+    },
+    {
+      "bom-ref": "pkg:apk/alpine/zlib@1.3.1-r1?arch=aarch64&distro=alpine-3.20.0&package-id=d8258d3d7c48cfbf",
+      "type": "library",
+      "publisher": "Natanael Copa <ncopa@alpinelinux.org>",
+      "name": "zlib",
+      "version": "1.3.1-r1",
+      "description": "A compression/decompression Library",
+      "licenses": [
+        {
+          "license": {
+            "id": "Zlib"
+          }
+        }
+      ],
+      "cpe": "cpe:2.3:a:zlib:zlib:1.3.1-r1:*:*:*:*:*:*:*",
+      "purl": "pkg:apk/alpine/zlib@1.3.1-r1?arch=aarch64&distro=alpine-3.20.0",
+      "externalReferences": [
+        {
+          "url": "https://zlib.net/",
+          "type": "distribution"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "apk-db-cataloger"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "apk"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "apk-db-entry"
+        },
+        {
+          "name": "syft:location:0:layerID",
+          "value": "sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/lib/apk/db/installed"
+        },
+        {
+          "name": "syft:metadata:gitCommitOfApkPort",
+          "value": "fad2d175bd85eb4c5566765375392a7394dfbcf2"
+        },
+        {
+          "name": "syft:metadata:installedSize",
+          "value": "143360"
+        },
+        {
+          "name": "syft:metadata:originPackage",
+          "value": "zlib"
+        },
+        {
+          "name": "syft:metadata:provides:0",
+          "value": "so:libz.so.1=1.3.1"
+        },
+        {
+          "name": "syft:metadata:pullChecksum",
+          "value": "Q14FTw+/Kyr3OzmLi6OGnrl2aoSzE="
+        },
+        {
+          "name": "syft:metadata:pullDependencies:0",
+          "value": "so:libc.musl-aarch64.so.1"
+        },
+        {
+          "name": "syft:metadata:size",
+          "value": "52595"
+        }
+      ]
+    },
+    {
+      "bom-ref": "os:alpine@3.20.0",
+      "type": "operating-system",
+      "name": "alpine",
+      "version": "3.20.0",
+      "description": "Alpine Linux v3.20",
+      "swid": {
+        "tagId": "alpine",
+        "name": "alpine",
+        "version": "3.20.0"
+      },
+      "externalReferences": [
+        {
+          "url": "https://gitlab.alpinelinux.org/alpine/aports/-/issues",
+          "type": "issue-tracker"
+        },
+        {
+          "url": "https://alpinelinux.org/",
+          "type": "website"
+        }
+      ],
+      "properties": [
+        {
+          "name": "syft:distro:id",
+          "value": "alpine"
+        },
+        {
+          "name": "syft:distro:prettyName",
+          "value": "Alpine Linux v3.20"
+        },
+        {
+          "name": "syft:distro:versionID",
+          "value": "3.20.0"
+        }
+      ]
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "pkg:apk/alpine/alpine-baselayout@3.6.5-r0?arch=aarch64&distro=alpine-3.20.0&package-id=21e54be9d7ca763c",
+      "dependsOn": [
+        "pkg:apk/alpine/alpine-baselayout-data@3.6.5-r0?arch=aarch64&upstream=alpine-baselayout&distro=alpine-3.20.0&package-id=9ff96f942d2401f2",
+        "pkg:apk/alpine/busybox-binsh@1.36.1-r28?arch=aarch64&upstream=busybox&distro=alpine-3.20.0&package-id=1fd95b4d43a9f438"
+      ]
+    },
+    {
+      "ref": "pkg:apk/alpine/apk-tools@2.14.4-r0?arch=aarch64&distro=alpine-3.20.0&package-id=78c55d64ab350462",
+      "dependsOn": [
+        "pkg:apk/alpine/ca-certificates-bundle@20240226-r0?arch=aarch64&upstream=ca-certificates&distro=alpine-3.20.0&package-id=bf42440dd0b61727",
+        "pkg:apk/alpine/libcrypto3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0&package-id=0cfcda1a242dfd13",
+        "pkg:apk/alpine/libssl3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0&package-id=1bffb507b1b535bc",
+        "pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&distro=alpine-3.20.0&package-id=03e521237cbed45a",
+        "pkg:apk/alpine/zlib@1.3.1-r1?arch=aarch64&distro=alpine-3.20.0&package-id=d8258d3d7c48cfbf"
+      ]
+    },
+    {
+      "ref": "pkg:apk/alpine/busybox-binsh@1.36.1-r28?arch=aarch64&upstream=busybox&distro=alpine-3.20.0&package-id=1fd95b4d43a9f438",
+      "dependsOn": [
+        "pkg:apk/alpine/busybox@1.36.1-r28?arch=aarch64&distro=alpine-3.20.0&package-id=4cea7ce2e2974c99"
+      ]
+    },
+    {
+      "ref": "pkg:apk/alpine/busybox@1.36.1-r28?arch=aarch64&distro=alpine-3.20.0&package-id=4cea7ce2e2974c99",
+      "dependsOn": [
+        "pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&distro=alpine-3.20.0&package-id=03e521237cbed45a"
+      ]
+    },
+    {
+      "ref": "pkg:apk/alpine/libcrypto3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0&package-id=0cfcda1a242dfd13",
+      "dependsOn": [
+        "pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&distro=alpine-3.20.0&package-id=03e521237cbed45a"
+      ]
+    },
+    {
+      "ref": "pkg:apk/alpine/libssl3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0&package-id=1bffb507b1b535bc",
+      "dependsOn": [
+        "pkg:apk/alpine/libcrypto3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0&package-id=0cfcda1a242dfd13",
+        "pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&distro=alpine-3.20.0&package-id=03e521237cbed45a"
+      ]
+    },
+    {
+      "ref": "pkg:apk/alpine/musl-utils@1.2.5-r0?arch=aarch64&upstream=musl&distro=alpine-3.20.0&package-id=c84ae08b59df5c6e",
+      "dependsOn": [
+        "pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&distro=alpine-3.20.0&package-id=03e521237cbed45a",
+        "pkg:apk/alpine/scanelf@1.3.7-r2?arch=aarch64&upstream=pax-utils&distro=alpine-3.20.0&package-id=54f3623fdd8fb8d4"
+      ]
+    },
+    {
+      "ref": "pkg:apk/alpine/scanelf@1.3.7-r2?arch=aarch64&upstream=pax-utils&distro=alpine-3.20.0&package-id=54f3623fdd8fb8d4",
+      "dependsOn": [
+        "pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&distro=alpine-3.20.0&package-id=03e521237cbed45a"
+      ]
+    },
+    {
+      "ref": "pkg:apk/alpine/ssl_client@1.36.1-r28?arch=aarch64&upstream=busybox&distro=alpine-3.20.0&package-id=6bbb10e52b8e7eb4",
+      "dependsOn": [
+        "pkg:apk/alpine/libcrypto3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0&package-id=0cfcda1a242dfd13",
+        "pkg:apk/alpine/libssl3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0&package-id=1bffb507b1b535bc",
+        "pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&distro=alpine-3.20.0&package-id=03e521237cbed45a"
+      ]
+    },
+    {
+      "ref": "pkg:apk/alpine/zlib@1.3.1-r1?arch=aarch64&distro=alpine-3.20.0&package-id=d8258d3d7c48cfbf",
+      "dependsOn": [
+        "pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&distro=alpine-3.20.0&package-id=03e521237cbed45a"
+      ]
+    }
+  ]
+}
diff --git a/attestation/sbom/boms/cyclonedx-xml/alpine.cyclonedx.xml b/attestation/sbom/boms/cyclonedx-xml/alpine.cyclonedx.xml
new file mode 100644
index 00000000..7690739a
--- /dev/null
+++ b/attestation/sbom/boms/cyclonedx-xml/alpine.cyclonedx.xml
@@ -0,0 +1,585 @@
+<?xml version="1.0" encoding="UTF-8"?><bom xmlns="http://cyclonedx.org/schema/bom/1.5" serialNumber="urn:uuid:fa5447c4-1eab-407c-8104-1614722b59f5" version="1">
+  <metadata>
+    <timestamp>2024-06-08T00:23:38-05:00</timestamp>
+    <tools>
+      <components>
+        <component type="application">
+          <author>anchore</author>
+          <name>syft</name>
+          <version>1.5.0</version>
+        </component>
+      </components>
+    </tools>
+    <component bom-ref="9c7969cf463a5d0e" type="container">
+      <name>alpine</name>
+      <version>sha256:1c3b93ed450e26eac89b471d6d140e2f99488f489739b8b8ea5e8202dd086f82</version>
+    </component>
+  </metadata>
+  <components>
+    <component bom-ref="pkg:apk/alpine/alpine-baselayout@3.6.5-r0?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=21e54be9d7ca763c" type="library">
+      <publisher>Natanael Copa <ncopa@alpinelinux.org></publisher>
+      <name>alpine-baselayout</name>
+      <version>3.6.5-r0</version>
+      <description>Alpine base dir structure and init scripts</description>
+      <licenses>
+        <license>
+          <id>GPL-2.0-only</id>
+        </license>
+      </licenses>
+      <cpe>cpe:2.3:a:alpine-baselayout:alpine-baselayout:3.6.5-r0:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:apk/alpine/alpine-baselayout@3.6.5-r0?arch=aarch64&distro=alpine-3.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://git.alpinelinux.org/cgit/aports/tree/main/alpine-baselayout</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:package:foundBy">apk-db-cataloger</property>
+        <property name="syft:package:type">apk</property>
+        <property name="syft:package:metadataType">apk-db-entry</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine-baselayout:alpine_baselayout:3.6.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine_baselayout:alpine-baselayout:3.6.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine_baselayout:alpine_baselayout:3.6.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine:alpine-baselayout:3.6.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine:alpine_baselayout:3.6.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:location:0:layerID">sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc</property>
+        <property name="syft:location:0:path">/lib/apk/db/installed</property>
+        <property name="syft:metadata:gitCommitOfApkPort">66187892e05b03a41d08e9acabd19b7576a1c875</property>
+        <property name="syft:metadata:installedSize">315392</property>
+        <property name="syft:metadata:originPackage">alpine-baselayout</property>
+        <property name="syft:metadata:pullChecksum">Q1R9ZP0tsvI8T8g9RLcTlCnsFt8l4=</property>
+        <property name="syft:metadata:pullDependencies:0">alpine-baselayout-data=3.6.5-r0</property>
+        <property name="syft:metadata:pullDependencies:1">/bin/sh</property>
+        <property name="syft:metadata:size">8504</property>
+      </properties>
+    </component>
+    <component bom-ref="pkg:apk/alpine/alpine-baselayout-data@3.6.5-r0?arch=aarch64&amp;upstream=alpine-baselayout&amp;distro=alpine-3.20.0&amp;package-id=9ff96f942d2401f2" type="library">
+      <publisher>Natanael Copa <ncopa@alpinelinux.org></publisher>
+      <name>alpine-baselayout-data</name>
+      <version>3.6.5-r0</version>
+      <description>Alpine base dir structure and init scripts</description>
+      <licenses>
+        <license>
+          <id>GPL-2.0-only</id>
+        </license>
+      </licenses>
+      <cpe>cpe:2.3:a:alpine-baselayout-data:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:apk/alpine/alpine-baselayout-data@3.6.5-r0?arch=aarch64&upstream=alpine-baselayout&distro=alpine-3.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://git.alpinelinux.org/cgit/aports/tree/main/alpine-baselayout</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:package:foundBy">apk-db-cataloger</property>
+        <property name="syft:package:type">apk</property>
+        <property name="syft:package:metadataType">apk-db-entry</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine-baselayout-data:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine_baselayout_data:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine_baselayout_data:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine-baselayout:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine-baselayout:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine_baselayout:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine_baselayout:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:location:0:layerID">sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc</property>
+        <property name="syft:location:0:path">/lib/apk/db/installed</property>
+        <property name="syft:metadata:gitCommitOfApkPort">66187892e05b03a41d08e9acabd19b7576a1c875</property>
+        <property name="syft:metadata:installedSize">77824</property>
+        <property name="syft:metadata:originPackage">alpine-baselayout</property>
+        <property name="syft:metadata:pullChecksum">Q1CBqmrtqbjIw3pkxXZ5Thkf2kPxg=</property>
+        <property name="syft:metadata:size">11219</property>
+      </properties>
+    </component>
+    <component bom-ref="pkg:apk/alpine/alpine-keys@2.4-r1?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=0e5100e3d266a135" type="library">
+      <publisher>Natanael Copa <ncopa@alpinelinux.org></publisher>
+      <name>alpine-keys</name>
+      <version>2.4-r1</version>
+      <description>Public keys for Alpine Linux packages</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <cpe>cpe:2.3:a:alpine-keys:alpine-keys:2.4-r1:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:apk/alpine/alpine-keys@2.4-r1?arch=aarch64&distro=alpine-3.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://alpinelinux.org</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:package:foundBy">apk-db-cataloger</property>
+        <property name="syft:package:type">apk</property>
+        <property name="syft:package:metadataType">apk-db-entry</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine-keys:alpine_keys:2.4-r1:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine_keys:alpine-keys:2.4-r1:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine_keys:alpine_keys:2.4-r1:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine:alpine-keys:2.4-r1:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:alpine:alpine_keys:2.4-r1:*:*:*:*:*:*:*</property>
+        <property name="syft:location:0:layerID">sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc</property>
+        <property name="syft:location:0:path">/lib/apk/db/installed</property>
+        <property name="syft:metadata:gitCommitOfApkPort">aab68f8c9ab434a46710de8e12fb3206e2930a59</property>
+        <property name="syft:metadata:installedSize">159744</property>
+        <property name="syft:metadata:originPackage">alpine-keys</property>
+        <property name="syft:metadata:pullChecksum">Q16gIk8kJZbjkxpQzH7qUET//mk4g=</property>
+        <property name="syft:metadata:size">13905</property>
+      </properties>
+    </component>
+    <component bom-ref="pkg:apk/alpine/apk-tools@2.14.4-r0?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=78c55d64ab350462" type="library">
+      <publisher>Natanael Copa <ncopa@alpinelinux.org></publisher>
+      <name>apk-tools</name>
+      <version>2.14.4-r0</version>
+      <description>Alpine Package Keeper - package manager for alpine</description>
+      <licenses>
+        <license>
+          <id>GPL-2.0-only</id>
+        </license>
+      </licenses>
+      <cpe>cpe:2.3:a:apk-tools:apk-tools:2.14.4-r0:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:apk/alpine/apk-tools@2.14.4-r0?arch=aarch64&distro=alpine-3.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://gitlab.alpinelinux.org/alpine/apk-tools</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:package:foundBy">apk-db-cataloger</property>
+        <property name="syft:package:type">apk</property>
+        <property name="syft:package:metadataType">apk-db-entry</property>
+        <property name="syft:cpe23">cpe:2.3:a:apk-tools:apk_tools:2.14.4-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:apk_tools:apk-tools:2.14.4-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:apk_tools:apk_tools:2.14.4-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:apk:apk-tools:2.14.4-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:apk:apk_tools:2.14.4-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:location:0:layerID">sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc</property>
+        <property name="syft:location:0:path">/lib/apk/db/installed</property>
+        <property name="syft:metadata:gitCommitOfApkPort">d435c805af8af4171438da3ec3429c094aac4c6e</property>
+        <property name="syft:metadata:installedSize">380928</property>
+        <property name="syft:metadata:originPackage">apk-tools</property>
+        <property name="syft:metadata:provides:0">so:libapk.so.2.14.0=2.14.0</property>
+        <property name="syft:metadata:provides:1">cmd:apk=2.14.4-r0</property>
+        <property name="syft:metadata:pullChecksum">Q1u2ym9AxaPUuKkZt9wuzNXbihxKU=</property>
+        <property name="syft:metadata:pullDependencies:0">musl>=1.2.3_git20230424</property>
+        <property name="syft:metadata:pullDependencies:1">ca-certificates-bundle</property>
+        <property name="syft:metadata:pullDependencies:2">so:libc.musl-aarch64.so.1</property>
+        <property name="syft:metadata:pullDependencies:3">so:libcrypto.so.3</property>
+        <property name="syft:metadata:pullDependencies:4">so:libssl.so.3</property>
+        <property name="syft:metadata:pullDependencies:5">so:libz.so.1</property>
+        <property name="syft:metadata:size">127552</property>
+      </properties>
+    </component>
+    <component bom-ref="pkg:apk/alpine/busybox@1.36.1-r28?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=4cea7ce2e2974c99" type="library">
+      <publisher>Sören Tempel <soeren+alpine@soeren-tempel.net></publisher>
+      <name>busybox</name>
+      <version>1.36.1-r28</version>
+      <description>Size optimized toolbox of many common UNIX utilities</description>
+      <licenses>
+        <license>
+          <id>GPL-2.0-only</id>
+        </license>
+      </licenses>
+      <cpe>cpe:2.3:a:busybox:busybox:1.36.1-r28:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:apk/alpine/busybox@1.36.1-r28?arch=aarch64&distro=alpine-3.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://busybox.net/</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:package:foundBy">apk-db-cataloger</property>
+        <property name="syft:package:type">apk</property>
+        <property name="syft:package:metadataType">apk-db-entry</property>
+        <property name="syft:location:0:layerID">sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc</property>
+        <property name="syft:location:0:path">/lib/apk/db/installed</property>
+        <property name="syft:metadata:gitCommitOfApkPort">4d9b7d8e9f37907d4ecf8e01e21854e95937e4a8</property>
+        <property name="syft:metadata:installedSize">1040384</property>
+        <property name="syft:metadata:originPackage">busybox</property>
+        <property name="syft:metadata:provides:0">cmd:busybox=1.36.1-r28</property>
+        <property name="syft:metadata:pullChecksum">Q1/eW7ympSUFCka5zq/gNIx8w6gWA=</property>
+        <property name="syft:metadata:pullDependencies:0">so:libc.musl-aarch64.so.1</property>
+        <property name="syft:metadata:size">528988</property>
+      </properties>
+    </component>
+    <component bom-ref="pkg:apk/alpine/busybox-binsh@1.36.1-r28?arch=aarch64&amp;upstream=busybox&amp;distro=alpine-3.20.0&amp;package-id=1fd95b4d43a9f438" type="library">
+      <publisher>Sören Tempel <soeren+alpine@soeren-tempel.net></publisher>
+      <name>busybox-binsh</name>
+      <version>1.36.1-r28</version>
+      <description>busybox ash /bin/sh</description>
+      <licenses>
+        <license>
+          <id>GPL-2.0-only</id>
+        </license>
+      </licenses>
+      <cpe>cpe:2.3:a:busybox-binsh:busybox-binsh:1.36.1-r28:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:apk/alpine/busybox-binsh@1.36.1-r28?arch=aarch64&upstream=busybox&distro=alpine-3.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://busybox.net/</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:package:foundBy">apk-db-cataloger</property>
+        <property name="syft:package:type">apk</property>
+        <property name="syft:package:metadataType">apk-db-entry</property>
+        <property name="syft:cpe23">cpe:2.3:a:busybox-binsh:busybox_binsh:1.36.1-r28:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:busybox_binsh:busybox-binsh:1.36.1-r28:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:busybox_binsh:busybox_binsh:1.36.1-r28:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:busybox:busybox-binsh:1.36.1-r28:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:busybox:busybox_binsh:1.36.1-r28:*:*:*:*:*:*:*</property>
+        <property name="syft:location:0:layerID">sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc</property>
+        <property name="syft:location:0:path">/lib/apk/db/installed</property>
+        <property name="syft:metadata:gitCommitOfApkPort">4d9b7d8e9f37907d4ecf8e01e21854e95937e4a8</property>
+        <property name="syft:metadata:installedSize">8192</property>
+        <property name="syft:metadata:originPackage">busybox</property>
+        <property name="syft:metadata:provides:0">/bin/sh</property>
+        <property name="syft:metadata:provides:1">cmd:sh=1.36.1-r28</property>
+        <property name="syft:metadata:pullChecksum">Q1tqUaZzPBng5354xPbhVrRigXNks=</property>
+        <property name="syft:metadata:pullDependencies:0">busybox=1.36.1-r28</property>
+        <property name="syft:metadata:size">1489</property>
+      </properties>
+    </component>
+    <component bom-ref="pkg:apk/alpine/ca-certificates-bundle@20240226-r0?arch=aarch64&amp;upstream=ca-certificates&amp;distro=alpine-3.20.0&amp;package-id=bf42440dd0b61727" type="library">
+      <publisher>Natanael Copa <ncopa@alpinelinux.org></publisher>
+      <name>ca-certificates-bundle</name>
+      <version>20240226-r0</version>
+      <description>Pre generated bundle of Mozilla certificates</description>
+      <licenses>
+        <expression>MPL-2.0 AND MIT</expression>
+      </licenses>
+      <cpe>cpe:2.3:a:ca-certificates-bundle:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:apk/alpine/ca-certificates-bundle@20240226-r0?arch=aarch64&upstream=ca-certificates&distro=alpine-3.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:package:foundBy">apk-db-cataloger</property>
+        <property name="syft:package:type">apk</property>
+        <property name="syft:package:metadataType">apk-db-entry</property>
+        <property name="syft:cpe23">cpe:2.3:a:ca-certificates-bundle:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:ca_certificates_bundle:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:ca_certificates_bundle:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:ca-certificates:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:ca-certificates:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:ca_certificates:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:ca_certificates:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:mozilla:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:mozilla:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:ca:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:ca:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:location:0:layerID">sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc</property>
+        <property name="syft:location:0:path">/lib/apk/db/installed</property>
+        <property name="syft:metadata:gitCommitOfApkPort">56fb003da0adcea3b59373ef6a633d0c5bfef3ac</property>
+        <property name="syft:metadata:installedSize">241664</property>
+        <property name="syft:metadata:originPackage">ca-certificates</property>
+        <property name="syft:metadata:provides:0">ca-certificates-cacert=20240226-r0</property>
+        <property name="syft:metadata:pullChecksum">Q1WTaxkM5GDX5n/oNq7cPedv59BKk=</property>
+        <property name="syft:metadata:size">130197</property>
+      </properties>
+    </component>
+    <component bom-ref="pkg:apk/alpine/libcrypto3@3.3.0-r2?arch=aarch64&amp;upstream=openssl&amp;distro=alpine-3.20.0&amp;package-id=0cfcda1a242dfd13" type="library">
+      <publisher>Natanael Copa <ncopa@alpinelinux.org></publisher>
+      <name>libcrypto3</name>
+      <version>3.3.0-r2</version>
+      <description>Crypto library from openssl</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <cpe>cpe:2.3:a:libcrypto3:libcrypto3:3.3.0-r2:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:apk/alpine/libcrypto3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://www.openssl.org/</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:package:foundBy">apk-db-cataloger</property>
+        <property name="syft:package:type">apk</property>
+        <property name="syft:package:metadataType">apk-db-entry</property>
+        <property name="syft:cpe23">cpe:2.3:a:libcrypto3:libcrypto:3.3.0-r2:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:libcrypto:libcrypto3:3.3.0-r2:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:libcrypto:libcrypto:3.3.0-r2:*:*:*:*:*:*:*</property>
+        <property name="syft:location:0:layerID">sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc</property>
+        <property name="syft:location:0:path">/lib/apk/db/installed</property>
+        <property name="syft:metadata:gitCommitOfApkPort">6758e15d502acb632d3ed521a992f1308c6e2fd8</property>
+        <property name="syft:metadata:installedSize">5095424</property>
+        <property name="syft:metadata:originPackage">openssl</property>
+        <property name="syft:metadata:provides:0">so:libcrypto.so.3=3</property>
+        <property name="syft:metadata:pullChecksum">Q1PRU3l0tZ3GQKiTZb4AYtcoZNO2A=</property>
+        <property name="syft:metadata:pullDependencies:0">so:libc.musl-aarch64.so.1</property>
+        <property name="syft:metadata:size">2227080</property>
+      </properties>
+    </component>
+    <component bom-ref="pkg:apk/alpine/libssl3@3.3.0-r2?arch=aarch64&amp;upstream=openssl&amp;distro=alpine-3.20.0&amp;package-id=1bffb507b1b535bc" type="library">
+      <publisher>Natanael Copa <ncopa@alpinelinux.org></publisher>
+      <name>libssl3</name>
+      <version>3.3.0-r2</version>
+      <description>SSL shared libraries</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <cpe>cpe:2.3:a:libssl3:libssl3:3.3.0-r2:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:apk/alpine/libssl3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://www.openssl.org/</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:package:foundBy">apk-db-cataloger</property>
+        <property name="syft:package:type">apk</property>
+        <property name="syft:package:metadataType">apk-db-entry</property>
+        <property name="syft:cpe23">cpe:2.3:a:libssl3:libssl:3.3.0-r2:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:libssl:libssl3:3.3.0-r2:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:libssl:libssl:3.3.0-r2:*:*:*:*:*:*:*</property>
+        <property name="syft:location:0:layerID">sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc</property>
+        <property name="syft:location:0:path">/lib/apk/db/installed</property>
+        <property name="syft:metadata:gitCommitOfApkPort">6758e15d502acb632d3ed521a992f1308c6e2fd8</property>
+        <property name="syft:metadata:installedSize">950272</property>
+        <property name="syft:metadata:originPackage">openssl</property>
+        <property name="syft:metadata:provides:0">so:libssl.so.3=3</property>
+        <property name="syft:metadata:pullChecksum">Q1tT+BUWpaUligJVR/UsT5zI/elh0=</property>
+        <property name="syft:metadata:pullDependencies:0">libcrypto3=3.3.0-r2</property>
+        <property name="syft:metadata:pullDependencies:1">so:libc.musl-aarch64.so.1</property>
+        <property name="syft:metadata:pullDependencies:2">so:libcrypto.so.3</property>
+        <property name="syft:metadata:size">362382</property>
+      </properties>
+    </component>
+    <component bom-ref="pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=03e521237cbed45a" type="library">
+      <publisher>Natanael Copa <ncopa@alpinelinux.org></publisher>
+      <name>musl</name>
+      <version>1.2.5-r0</version>
+      <description>the musl c library (libc) implementation</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <cpe>cpe:2.3:a:musl-libc:musl:1.2.5-r0:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&distro=alpine-3.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://musl.libc.org/</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:package:foundBy">apk-db-cataloger</property>
+        <property name="syft:package:type">apk</property>
+        <property name="syft:package:metadataType">apk-db-entry</property>
+        <property name="syft:cpe23">cpe:2.3:a:musl_libc:musl:1.2.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:musl:musl:1.2.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:location:0:layerID">sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc</property>
+        <property name="syft:location:0:path">/lib/apk/db/installed</property>
+        <property name="syft:metadata:gitCommitOfApkPort">4fe5bdbe47b100daa6380f81c4c8ea3f99b61362</property>
+        <property name="syft:metadata:installedSize">741376</property>
+        <property name="syft:metadata:originPackage">musl</property>
+        <property name="syft:metadata:provides:0">so:libc.musl-aarch64.so.1=1</property>
+        <property name="syft:metadata:pullChecksum">Q1sdlDq9r9kKVIGZNgDX6mkPZMaHE=</property>
+        <property name="syft:metadata:size">415580</property>
+      </properties>
+    </component>
+    <component bom-ref="pkg:apk/alpine/musl-utils@1.2.5-r0?arch=aarch64&amp;upstream=musl&amp;distro=alpine-3.20.0&amp;package-id=c84ae08b59df5c6e" type="library">
+      <publisher>Natanael Copa <ncopa@alpinelinux.org></publisher>
+      <name>musl-utils</name>
+      <version>1.2.5-r0</version>
+      <description>the musl c library (libc) implementation</description>
+      <licenses>
+        <expression>MIT AND BSD-2-Clause AND GPL-2.0-or-later</expression>
+      </licenses>
+      <cpe>cpe:2.3:a:musl-utils:musl-utils:1.2.5-r0:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:apk/alpine/musl-utils@1.2.5-r0?arch=aarch64&upstream=musl&distro=alpine-3.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://musl.libc.org/</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:package:foundBy">apk-db-cataloger</property>
+        <property name="syft:package:type">apk</property>
+        <property name="syft:package:metadataType">apk-db-entry</property>
+        <property name="syft:cpe23">cpe:2.3:a:musl-utils:musl_utils:1.2.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:musl_utils:musl-utils:1.2.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:musl_utils:musl_utils:1.2.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:musl-libc:musl-utils:1.2.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:musl-libc:musl_utils:1.2.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:musl:musl-utils:1.2.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:musl:musl_utils:1.2.5-r0:*:*:*:*:*:*:*</property>
+        <property name="syft:location:0:layerID">sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc</property>
+        <property name="syft:location:0:path">/lib/apk/db/installed</property>
+        <property name="syft:metadata:gitCommitOfApkPort">4fe5bdbe47b100daa6380f81c4c8ea3f99b61362</property>
+        <property name="syft:metadata:installedSize">286720</property>
+        <property name="syft:metadata:originPackage">musl</property>
+        <property name="syft:metadata:provides:0">libc-utils=1.2.5-r0</property>
+        <property name="syft:metadata:provides:1">cmd:getconf=1.2.5-r0</property>
+        <property name="syft:metadata:provides:2">cmd:getent=1.2.5-r0</property>
+        <property name="syft:metadata:provides:3">cmd:iconv=1.2.5-r0</property>
+        <property name="syft:metadata:provides:4">cmd:ldconfig=1.2.5-r0</property>
+        <property name="syft:metadata:provides:5">cmd:ldd=1.2.5-r0</property>
+        <property name="syft:metadata:pullChecksum">Q1BQWUHHGLpcXMeRjKiOCeK7/RiWc=</property>
+        <property name="syft:metadata:pullDependencies:0">scanelf</property>
+        <property name="syft:metadata:pullDependencies:1">so:libc.musl-aarch64.so.1</property>
+        <property name="syft:metadata:size">39340</property>
+      </properties>
+    </component>
+    <component bom-ref="pkg:apk/alpine/scanelf@1.3.7-r2?arch=aarch64&amp;upstream=pax-utils&amp;distro=alpine-3.20.0&amp;package-id=54f3623fdd8fb8d4" type="library">
+      <publisher>Natanael Copa <ncopa@alpinelinux.org></publisher>
+      <name>scanelf</name>
+      <version>1.3.7-r2</version>
+      <description>Scan ELF binaries for stuff</description>
+      <licenses>
+        <license>
+          <id>GPL-2.0-only</id>
+        </license>
+      </licenses>
+      <cpe>cpe:2.3:a:scanelf:scanelf:1.3.7-r2:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:apk/alpine/scanelf@1.3.7-r2?arch=aarch64&upstream=pax-utils&distro=alpine-3.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:package:foundBy">apk-db-cataloger</property>
+        <property name="syft:package:type">apk</property>
+        <property name="syft:package:metadataType">apk-db-entry</property>
+        <property name="syft:location:0:layerID">sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc</property>
+        <property name="syft:location:0:path">/lib/apk/db/installed</property>
+        <property name="syft:metadata:gitCommitOfApkPort">e65a4f2d0470e70d862ef2b5c412ecf2cb9ad0a6</property>
+        <property name="syft:metadata:installedSize">147456</property>
+        <property name="syft:metadata:originPackage">pax-utils</property>
+        <property name="syft:metadata:provides:0">cmd:scanelf=1.3.7-r2</property>
+        <property name="syft:metadata:pullChecksum">Q1aO0qnRrUwglfFuvEajfWlPUUAXk=</property>
+        <property name="syft:metadata:pullDependencies:0">so:libc.musl-aarch64.so.1</property>
+        <property name="syft:metadata:size">33669</property>
+      </properties>
+    </component>
+    <component bom-ref="pkg:apk/alpine/ssl_client@1.36.1-r28?arch=aarch64&amp;upstream=busybox&amp;distro=alpine-3.20.0&amp;package-id=6bbb10e52b8e7eb4" type="library">
+      <publisher>Sören Tempel <soeren+alpine@soeren-tempel.net></publisher>
+      <name>ssl_client</name>
+      <version>1.36.1-r28</version>
+      <description>EXternal ssl_client for busybox wget</description>
+      <licenses>
+        <license>
+          <id>GPL-2.0-only</id>
+        </license>
+      </licenses>
+      <cpe>cpe:2.3:a:ssl-client:ssl-client:1.36.1-r28:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:apk/alpine/ssl_client@1.36.1-r28?arch=aarch64&upstream=busybox&distro=alpine-3.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://busybox.net/</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:package:foundBy">apk-db-cataloger</property>
+        <property name="syft:package:type">apk</property>
+        <property name="syft:package:metadataType">apk-db-entry</property>
+        <property name="syft:cpe23">cpe:2.3:a:ssl-client:ssl_client:1.36.1-r28:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:ssl_client:ssl-client:1.36.1-r28:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:ssl_client:ssl_client:1.36.1-r28:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:ssl:ssl-client:1.36.1-r28:*:*:*:*:*:*:*</property>
+        <property name="syft:cpe23">cpe:2.3:a:ssl:ssl_client:1.36.1-r28:*:*:*:*:*:*:*</property>
+        <property name="syft:location:0:layerID">sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc</property>
+        <property name="syft:location:0:path">/lib/apk/db/installed</property>
+        <property name="syft:metadata:gitCommitOfApkPort">4d9b7d8e9f37907d4ecf8e01e21854e95937e4a8</property>
+        <property name="syft:metadata:installedSize">81920</property>
+        <property name="syft:metadata:originPackage">busybox</property>
+        <property name="syft:metadata:provides:0">cmd:ssl_client=1.36.1-r28</property>
+        <property name="syft:metadata:pullChecksum">Q1St6DKLiEYxalNRl8Kfj2PH1fZco=</property>
+        <property name="syft:metadata:pullDependencies:0">so:libc.musl-aarch64.so.1</property>
+        <property name="syft:metadata:pullDependencies:1">so:libcrypto.so.3</property>
+        <property name="syft:metadata:pullDependencies:2">so:libssl.so.3</property>
+        <property name="syft:metadata:size">5084</property>
+      </properties>
+    </component>
+    <component bom-ref="pkg:apk/alpine/zlib@1.3.1-r1?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=d8258d3d7c48cfbf" type="library">
+      <publisher>Natanael Copa <ncopa@alpinelinux.org></publisher>
+      <name>zlib</name>
+      <version>1.3.1-r1</version>
+      <description>A compression/decompression Library</description>
+      <licenses>
+        <license>
+          <id>Zlib</id>
+        </license>
+      </licenses>
+      <cpe>cpe:2.3:a:zlib:zlib:1.3.1-r1:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:apk/alpine/zlib@1.3.1-r1?arch=aarch64&distro=alpine-3.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://zlib.net/</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:package:foundBy">apk-db-cataloger</property>
+        <property name="syft:package:type">apk</property>
+        <property name="syft:package:metadataType">apk-db-entry</property>
+        <property name="syft:location:0:layerID">sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc</property>
+        <property name="syft:location:0:path">/lib/apk/db/installed</property>
+        <property name="syft:metadata:gitCommitOfApkPort">fad2d175bd85eb4c5566765375392a7394dfbcf2</property>
+        <property name="syft:metadata:installedSize">143360</property>
+        <property name="syft:metadata:originPackage">zlib</property>
+        <property name="syft:metadata:provides:0">so:libz.so.1=1.3.1</property>
+        <property name="syft:metadata:pullChecksum">Q14FTw+/Kyr3OzmLi6OGnrl2aoSzE=</property>
+        <property name="syft:metadata:pullDependencies:0">so:libc.musl-aarch64.so.1</property>
+        <property name="syft:metadata:size">52595</property>
+      </properties>
+    </component>
+    <component bom-ref="os:alpine@3.20.0" type="operating-system">
+      <name>alpine</name>
+      <version>3.20.0</version>
+      <description>Alpine Linux v3.20</description>
+      <swid tagId="alpine" name="alpine" version="3.20.0"/>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://gitlab.alpinelinux.org/alpine/aports/-/issues</url>
+        </reference>
+        <reference type="website">
+          <url>https://alpinelinux.org/</url>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="syft:distro:id">alpine</property>
+        <property name="syft:distro:prettyName">Alpine Linux v3.20</property>
+        <property name="syft:distro:versionID">3.20.0</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="pkg:apk/alpine/alpine-baselayout@3.6.5-r0?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=21e54be9d7ca763c">
+      <dependency ref="pkg:apk/alpine/alpine-baselayout-data@3.6.5-r0?arch=aarch64&amp;upstream=alpine-baselayout&amp;distro=alpine-3.20.0&amp;package-id=9ff96f942d2401f2"/>
+      <dependency ref="pkg:apk/alpine/busybox-binsh@1.36.1-r28?arch=aarch64&amp;upstream=busybox&amp;distro=alpine-3.20.0&amp;package-id=1fd95b4d43a9f438"/>/>
+    <dependency ref="pkg:apk/alpine/apk-tools@2.14.4-r0?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=78c55d64ab350462">
+      <dependency ref="pkg:apk/alpine/ca-certificates-bundle@20240226-r0?arch=aarch64&amp;upstream=ca-certificates&amp;distro=alpine-3.20.0&amp;package-id=bf42440dd0b61727"/>
+      <dependency ref="pkg:apk/alpine/libcrypto3@3.3.0-r2?arch=aarch64&amp;upstream=openssl&amp;distro=alpine-3.20.0&amp;package-id=0cfcda1a242dfd13"/>
+      <dependency ref="pkg:apk/alpine/libssl3@3.3.0-r2?arch=aarch64&amp;upstream=openssl&amp;distro=alpine-3.20.0&amp;package-id=1bffb507b1b535bc"/>
+      <dependency ref="pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=03e521237cbed45a"/>
+      <dependency ref="pkg:apk/alpine/zlib@1.3.1-r1?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=d8258d3d7c48cfbf"/>/>
+    <dependency ref="pkg:apk/alpine/busybox-binsh@1.36.1-r28?arch=aarch64&amp;upstream=busybox&amp;distro=alpine-3.20.0&amp;package-id=1fd95b4d43a9f438">
+      <dependency ref="pkg:apk/alpine/busybox@1.36.1-r28?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=4cea7ce2e2974c99"/>/>
+    <dependency ref="pkg:apk/alpine/busybox@1.36.1-r28?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=4cea7ce2e2974c99">
+      <dependency ref="pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=03e521237cbed45a"/>/>
+    <dependency ref="pkg:apk/alpine/libcrypto3@3.3.0-r2?arch=aarch64&amp;upstream=openssl&amp;distro=alpine-3.20.0&amp;package-id=0cfcda1a242dfd13">
+      <dependency ref="pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=03e521237cbed45a"/>/>
+    <dependency ref="pkg:apk/alpine/libssl3@3.3.0-r2?arch=aarch64&amp;upstream=openssl&amp;distro=alpine-3.20.0&amp;package-id=1bffb507b1b535bc">
+      <dependency ref="pkg:apk/alpine/libcrypto3@3.3.0-r2?arch=aarch64&amp;upstream=openssl&amp;distro=alpine-3.20.0&amp;package-id=0cfcda1a242dfd13"/>
+      <dependency ref="pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=03e521237cbed45a"/>/>
+    <dependency ref="pkg:apk/alpine/musl-utils@1.2.5-r0?arch=aarch64&amp;upstream=musl&amp;distro=alpine-3.20.0&amp;package-id=c84ae08b59df5c6e">
+      <dependency ref="pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=03e521237cbed45a"/>
+      <dependency ref="pkg:apk/alpine/scanelf@1.3.7-r2?arch=aarch64&amp;upstream=pax-utils&amp;distro=alpine-3.20.0&amp;package-id=54f3623fdd8fb8d4"/>/>
+    <dependency ref="pkg:apk/alpine/scanelf@1.3.7-r2?arch=aarch64&amp;upstream=pax-utils&amp;distro=alpine-3.20.0&amp;package-id=54f3623fdd8fb8d4">
+      <dependency ref="pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=03e521237cbed45a"/>/>
+    <dependency ref="pkg:apk/alpine/ssl_client@1.36.1-r28?arch=aarch64&amp;upstream=busybox&amp;distro=alpine-3.20.0&amp;package-id=6bbb10e52b8e7eb4">
+      <dependency ref="pkg:apk/alpine/libcrypto3@3.3.0-r2?arch=aarch64&amp;upstream=openssl&amp;distro=alpine-3.20.0&amp;package-id=0cfcda1a242dfd13"/>
+      <dependency ref="pkg:apk/alpine/libssl3@3.3.0-r2?arch=aarch64&amp;upstream=openssl&amp;distro=alpine-3.20.0&amp;package-id=1bffb507b1b535bc"/>
+      <dependency ref="pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=03e521237cbed45a"/>/>
+    <dependency ref="pkg:apk/alpine/zlib@1.3.1-r1?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=d8258d3d7c48cfbf">
+      <dependency ref="pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&amp;distro=alpine-3.20.0&amp;package-id=03e521237cbed45a"/>/>
+  </dependencies>
+</bom>
diff --git a/attestation/sbom/boms/spdx-2.2/alpine.spdx-2-2.json b/attestation/sbom/boms/spdx-2.2/alpine.spdx-2-2.json
new file mode 100644
index 00000000..19afba25
--- /dev/null
+++ b/attestation/sbom/boms/spdx-2.2/alpine.spdx-2-2.json
@@ -0,0 +1,3167 @@
+{"spdxVersion": "SPDX-2.2",
+  "dataLicense": "CC0-1.0",
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "name": "alpine",
+  "documentNamespace": "https://anchore.com/syft/image/alpine-50dc349e-c245-4e86-b8f8-e55354679812",
+  "creationInfo": {
+    "licenseListVersion": "3.24",
+    "creators": [
+      "Organization: Anchore, Inc",
+      "Tool: syft-1.5.0"
+    ],
+    "created": "2024-06-08T05:25:40Z"
+  },
+  "packages": [
+    {
+      "name": "alpine-baselayout",
+      "SPDXID": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "versionInfo": "3.6.5-r0",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://git.alpinelinux.org/cgit/aports/tree/main/alpine-baselayout",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "6a22bff30e2aed347029eeb9d51c810613705455"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "description": "Alpine base dir structure and init scripts",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-baselayout:alpine-baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-baselayout:alpine_baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_baselayout:alpine-baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_baselayout:alpine_baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine:alpine-baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine:alpine_baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/alpine-baselayout@3.6.5-r0?arch=aarch64&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "alpine-baselayout-data",
+      "SPDXID": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "versionInfo": "3.6.5-r0",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://git.alpinelinux.org/cgit/aports/tree/main/alpine-baselayout",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "6a7d69893b8bca00a39ad9a06c6a7e2833593ad0"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "description": "Alpine base dir structure and init scripts",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-baselayout-data:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-baselayout-data:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_baselayout_data:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_baselayout_data:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-baselayout:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-baselayout:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_baselayout:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_baselayout:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/alpine-baselayout-data@3.6.5-r0?arch=aarch64&upstream=alpine-baselayout&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "alpine-keys",
+      "SPDXID": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "versionInfo": "2.4-r1",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://alpinelinux.org",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "555910826b4a68482679b6d4809b1502dd6d46ab"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "description": "Public keys for Alpine Linux packages",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-keys:alpine-keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-keys:alpine_keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_keys:alpine-keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_keys:alpine_keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine:alpine-keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine:alpine_keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/alpine-keys@2.4-r1?arch=aarch64&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "apk-tools",
+      "SPDXID": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "versionInfo": "2.14.4-r0",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://gitlab.alpinelinux.org/alpine/apk-tools",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "e09707a797756cf9daf1c3f5832e7c4499a04266"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "description": "Alpine Package Keeper - package manager for alpine",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:apk-tools:apk-tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:apk-tools:apk_tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:apk_tools:apk-tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:apk_tools:apk_tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:apk:apk-tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:apk:apk_tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/apk-tools@2.14.4-r0?arch=aarch64&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "busybox",
+      "SPDXID": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "versionInfo": "1.36.1-r28",
+      "supplier": "NOASSERTION",
+      "downloadLocation": "https://busybox.net/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "c873508e0b37506b4b2d3006b4ce096069b6ab9a"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "description": "Size optimized toolbox of many common UNIX utilities",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:busybox:busybox:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/busybox@1.36.1-r28?arch=aarch64&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "busybox-binsh",
+      "SPDXID": "SPDXRef-Package-apk-busybox-binsh-1fd95b4d43a9f438",
+      "versionInfo": "1.36.1-r28",
+      "supplier": "NOASSERTION",
+      "downloadLocation": "https://busybox.net/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "71bd3a1b510b531ba920457cfaa87f907c6cd091"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "description": "busybox ash /bin/sh",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:busybox-binsh:busybox-binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:busybox-binsh:busybox_binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:busybox_binsh:busybox-binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:busybox_binsh:busybox_binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:busybox:busybox-binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:busybox:busybox_binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/busybox-binsh@1.36.1-r28?arch=aarch64&upstream=busybox&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "ca-certificates-bundle",
+      "SPDXID": "SPDXRef-Package-apk-ca-certificates-bundle-bf42440dd0b61727",
+      "versionInfo": "20240226-r0",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "ed7a773d52aea0765c0db03bb25b01b5f0f50f3c"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "(MPL-2.0 AND MIT)",
+      "copyrightText": "NOASSERTION",
+      "description": "Pre generated bundle of Mozilla certificates",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca-certificates-bundle:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca-certificates-bundle:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca_certificates_bundle:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca_certificates_bundle:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca-certificates:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca-certificates:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca_certificates:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca_certificates:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:mozilla:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:mozilla:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/ca-certificates-bundle@20240226-r0?arch=aarch64&upstream=ca-certificates&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "libcrypto3",
+      "SPDXID": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "versionInfo": "3.3.0-r2",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://www.openssl.org/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "ae6bdffda4acbdf371b8ccc19dba2e7a525d08e1"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "Apache-2.0",
+      "copyrightText": "NOASSERTION",
+      "description": "Crypto library from openssl",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libcrypto3:libcrypto3:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libcrypto3:libcrypto:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libcrypto:libcrypto3:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libcrypto:libcrypto:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/libcrypto3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "libssl3",
+      "SPDXID": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "versionInfo": "3.3.0-r2",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://www.openssl.org/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "bdcc4aef521963183255243c4256cc3348a6796b"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "Apache-2.0",
+      "copyrightText": "NOASSERTION",
+      "description": "SSL shared libraries",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libssl3:libssl3:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libssl3:libssl:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libssl:libssl3:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libssl:libssl:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/libssl3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "musl",
+      "SPDXID": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "versionInfo": "1.2.5-r0",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://musl.libc.org/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "498ba4340e8deb05fbea7e1053b734717307dd81"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "description": "the musl c library (libc) implementation",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl-libc:musl:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl_libc:musl:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl:musl:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "musl-utils",
+      "SPDXID": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "versionInfo": "1.2.5-r0",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://musl.libc.org/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "c05211eeb2d680bcd129b57790feea2157222f93"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "(MIT AND BSD-2-Clause AND GPL-2.0-or-later)",
+      "copyrightText": "NOASSERTION",
+      "description": "the musl c library (libc) implementation",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl-utils:musl-utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl-utils:musl_utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl_utils:musl-utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl_utils:musl_utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl-libc:musl-utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl-libc:musl_utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl:musl-utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl:musl_utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/musl-utils@1.2.5-r0?arch=aarch64&upstream=musl&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "scanelf",
+      "SPDXID": "SPDXRef-Package-apk-scanelf-54f3623fdd8fb8d4",
+      "versionInfo": "1.3.7-r2",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "98c686afd83394fddb10bd9239ec6b5a474397f1"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "description": "Scan ELF binaries for stuff",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:scanelf:scanelf:1.3.7-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/scanelf@1.3.7-r2?arch=aarch64&upstream=pax-utils&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "ssl_client",
+      "SPDXID": "SPDXRef-Package-apk-ssl-client-6bbb10e52b8e7eb4",
+      "versionInfo": "1.36.1-r28",
+      "supplier": "NOASSERTION",
+      "downloadLocation": "https://busybox.net/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "7d5a1591577ff883690877e5b50998b7950f9ac7"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "description": "EXternal ssl_client for busybox wget",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ssl-client:ssl-client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ssl-client:ssl_client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ssl_client:ssl-client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ssl_client:ssl_client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ssl:ssl-client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ssl:ssl_client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/ssl_client@1.36.1-r28?arch=aarch64&upstream=busybox&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "zlib",
+      "SPDXID": "SPDXRef-Package-apk-zlib-d8258d3d7c48cfbf",
+      "versionInfo": "1.3.1-r1",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://zlib.net/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "144c1bbadb241708c66589af3af429734cb73bb0"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "Zlib",
+      "copyrightText": "NOASSERTION",
+      "description": "A compression/decompression Library",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:zlib:zlib:1.3.1-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/zlib@1.3.1-r1?arch=aarch64&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "SPDXID": "SPDXRef-DocumentRoot-Image-alpine",
+      "checksums": [
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "1c3b93ed450e26eac89b471d6d140e2f99488f489739b8b8ea5e8202dd086f82"
+        }
+      ],
+      "copyrightText": "",
+      "downloadLocation": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE_MANAGER",
+          "referenceLocator": "pkg:oci/alpine@sha256:1c3b93ed450e26eac89b471d6d140e2f99488f489739b8b8ea5e8202dd086f82?arch=arm64&tag=latest",
+          "referenceType": "purl"
+        }
+      ],
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "name": "alpine",
+      "supplier": "NOASSERTION",
+      "versionInfo": "sha256:1c3b93ed450e26eac89b471d6d140e2f99488f489739b8b8ea5e8202dd086f82"
+    }
+  ],
+  "files": [
+    {
+      "fileName": "/bin/busybox",
+      "SPDXID": "SPDXRef-File-bin-busybox-909c5f40cb01cb38",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "db850d50e6edff81a9f1af582aaf9b843b0981e3"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "19f15cbea8d91421f7f8d5086a494048d305a922a8cad88f0a4836299411ac12"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-524d27bb.rsa.pub-6742b949ff851b46",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "053a92f87fd4532850bb31f0881978efe0532ae5"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "1bb2a846c0ea4ca9d0e7862f970863857fc33c32f5506098c636a62a726a847b"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58199dcc.rsa.pub-444fb4815b9c5fa7",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "39ac5d72c6ba018a0f74b8b453894edc9db07b5f"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "73867d92083f2f8ab899a26ccda7ef63dfaa0032a938620eda605558958a8041"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616a9724.rsa.pub-cfc1d017a48ee9e7",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "23d0f2ea1af269c2f66165e0f8a944e96bf011de"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "10877cce0a935e46ad88cb79e174a2491680508eccda08e92bf04fb9bf37fbc1"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616adfeb.rsa.pub-ed83cb346d241bdf",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "de1241307014aae3dba798e900f163408d98d6f4"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "ebe717d228555aa58133c202314a451f81e71f174781fd7ff8d8970d6cfa60da"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616ae350.rsa.pub-76207aeaad529724",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "57f6b93fda4a4496fab62844ddef0eeb168f80b5"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "d11f6b21c61b4274e182eb888883a8ba8acdbf820dcc7a6d82a7d9fc2fd2836d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/busybox-paths.d/busybox",
+      "SPDXID": "SPDXRef-File-etc-busybox-paths.d-busybox-6a326fdbd2e5a86c",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "af9972dab927fb4bfcbf574de8cf870492a66657"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "e12e0822f5c6426b62f07799a0fc20394241535c5bc2cc8f10c8a25088b8defa"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/crontabs/root",
+      "SPDXID": "SPDXRef-File-etc-crontabs-root-351da988aba8a527",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "bdf9356a9516238c8b2468613517749098b17ef6"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "575d810a9fae5f2f0671c9b2c0ce973e46c7207fbe5cb8d1b0d1836a6a0470e3"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/fstab",
+      "SPDXID": "SPDXRef-File-etc-fstab-0c5c3473875a5b85",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "d50ee135ef10a434b9df582ea8276b5c1ce803fa"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "a3efca2e8d62785c87517283092b4c800d88612b6f3f06b80a4c2f39d8e68841"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/group",
+      "SPDXID": "SPDXRef-File-etc-group-cc490babc7ba6984",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "d8eb64e0cdfd7cfd998e4a1bbb49c2f45be5448d"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "6fb6ab5a5526e6f4896b70c7e3c350fd475158a1f0d7b5fc0f3f9bd57f1c3be8"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/hostname",
+      "SPDXID": "SPDXRef-File-etc-hostname-18f4143fa24a5309",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "ea75706155cffed0a1bd43ddba4543da27d73a67"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "d906aecb61d076a967d9ffe8821c7b04b063f72df9d9e35b33ef36b1c0d98f16"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/hosts",
+      "SPDXID": "SPDXRef-File-etc-hosts-097d60485ef1a565",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "043eb324a653456caa1a73e2e2d49f77792bb0c5"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "e3998dbe02b51dada33de87ae43d18a93ab6915b9e34f5a751bf2b9b25a55492"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/inittab",
+      "SPDXID": "SPDXRef-File-etc-inittab-273285a459443001",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "ce9586d2acf1d9462765259a21ccc4f96a402151"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "7326d8ad56bf5fea63b1ca516a747ff6e6723e25ae84a93c31620b03de6c001d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/logrotate.d/acpid",
+      "SPDXID": "SPDXRef-File-etc-logrotate.d-acpid-e47331443c3f2fdc",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "4f29720883559a74be03f4de69de2f66113b064b"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "d608a3b7715886b5735def0cc50a6359fd364fac2e0e0a459c588c04be471031"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/modprobe.d/aliases.conf",
+      "SPDXID": "SPDXRef-File-etc-modprobe.d-aliases.conf-8ac9ab5944e0b537",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "5946e1e930583552bb7b863eb94bcbb3feef8aa9"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "3ebaba946f213670170c7d69949f690a3854553bd0b1560f1d980cba4c83a942"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/modprobe.d/blacklist.conf",
+      "SPDXID": "SPDXRef-File-etc-modprobe.d-blacklist.conf-abf9fc46510ff77c",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "e1376014791376ddee402f8d06dae7b4e9e6f67e"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "5cd46031fc7dc7186e67c97fd34780597de4ebff51dbe41eba27220fe5e0d866"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/modprobe.d/i386.conf",
+      "SPDXID": "SPDXRef-File-etc-modprobe.d-i386.conf-e9054a53c22e88cf",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "a676b2fe78e7ea897d702b2c2fb2a2659f1eb657"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "6c46c4cbfb8b7594f19eb94801a350fa2221ae9ac5239a8819d15555caa76ae8"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/modprobe.d/kms.conf",
+      "SPDXID": "SPDXRef-File-etc-modprobe.d-kms.conf-77f620d7a99cffa8",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "ca76cb9f71980e9bda8db6bf95da759e26b27a88"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "50467fa732f809f3a2bb5738628765c5f895c3a237e1c1ad09f85d41fd9ca7c5"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/modules",
+      "SPDXID": "SPDXRef-File-etc-modules-f9e050b82be1ad75",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "b68a208d48a91c670c8040a03c95fae12c144f53"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "2c881de75a5409c35d2433a24f180b8b02ba478ef2c1c60ea3434a35bcbc335d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/motd",
+      "SPDXID": "SPDXRef-File-etc-motd-9a55980593b74a03",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "48b912f610627546cfc30af0f974745a1bf7c30f"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "ff044e9be5daa2eee2d3d10a4da72e5477e4c24c16f1792de2c91dae844c0e30"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/network/if-up.d/dad",
+      "SPDXID": "SPDXRef-File-etc-network-if-up.d-dad-e17f6cd71c480b11",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "ddd99bc197c36e8a9aab9463aaeebda44a7a8029"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "2fd20d1bc67d9ee711990002b24f156635a73f56b8935b2f76592938817fa4e7"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/nsswitch.conf",
+      "SPDXID": "SPDXRef-File-etc-nsswitch.conf-26adb8feffe4129b",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "f4306c327bf44767da8da4e3a13bf40bdd4d3aaa"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "0afd94c183d30a348b45057f6bf468e121aa448a7641109addb5bb8e282f514d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/passwd",
+      "SPDXID": "SPDXRef-File-etc-passwd-7accffa8923d35e9",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "afe6cba27664032062c7f1cb812783b1ecf6d99b"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "31a94f06f17bc3b9085fccab1d0fa6ee9e79c4a1e4d91f617fa5de95863be015"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/profile",
+      "SPDXID": "SPDXRef-File-etc-profile-6dfdb9518e6b63ef",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "54dd1d99ac0383798113f96307ee9b52b0bb0f37"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "87e8643d3ce156de0c09370d4d39446f30bd00d264bea248abc191c4d7b9df3e"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/profile.d/20locale.sh",
+      "SPDXID": "SPDXRef-File-etc-profile.d-20locale.sh-4738cb952eababba",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "96adbd950ccf992085295990f9bbe667f0cf4c4e"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "284a6ef56ab97a13a777c6b01ae14f2cc3d2b7a29c19e750e622e70cc3c73186"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/profile.d/README",
+      "SPDXID": "SPDXRef-File-etc-profile.d-README-3be87e7f154adb63",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "df9396b02cf3be70767e6171eb691baa6d40c759"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "b73284f27fe2da9ae1902b1fe9596c3ffc61a154e2805a034184f0468f8b09b0"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/profile.d/color_prompt.sh.disabled",
+      "SPDXID": "SPDXRef-File-etc-profile.d-color-prompt.sh.disabled-eeb93048af63bf64",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "d5733d99d7b5676f6d58c19a3a47a8bc3fe6e2e5"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "ba24425c6864a5d17fa0fdaf914c4d21419e47c4d62080c33830af059fe46617"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/protocols",
+      "SPDXID": "SPDXRef-File-etc-protocols-5f1d8d1482d973b6",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "d5f9654539089b96f1b1956848d783527da6fb47"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "4959498abbadaa1e50894a266f8d0d94500101cfe5b5f09dcad82e9d5bdfab46"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/securetty",
+      "SPDXID": "SPDXRef-File-etc-securetty-f5826ff16d6eaebb",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "0e29ce7fa251a4246033abcdaa339ec5dde84a75"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "713fcea5109728883b9147e822429133fcc8b5e253afd3c2a197b10cd0bc3b4d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/services",
+      "SPDXID": "SPDXRef-File-etc-services-812b3f1a2d583f29",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "a0d7a229bf049f7fe17e8445226236e4024535d0"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "f6183055fd949f9c53d49ee620f85d0150123ea691d25ed1bba0c641b4ee2f48"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/shadow",
+      "SPDXID": "SPDXRef-File-etc-shadow-a1d64c72d061cd92",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "fdcce813d9a3aa27fffcf07126d2deabf17cb057"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "d5992a27f05f380fc5faeb82a3359e2f230fd1d6ea6517b45892b771a2194ddb"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/shells",
+      "SPDXID": "SPDXRef-File-etc-shells-2dc73ba417bebb75",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "a239b661da4227a07f6a9183699fd275bdb12640"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "24be6ceb236610df45684c83b06c918ae45635be55f69975e43676b7595bbc5f"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/ssl/certs/ca-certificates.crt",
+      "SPDXID": "SPDXRef-File-etc-ssl-certs-ca-certificates.crt-c7ec96e3f9d22e5e",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "ef142b502de28cb73fab260c80032bbb9013f2bd"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "37acffef4900dc598edca36a177c60ca77f9130b5a93b1344d713ac4abcf94c1"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/ssl/ct_log_list.cnf",
+      "SPDXID": "SPDXRef-File-etc-ssl-ct-log-list.cnf-7c00b4ab1629d304",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "a2587c4e97408b64274e5e052b74e3754892c13a"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "f1c1803d13d1d0b755b13b23c28bd4e20e07baf9f2b744c9337ba5866aa0ec3b"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/ssl/ct_log_list.cnf.dist",
+      "SPDXID": "SPDXRef-File-etc-ssl-ct-log-list.cnf.dist-4706267d3fefbca6",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "a2587c4e97408b64274e5e052b74e3754892c13a"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "f1c1803d13d1d0b755b13b23c28bd4e20e07baf9f2b744c9337ba5866aa0ec3b"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/ssl/openssl.cnf",
+      "SPDXID": "SPDXRef-File-etc-ssl-openssl.cnf-e2fe362bf9fd5340",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "c6aaa437fab0d4186ff361da58952c45447f0181"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "3a0c65ff954aff207420846926d31d1b6056be525a0f3d38dff21f5b89f90688"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/ssl/openssl.cnf.dist",
+      "SPDXID": "SPDXRef-File-etc-ssl-openssl.cnf.dist-a2fcecd0c7860aea",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "c6aaa437fab0d4186ff361da58952c45447f0181"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "3a0c65ff954aff207420846926d31d1b6056be525a0f3d38dff21f5b89f90688"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/sysctl.conf",
+      "SPDXID": "SPDXRef-File-etc-sysctl.conf-2eede682f1d2d57e",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "e2ea73ded7e7371664204b148569fb5e88b0f7a8"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "8bba47da45bc8715c69ac904a60410eabffaa7bbbef640f9c1368ab9c48493d0"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/udhcpc/udhcpc.conf",
+      "SPDXID": "SPDXRef-File-etc-udhcpc-udhcpc.conf-a8f34a90829fb0c8",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "9bc069e434228e6ca441848bfb7a6bac23fa148a"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "5b372209e01cda07c87b8afa6d1ab3d7e8daf18a1f2332d744203a6dc289eb1a"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/lib/apk/db/installed",
+      "SPDXID": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "0000000000000000000000000000000000000000"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/lib/ld-musl-aarch64.so.1",
+      "SPDXID": "SPDXRef-File-lib-ld-musl-aarch64.so.1-15ac5a87021c605c",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "50859585e21254306aeb74426d5dd4537cbe3305"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "59420a762274dddac5c3d7d612564d0d6f76c54a0edf0bdf167fea661bb6d6bf"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/lib/libapk.so.2.14.0",
+      "SPDXID": "SPDXRef-File-lib-libapk.so.2.14.0-85382abc3213df0c",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "d6eed4bf4133792285922c44322d42e196405e50"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "3d9d886647cc576d1c3bab0dc1a4d4e752a2f4b7d8bd5c6abfe11acccb3e4409"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/lib/libcrypto.so.3",
+      "SPDXID": "SPDXRef-File-lib-libcrypto.so.3-d7aa31f07714a25f",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "eddc1d6d87670038a43530097662cb6eee36e624"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "0f9439f7e7f83e4ae355fa957ffe6878b03c467cb289dbc56f65ce058729de6d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/lib/libssl.so.3",
+      "SPDXID": "SPDXRef-File-lib-libssl.so.3-942e1a73404f4c12",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "3f1e772e6d4a99fecf0a608f6e42d7da2069c73c"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "5136a0a97053a7694de117eaec692c85bee2062b8e6907dc875599dc56629384"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/lib/libz.so.1.3.1",
+      "SPDXID": "SPDXRef-File-lib-libz.so.1.3.1-cfebf8b5dc1f6374",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "70949f5bdc478b4552562050c43b1e4b6bf014bb"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "540bf9ba24238ac85b21755126dfa3a9c8ca947e0d0c938b6c1fea43d6927a7e"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/lib/sysctl.d/00-alpine.conf",
+      "SPDXID": "SPDXRef-File-lib-sysctl.d-00-alpine.conf-812cee121e721231",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "1e9125cd6d7112098a7c446d4f2ee8a269a7aba7"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "ee169bea2cb6859420b55ca7a9c23fb68b50adc1d26c951f904dec9e8f767380"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/sbin/apk",
+      "SPDXID": "SPDXRef-File-sbin-apk-03a303c2f408ad75",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "191b64288f8976f9cb5875ad24481671998eceed"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "d15d690cdb7e32b735a0b47806710fbfc2f8e7faabe3b3059b2009c8fbda8cdc"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/sbin/ldconfig",
+      "SPDXID": "SPDXRef-File-sbin-ldconfig-6dd00345fd25dfbe",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "2a36b6f8f3992b112450e66ac128c2ea499a103e"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "b4a2c06db38742e8c42c3c9838b285a7d8cdac6c091ff3df5ff9a15f1e41b9c7"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/bin/getconf",
+      "SPDXID": "SPDXRef-File-usr-bin-getconf-aa569a0b492dbc3e",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "a7c92a25adeb9f46272bf52c5d33d3babedb312d"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "5238595ed22353d8c6adb8d78652b3b252f3c2ba6cffdf6eecf419eb78ff0209"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/bin/getent",
+      "SPDXID": "SPDXRef-File-usr-bin-getent-dfc1d5b68ea46609",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "db0ec5b54f31a315956027172ecfee6aa60a2581"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "ace5b03661ca07022837d3d7cd4781cb5a30ef6d3fc5d591d83b9263368ec0ac"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/bin/iconv",
+      "SPDXID": "SPDXRef-File-usr-bin-iconv-b4f317a0c3ae4126",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "913d4848ef8289b2ff1a8f6386c3771380c601bf"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "e6fcc190f17c0dc4fb691256440a6e83dc52e9fb1217e35d2a882e32296c48a6"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/bin/ldd",
+      "SPDXID": "SPDXRef-File-usr-bin-ldd-0f8acf82bbb616a2",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "afe298b72fc708b978a7876f3edf2409bd66841d"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "5f115be8562262bcc50ec469e25c0af2fda3bad72a960c6aa3488acd7a7da8cf"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/bin/scanelf",
+      "SPDXID": "SPDXRef-File-usr-bin-scanelf-42e6597f9fa4518a",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "429e07005a605dcf7afa72a2926033c6c2cfb07d"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "5ef9e7df17d4f20ad9dec44a5fdc39ea581377680cfdc1994ac48986c9254351"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/bin/ssl_client",
+      "SPDXID": "SPDXRef-File-usr-bin-ssl-client-90e1da58238b5003",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "f17cb9d9effd3a5597f5dc79f50349f7b5971d31"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "0094d52eac21454dedd2fce85262bba9e8538f45a3125a9e3a767ba6b8056f67"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/lib/engines-3/afalg.so",
+      "SPDXID": "SPDXRef-File-usr-lib-engines-3-afalg.so-2dd02daf0dc8736e",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "feb5d2147e9a48d12cc936e1ccb8aeedd3e4c330"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "24d5276e7ebb6e2c898d5329ffabb62adb0212a6bf90829b4bf88e692b669b93"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/lib/engines-3/capi.so",
+      "SPDXID": "SPDXRef-File-usr-lib-engines-3-capi.so-ec9b7c1e1d7152b6",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "ddea94ab48fc5f001be7c04733be2232650b2af1"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "936611a77d0786c572fcd931cd745a3e98570c82d1a1f119b8cd12062ff6da58"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/lib/engines-3/loader_attic.so",
+      "SPDXID": "SPDXRef-File-usr-lib-engines-3-loader-attic.so-592a2f6a8711eea8",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "b4be46c34fcb2a01faa45819b05d0904739b0c61"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "5211c7f5c60792672d4b329fc6618f4852e44ad524a480dae785b4c3fdf2e294"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/lib/engines-3/padlock.so",
+      "SPDXID": "SPDXRef-File-usr-lib-engines-3-padlock.so-cb12bf2787e0b4d0",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "867d553d0d11f999eb8b9e69f66421fa0a024eb2"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "129501fb2e14a42fcb8435235ef5811ff1ebc2bbebb6de9ad8d20142cadb7a97"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/lib/ossl-modules/legacy.so",
+      "SPDXID": "SPDXRef-File-usr-lib-ossl-modules-legacy.so-fda2c463fe1d1275",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "1d8693b5b9b8cb13bb679d5f8bdd92038fe05850"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "96e39fb0e1e386543d6d46259bc3cf77c5b5a938eda714e440ca8066b471c5d2"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-4a6a0840.rsa.pub-410a0a130a42ece8",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "3af08548ef78cfdedcf349880c2c6a1a48763a0e"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "9c102bcc376af1498d549b77bdbfa815ae86faa1d2d82f040e616b18ef2df2d4"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-5243ef4b.rsa.pub-b5b8c9e17450db1c",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "bfb616658cc05a872568b0c8e398c482e23b60dd"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "ebf31683b56410ecc4c00acd9f6e2839e237a3b62b5ae7ef686705c7ba0396a9"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-524d27bb.rsa.pub-050339be1296c5a7",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "053a92f87fd4532850bb31f0881978efe0532ae5"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "1bb2a846c0ea4ca9d0e7862f970863857fc33c32f5506098c636a62a726a847b"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-5261cecb.rsa.pub-3840c02005b419b2",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "3671ae0ec7503b1e193587c1dcdf7b78bc863e42"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "12f899e55a7691225603d6fb3324940fc51cd7f133e7ead788663c2b7eecb00c"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58199dcc.rsa.pub-df4b284ea560bc2f",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "39ac5d72c6ba018a0f74b8b453894edc9db07b5f"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "73867d92083f2f8ab899a26ccda7ef63dfaa0032a938620eda605558958a8041"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58cbb476.rsa.pub-fc38dbb1c534a98b",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "c8fabeb2eeb992c368c77b9707e0d1ecfd7cf905"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "9a4cd858d9710963848e6d5f555325dc199d1c952b01cf6e64da2c15deedbd97"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58e4f17d.rsa.pub-793318842ffeec8c",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "329643357d0b78b1ef48ec155325e25f1d7534dd"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "780b3ed41786772cbc7b68136546fa3f897f28a23b30c72dde6225319c44cfff"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-5e69ca50.rsa.pub-fb2a93a263fc77d5",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "825090fde25bbc0e71a9cb3076316b5afe459e4d"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "59c01c57b446633249f67c04b115dd6787f4378f183dff2bbf65406df93f176d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-60ac2099.rsa.pub-05c47cc8cdd4f66e",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "5d4743128353b6396fad2fa2ba793ace21602295"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "db0b49163f07ffba64a5ca198bcf1688610b0bd1f0d8d5afeaf78559d73f2278"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-6165ee59.rsa.pub-5576929bc9db6198",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "95995311236b7a55933642ffa10ce6014f1af7d0"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "207e4696d3c05f7cb05966aee557307151f1f00217af4143c1bcaf33b8df733f"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-61666e3f.rsa.pub-fdccfa670e123d3d",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "58d5ba4b2f3b1e927721d7a6432f298eedf72a6b"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "128d34d4aec39b0daedea8163cd8dc24dff36fd3d848630ab97eeb1d3084bbb3"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616a9724.rsa.pub-fe0797f3d753de34",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "23d0f2ea1af269c2f66165e0f8a944e96bf011de"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "10877cce0a935e46ad88cb79e174a2491680508eccda08e92bf04fb9bf37fbc1"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616abc23.rsa.pub-83f8824a9e8a4daf",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "3529ec82670c6d4e20ee3e4968db34b551e91d50"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "4a095a9daca86da496a3cd9adcd95ee2197fdbeb84638656d469f05a4d740751"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616ac3bc.rsa.pub-22d34d5fbfa617ab",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "55a301064e11c6fe9ba0f2ca17e234f3943ccb61"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "0caf5662fde45616d88cfd7021b7bda269a2fcaf311e51c48945a967a609ec0b"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616adfeb.rsa.pub-951eb66cb4549509",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "de1241307014aae3dba798e900f163408d98d6f4"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "ebe717d228555aa58133c202314a451f81e71f174781fd7ff8d8970d6cfa60da"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616ae350.rsa.pub-44fa2966c51f0c1f",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "57f6b93fda4a4496fab62844ddef0eeb168f80b5"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "d11f6b21c61b4274e182eb888883a8ba8acdbf820dcc7a6d82a7d9fc2fd2836d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616db30d.rsa.pub-b14251d1f8bcfe18",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "df02c9adc2906a3aa5e5ad69f50e3953e65710d0"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "40a216cbd163f22e5f16a9e0929de7cde221b9cbae8e36aa368b1e128afe0a31"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/udhcpc/default.script",
+      "SPDXID": "SPDXRef-File-usr-share-udhcpc-default.script-4fc79137008d263f",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "1d6a46dde403f14a22e2692cd84dd24af3805216"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "c4e5a7c4783a7a73dec48dee009ee687015d2de7ff86b269679b95bef2c60e13"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    }
+  ],
+  "relationships": [
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-File-lib-ld-musl-aarch64.so.1-15ac5a87021c605c",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-scanelf-54f3623fdd8fb8d4",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-ssl-client-6bbb10e52b8e7eb4",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-zlib-d8258d3d7c48cfbf",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-usr-lib-engines-3-afalg.so-2dd02daf0dc8736e",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-etc-ssl-ct-log-list.cnf.dist-4706267d3fefbca6",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-usr-lib-engines-3-loader-attic.so-592a2f6a8711eea8",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-Package-apk-ssl-client-6bbb10e52b8e7eb4",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-etc-ssl-ct-log-list.cnf-7c00b4ab1629d304",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-etc-ssl-openssl.cnf.dist-a2fcecd0c7860aea",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-usr-lib-engines-3-padlock.so-cb12bf2787e0b4d0",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-lib-libcrypto.so.3-d7aa31f07714a25f",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-etc-ssl-openssl.cnf-e2fe362bf9fd5340",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-usr-lib-engines-3-capi.so-ec9b7c1e1d7152b6",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-usr-lib-ossl-modules-legacy.so-fda2c463fe1d1275",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-524d27bb.rsa.pub-050339be1296c5a7",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-60ac2099.rsa.pub-05c47cc8cdd4f66e",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616ac3bc.rsa.pub-22d34d5fbfa617ab",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-5261cecb.rsa.pub-3840c02005b419b2",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-4a6a0840.rsa.pub-410a0a130a42ece8",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58199dcc.rsa.pub-444fb4815b9c5fa7",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616ae350.rsa.pub-44fa2966c51f0c1f",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-6165ee59.rsa.pub-5576929bc9db6198",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-524d27bb.rsa.pub-6742b949ff851b46",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616ae350.rsa.pub-76207aeaad529724",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58e4f17d.rsa.pub-793318842ffeec8c",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616abc23.rsa.pub-83f8824a9e8a4daf",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616adfeb.rsa.pub-951eb66cb4549509",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616db30d.rsa.pub-b14251d1f8bcfe18",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-5243ef4b.rsa.pub-b5b8c9e17450db1c",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616a9724.rsa.pub-cfc1d017a48ee9e7",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58199dcc.rsa.pub-df4b284ea560bc2f",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616adfeb.rsa.pub-ed83cb346d241bdf",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-5e69ca50.rsa.pub-fb2a93a263fc77d5",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58cbb476.rsa.pub-fc38dbb1c534a98b",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-61666e3f.rsa.pub-fdccfa670e123d3d",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616a9724.rsa.pub-fe0797f3d753de34",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "relatedSpdxElement": "SPDXRef-Package-apk-ssl-client-6bbb10e52b8e7eb4",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "relatedSpdxElement": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "relatedSpdxElement": "SPDXRef-File-lib-libssl.so.3-942e1a73404f4c12",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-binsh-1fd95b4d43a9f438",
+      "relatedSpdxElement": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-binsh-1fd95b4d43a9f438",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-binsh-1fd95b4d43a9f438",
+      "relatedSpdxElement": "SPDXRef-File-bin-busybox-909c5f40cb01cb38",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-crontabs-root-351da988aba8a527",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-profile.d-README-3be87e7f154adb63",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-profile.d-20locale.sh-4738cb952eababba",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-modprobe.d-kms.conf-77f620d7a99cffa8",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-lib-sysctl.d-00-alpine.conf-812cee121e721231",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-modprobe.d-aliases.conf-8ac9ab5944e0b537",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-motd-9a55980593b74a03",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-modprobe.d-blacklist.conf-abf9fc46510ff77c",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-modprobe.d-i386.conf-e9054a53c22e88cf",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-profile.d-color-prompt.sh.disabled-eeb93048af63bf64",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-Package-apk-busybox-binsh-1fd95b4d43a9f438",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-usr-share-udhcpc-default.script-4fc79137008d263f",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-etc-busybox-paths.d-busybox-6a326fdbd2e5a86c",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-bin-busybox-909c5f40cb01cb38",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-etc-udhcpc-udhcpc.conf-a8f34a90829fb0c8",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-etc-network-if-up.d-dad-e17f6cd71c480b11",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-etc-logrotate.d-acpid-e47331443c3f2fdc",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-etc-securetty-f5826ff16d6eaebb",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-scanelf-54f3623fdd8fb8d4",
+      "relatedSpdxElement": "SPDXRef-File-usr-bin-scanelf-42e6597f9fa4518a",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-scanelf-54f3623fdd8fb8d4",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-scanelf-54f3623fdd8fb8d4",
+      "relatedSpdxElement": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-ssl-client-6bbb10e52b8e7eb4",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-ssl-client-6bbb10e52b8e7eb4",
+      "relatedSpdxElement": "SPDXRef-File-usr-bin-ssl-client-90e1da58238b5003",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relatedSpdxElement": "SPDXRef-File-sbin-apk-03a303c2f408ad75",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relatedSpdxElement": "SPDXRef-File-lib-libapk.so.2.14.0-85382abc3213df0c",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-hosts-097d60485ef1a565",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-fstab-0c5c3473875a5b85",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-hostname-18f4143fa24a5309",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-nsswitch.conf-26adb8feffe4129b",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-inittab-273285a459443001",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-shells-2dc73ba417bebb75",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-sysctl.conf-2eede682f1d2d57e",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-protocols-5f1d8d1482d973b6",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-profile-6dfdb9518e6b63ef",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-passwd-7accffa8923d35e9",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-services-812b3f1a2d583f29",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-shadow-a1d64c72d061cd92",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-group-cc490babc7ba6984",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-modules-f9e050b82be1ad75",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-ca-certificates-bundle-bf42440dd0b61727",
+      "relatedSpdxElement": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-ca-certificates-bundle-bf42440dd0b61727",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-ca-certificates-bundle-bf42440dd0b61727",
+      "relatedSpdxElement": "SPDXRef-File-etc-ssl-certs-ca-certificates.crt-c7ec96e3f9d22e5e",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relatedSpdxElement": "SPDXRef-File-usr-bin-ldd-0f8acf82bbb616a2",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relatedSpdxElement": "SPDXRef-File-sbin-ldconfig-6dd00345fd25dfbe",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relatedSpdxElement": "SPDXRef-File-usr-bin-getconf-aa569a0b492dbc3e",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relatedSpdxElement": "SPDXRef-File-usr-bin-iconv-b4f317a0c3ae4126",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relatedSpdxElement": "SPDXRef-File-usr-bin-getent-dfc1d5b68ea46609",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-zlib-d8258d3d7c48cfbf",
+      "relatedSpdxElement": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-zlib-d8258d3d7c48cfbf",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-zlib-d8258d3d7c48cfbf",
+      "relatedSpdxElement": "SPDXRef-File-lib-libz.so.1.3.1-cfebf8b5dc1f6374",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-busybox-binsh-1fd95b4d43a9f438",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-ca-certificates-bundle-bf42440dd0b61727",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-scanelf-54f3623fdd8fb8d4",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-ssl-client-6bbb10e52b8e7eb4",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-zlib-d8258d3d7c48cfbf",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DOCUMENT",
+      "relatedSpdxElement": "SPDXRef-DocumentRoot-Image-alpine",
+      "relationshipType": "DESCRIBES"
+    }
+  ]
+}
diff --git a/attestation/sbom/boms/spdx-2.3/alpine.spdx-2-3.json b/attestation/sbom/boms/spdx-2.3/alpine.spdx-2-3.json
new file mode 100644
index 00000000..4fe7073d
--- /dev/null
+++ b/attestation/sbom/boms/spdx-2.3/alpine.spdx-2-3.json
@@ -0,0 +1,3167 @@
+{"spdxVersion": "SPDX-2.3",
+  "dataLicense": "CC0-1.0",
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "name": "alpine",
+  "documentNamespace": "https://anchore.com/syft/image/alpine-f47d85d3-941f-4842-ab31-da90d949d6d8",
+  "creationInfo": {
+    "licenseListVersion": "3.24",
+    "creators": [
+      "Organization: Anchore, Inc",
+      "Tool: syft-1.5.0"
+    ],
+    "created": "2024-06-08T05:25:11Z"
+  },
+  "packages": [
+    {
+      "name": "alpine-baselayout",
+      "SPDXID": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "versionInfo": "3.6.5-r0",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://git.alpinelinux.org/cgit/aports/tree/main/alpine-baselayout",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "6a22bff30e2aed347029eeb9d51c810613705455"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "description": "Alpine base dir structure and init scripts",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-baselayout:alpine-baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-baselayout:alpine_baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_baselayout:alpine-baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_baselayout:alpine_baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine:alpine-baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine:alpine_baselayout:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/alpine-baselayout@3.6.5-r0?arch=aarch64&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "alpine-baselayout-data",
+      "SPDXID": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "versionInfo": "3.6.5-r0",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://git.alpinelinux.org/cgit/aports/tree/main/alpine-baselayout",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "6a7d69893b8bca00a39ad9a06c6a7e2833593ad0"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "description": "Alpine base dir structure and init scripts",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-baselayout-data:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-baselayout-data:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_baselayout_data:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_baselayout_data:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-baselayout:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-baselayout:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_baselayout:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_baselayout:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine:alpine-baselayout-data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine:alpine_baselayout_data:3.6.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/alpine-baselayout-data@3.6.5-r0?arch=aarch64&upstream=alpine-baselayout&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "alpine-keys",
+      "SPDXID": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "versionInfo": "2.4-r1",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://alpinelinux.org",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "555910826b4a68482679b6d4809b1502dd6d46ab"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "description": "Public keys for Alpine Linux packages",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-keys:alpine-keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine-keys:alpine_keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_keys:alpine-keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine_keys:alpine_keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine:alpine-keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:alpine:alpine_keys:2.4-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/alpine-keys@2.4-r1?arch=aarch64&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "apk-tools",
+      "SPDXID": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "versionInfo": "2.14.4-r0",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://gitlab.alpinelinux.org/alpine/apk-tools",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "e09707a797756cf9daf1c3f5832e7c4499a04266"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "description": "Alpine Package Keeper - package manager for alpine",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:apk-tools:apk-tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:apk-tools:apk_tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:apk_tools:apk-tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:apk_tools:apk_tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:apk:apk-tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:apk:apk_tools:2.14.4-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/apk-tools@2.14.4-r0?arch=aarch64&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "busybox",
+      "SPDXID": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "versionInfo": "1.36.1-r28",
+      "supplier": "NOASSERTION",
+      "downloadLocation": "https://busybox.net/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "c873508e0b37506b4b2d3006b4ce096069b6ab9a"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "description": "Size optimized toolbox of many common UNIX utilities",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:busybox:busybox:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/busybox@1.36.1-r28?arch=aarch64&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "busybox-binsh",
+      "SPDXID": "SPDXRef-Package-apk-busybox-binsh-1fd95b4d43a9f438",
+      "versionInfo": "1.36.1-r28",
+      "supplier": "NOASSERTION",
+      "downloadLocation": "https://busybox.net/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "71bd3a1b510b531ba920457cfaa87f907c6cd091"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "description": "busybox ash /bin/sh",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:busybox-binsh:busybox-binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:busybox-binsh:busybox_binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:busybox_binsh:busybox-binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:busybox_binsh:busybox_binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:busybox:busybox-binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:busybox:busybox_binsh:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/busybox-binsh@1.36.1-r28?arch=aarch64&upstream=busybox&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "ca-certificates-bundle",
+      "SPDXID": "SPDXRef-Package-apk-ca-certificates-bundle-bf42440dd0b61727",
+      "versionInfo": "20240226-r0",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "ed7a773d52aea0765c0db03bb25b01b5f0f50f3c"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "(MPL-2.0 AND MIT)",
+      "copyrightText": "NOASSERTION",
+      "description": "Pre generated bundle of Mozilla certificates",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca-certificates-bundle:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca-certificates-bundle:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca_certificates_bundle:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca_certificates_bundle:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca-certificates:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca-certificates:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca_certificates:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca_certificates:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:mozilla:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:mozilla:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca:ca-certificates-bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ca:ca_certificates_bundle:20240226-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/ca-certificates-bundle@20240226-r0?arch=aarch64&upstream=ca-certificates&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "libcrypto3",
+      "SPDXID": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "versionInfo": "3.3.0-r2",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://www.openssl.org/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "ae6bdffda4acbdf371b8ccc19dba2e7a525d08e1"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "Apache-2.0",
+      "copyrightText": "NOASSERTION",
+      "description": "Crypto library from openssl",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libcrypto3:libcrypto3:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libcrypto3:libcrypto:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libcrypto:libcrypto3:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libcrypto:libcrypto:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/libcrypto3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "libssl3",
+      "SPDXID": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "versionInfo": "3.3.0-r2",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://www.openssl.org/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "bdcc4aef521963183255243c4256cc3348a6796b"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "Apache-2.0",
+      "copyrightText": "NOASSERTION",
+      "description": "SSL shared libraries",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libssl3:libssl3:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libssl3:libssl:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libssl:libssl3:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:libssl:libssl:3.3.0-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/libssl3@3.3.0-r2?arch=aarch64&upstream=openssl&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "musl",
+      "SPDXID": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "versionInfo": "1.2.5-r0",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://musl.libc.org/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "498ba4340e8deb05fbea7e1053b734717307dd81"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "description": "the musl c library (libc) implementation",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl-libc:musl:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl_libc:musl:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl:musl:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "musl-utils",
+      "SPDXID": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "versionInfo": "1.2.5-r0",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://musl.libc.org/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "c05211eeb2d680bcd129b57790feea2157222f93"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "(MIT AND BSD-2-Clause AND GPL-2.0-or-later)",
+      "copyrightText": "NOASSERTION",
+      "description": "the musl c library (libc) implementation",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl-utils:musl-utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl-utils:musl_utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl_utils:musl-utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl_utils:musl_utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl-libc:musl-utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl-libc:musl_utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl:musl-utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:musl:musl_utils:1.2.5-r0:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/musl-utils@1.2.5-r0?arch=aarch64&upstream=musl&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "scanelf",
+      "SPDXID": "SPDXRef-Package-apk-scanelf-54f3623fdd8fb8d4",
+      "versionInfo": "1.3.7-r2",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "98c686afd83394fddb10bd9239ec6b5a474397f1"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "description": "Scan ELF binaries for stuff",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:scanelf:scanelf:1.3.7-r2:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/scanelf@1.3.7-r2?arch=aarch64&upstream=pax-utils&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "ssl_client",
+      "SPDXID": "SPDXRef-Package-apk-ssl-client-6bbb10e52b8e7eb4",
+      "versionInfo": "1.36.1-r28",
+      "supplier": "NOASSERTION",
+      "downloadLocation": "https://busybox.net/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "7d5a1591577ff883690877e5b50998b7950f9ac7"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "description": "EXternal ssl_client for busybox wget",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ssl-client:ssl-client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ssl-client:ssl_client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ssl_client:ssl-client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ssl_client:ssl_client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ssl:ssl-client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:ssl:ssl_client:1.36.1-r28:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/ssl_client@1.36.1-r28?arch=aarch64&upstream=busybox&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "zlib",
+      "SPDXID": "SPDXRef-Package-apk-zlib-d8258d3d7c48cfbf",
+      "versionInfo": "1.3.1-r1",
+      "supplier": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "originator": "Person: Natanael Copa (ncopa@alpinelinux.org)",
+      "downloadLocation": "https://zlib.net/",
+      "filesAnalyzed": true,
+      "packageVerificationCode": {
+        "packageVerificationCodeValue": "144c1bbadb241708c66589af3af429734cb73bb0"
+      },
+      "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "Zlib",
+      "copyrightText": "NOASSERTION",
+      "description": "A compression/decompression Library",
+      "externalRefs": [
+        {
+          "referenceCategory": "SECURITY",
+          "referenceType": "cpe23Type",
+          "referenceLocator": "cpe:2.3:a:zlib:zlib:1.3.1-r1:*:*:*:*:*:*:*"
+        },
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:apk/alpine/zlib@1.3.1-r1?arch=aarch64&distro=alpine-3.20.0"
+        }
+      ]
+    },
+    {
+      "name": "alpine",
+      "SPDXID": "SPDXRef-DocumentRoot-Image-alpine",
+      "versionInfo": "sha256:1c3b93ed450e26eac89b471d6d140e2f99488f489739b8b8ea5e8202dd086f82",
+      "supplier": "NOASSERTION",
+      "downloadLocation": "NOASSERTION",
+      "filesAnalyzed": false,
+      "checksums": [
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "1c3b93ed450e26eac89b471d6d140e2f99488f489739b8b8ea5e8202dd086f82"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:oci/alpine@sha256:1c3b93ed450e26eac89b471d6d140e2f99488f489739b8b8ea5e8202dd086f82?arch=arm64&tag=latest"
+        }
+      ],
+      "primaryPackagePurpose": "CONTAINER"
+    }
+  ],
+  "files": [
+    {
+      "fileName": "/bin/busybox",
+      "SPDXID": "SPDXRef-File-bin-busybox-909c5f40cb01cb38",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "db850d50e6edff81a9f1af582aaf9b843b0981e3"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "19f15cbea8d91421f7f8d5086a494048d305a922a8cad88f0a4836299411ac12"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-524d27bb.rsa.pub-6742b949ff851b46",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "053a92f87fd4532850bb31f0881978efe0532ae5"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "1bb2a846c0ea4ca9d0e7862f970863857fc33c32f5506098c636a62a726a847b"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58199dcc.rsa.pub-444fb4815b9c5fa7",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "39ac5d72c6ba018a0f74b8b453894edc9db07b5f"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "73867d92083f2f8ab899a26ccda7ef63dfaa0032a938620eda605558958a8041"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616a9724.rsa.pub-cfc1d017a48ee9e7",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "23d0f2ea1af269c2f66165e0f8a944e96bf011de"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "10877cce0a935e46ad88cb79e174a2491680508eccda08e92bf04fb9bf37fbc1"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616adfeb.rsa.pub-ed83cb346d241bdf",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "de1241307014aae3dba798e900f163408d98d6f4"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "ebe717d228555aa58133c202314a451f81e71f174781fd7ff8d8970d6cfa60da"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616ae350.rsa.pub-76207aeaad529724",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "57f6b93fda4a4496fab62844ddef0eeb168f80b5"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "d11f6b21c61b4274e182eb888883a8ba8acdbf820dcc7a6d82a7d9fc2fd2836d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/busybox-paths.d/busybox",
+      "SPDXID": "SPDXRef-File-etc-busybox-paths.d-busybox-6a326fdbd2e5a86c",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "af9972dab927fb4bfcbf574de8cf870492a66657"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "e12e0822f5c6426b62f07799a0fc20394241535c5bc2cc8f10c8a25088b8defa"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/crontabs/root",
+      "SPDXID": "SPDXRef-File-etc-crontabs-root-351da988aba8a527",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "bdf9356a9516238c8b2468613517749098b17ef6"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "575d810a9fae5f2f0671c9b2c0ce973e46c7207fbe5cb8d1b0d1836a6a0470e3"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/fstab",
+      "SPDXID": "SPDXRef-File-etc-fstab-0c5c3473875a5b85",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "d50ee135ef10a434b9df582ea8276b5c1ce803fa"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "a3efca2e8d62785c87517283092b4c800d88612b6f3f06b80a4c2f39d8e68841"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/group",
+      "SPDXID": "SPDXRef-File-etc-group-cc490babc7ba6984",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "d8eb64e0cdfd7cfd998e4a1bbb49c2f45be5448d"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "6fb6ab5a5526e6f4896b70c7e3c350fd475158a1f0d7b5fc0f3f9bd57f1c3be8"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/hostname",
+      "SPDXID": "SPDXRef-File-etc-hostname-18f4143fa24a5309",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "ea75706155cffed0a1bd43ddba4543da27d73a67"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "d906aecb61d076a967d9ffe8821c7b04b063f72df9d9e35b33ef36b1c0d98f16"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/hosts",
+      "SPDXID": "SPDXRef-File-etc-hosts-097d60485ef1a565",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "043eb324a653456caa1a73e2e2d49f77792bb0c5"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "e3998dbe02b51dada33de87ae43d18a93ab6915b9e34f5a751bf2b9b25a55492"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/inittab",
+      "SPDXID": "SPDXRef-File-etc-inittab-273285a459443001",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "ce9586d2acf1d9462765259a21ccc4f96a402151"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "7326d8ad56bf5fea63b1ca516a747ff6e6723e25ae84a93c31620b03de6c001d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/logrotate.d/acpid",
+      "SPDXID": "SPDXRef-File-etc-logrotate.d-acpid-e47331443c3f2fdc",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "4f29720883559a74be03f4de69de2f66113b064b"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "d608a3b7715886b5735def0cc50a6359fd364fac2e0e0a459c588c04be471031"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/modprobe.d/aliases.conf",
+      "SPDXID": "SPDXRef-File-etc-modprobe.d-aliases.conf-8ac9ab5944e0b537",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "5946e1e930583552bb7b863eb94bcbb3feef8aa9"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "3ebaba946f213670170c7d69949f690a3854553bd0b1560f1d980cba4c83a942"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/modprobe.d/blacklist.conf",
+      "SPDXID": "SPDXRef-File-etc-modprobe.d-blacklist.conf-abf9fc46510ff77c",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "e1376014791376ddee402f8d06dae7b4e9e6f67e"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "5cd46031fc7dc7186e67c97fd34780597de4ebff51dbe41eba27220fe5e0d866"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/modprobe.d/i386.conf",
+      "SPDXID": "SPDXRef-File-etc-modprobe.d-i386.conf-e9054a53c22e88cf",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "a676b2fe78e7ea897d702b2c2fb2a2659f1eb657"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "6c46c4cbfb8b7594f19eb94801a350fa2221ae9ac5239a8819d15555caa76ae8"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/modprobe.d/kms.conf",
+      "SPDXID": "SPDXRef-File-etc-modprobe.d-kms.conf-77f620d7a99cffa8",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "ca76cb9f71980e9bda8db6bf95da759e26b27a88"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "50467fa732f809f3a2bb5738628765c5f895c3a237e1c1ad09f85d41fd9ca7c5"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/modules",
+      "SPDXID": "SPDXRef-File-etc-modules-f9e050b82be1ad75",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "b68a208d48a91c670c8040a03c95fae12c144f53"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "2c881de75a5409c35d2433a24f180b8b02ba478ef2c1c60ea3434a35bcbc335d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/motd",
+      "SPDXID": "SPDXRef-File-etc-motd-9a55980593b74a03",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "48b912f610627546cfc30af0f974745a1bf7c30f"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "ff044e9be5daa2eee2d3d10a4da72e5477e4c24c16f1792de2c91dae844c0e30"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/network/if-up.d/dad",
+      "SPDXID": "SPDXRef-File-etc-network-if-up.d-dad-e17f6cd71c480b11",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "ddd99bc197c36e8a9aab9463aaeebda44a7a8029"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "2fd20d1bc67d9ee711990002b24f156635a73f56b8935b2f76592938817fa4e7"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/nsswitch.conf",
+      "SPDXID": "SPDXRef-File-etc-nsswitch.conf-26adb8feffe4129b",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "f4306c327bf44767da8da4e3a13bf40bdd4d3aaa"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "0afd94c183d30a348b45057f6bf468e121aa448a7641109addb5bb8e282f514d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/passwd",
+      "SPDXID": "SPDXRef-File-etc-passwd-7accffa8923d35e9",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "afe6cba27664032062c7f1cb812783b1ecf6d99b"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "31a94f06f17bc3b9085fccab1d0fa6ee9e79c4a1e4d91f617fa5de95863be015"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/profile",
+      "SPDXID": "SPDXRef-File-etc-profile-6dfdb9518e6b63ef",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "54dd1d99ac0383798113f96307ee9b52b0bb0f37"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "87e8643d3ce156de0c09370d4d39446f30bd00d264bea248abc191c4d7b9df3e"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/profile.d/20locale.sh",
+      "SPDXID": "SPDXRef-File-etc-profile.d-20locale.sh-4738cb952eababba",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "96adbd950ccf992085295990f9bbe667f0cf4c4e"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "284a6ef56ab97a13a777c6b01ae14f2cc3d2b7a29c19e750e622e70cc3c73186"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/profile.d/README",
+      "SPDXID": "SPDXRef-File-etc-profile.d-README-3be87e7f154adb63",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "df9396b02cf3be70767e6171eb691baa6d40c759"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "b73284f27fe2da9ae1902b1fe9596c3ffc61a154e2805a034184f0468f8b09b0"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/profile.d/color_prompt.sh.disabled",
+      "SPDXID": "SPDXRef-File-etc-profile.d-color-prompt.sh.disabled-eeb93048af63bf64",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "d5733d99d7b5676f6d58c19a3a47a8bc3fe6e2e5"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "ba24425c6864a5d17fa0fdaf914c4d21419e47c4d62080c33830af059fe46617"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/protocols",
+      "SPDXID": "SPDXRef-File-etc-protocols-5f1d8d1482d973b6",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "d5f9654539089b96f1b1956848d783527da6fb47"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "4959498abbadaa1e50894a266f8d0d94500101cfe5b5f09dcad82e9d5bdfab46"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/securetty",
+      "SPDXID": "SPDXRef-File-etc-securetty-f5826ff16d6eaebb",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "0e29ce7fa251a4246033abcdaa339ec5dde84a75"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "713fcea5109728883b9147e822429133fcc8b5e253afd3c2a197b10cd0bc3b4d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/services",
+      "SPDXID": "SPDXRef-File-etc-services-812b3f1a2d583f29",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "a0d7a229bf049f7fe17e8445226236e4024535d0"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "f6183055fd949f9c53d49ee620f85d0150123ea691d25ed1bba0c641b4ee2f48"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/shadow",
+      "SPDXID": "SPDXRef-File-etc-shadow-a1d64c72d061cd92",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "fdcce813d9a3aa27fffcf07126d2deabf17cb057"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "d5992a27f05f380fc5faeb82a3359e2f230fd1d6ea6517b45892b771a2194ddb"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/shells",
+      "SPDXID": "SPDXRef-File-etc-shells-2dc73ba417bebb75",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "a239b661da4227a07f6a9183699fd275bdb12640"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "24be6ceb236610df45684c83b06c918ae45635be55f69975e43676b7595bbc5f"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/ssl/certs/ca-certificates.crt",
+      "SPDXID": "SPDXRef-File-etc-ssl-certs-ca-certificates.crt-c7ec96e3f9d22e5e",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "ef142b502de28cb73fab260c80032bbb9013f2bd"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "37acffef4900dc598edca36a177c60ca77f9130b5a93b1344d713ac4abcf94c1"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/ssl/ct_log_list.cnf",
+      "SPDXID": "SPDXRef-File-etc-ssl-ct-log-list.cnf-7c00b4ab1629d304",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "a2587c4e97408b64274e5e052b74e3754892c13a"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "f1c1803d13d1d0b755b13b23c28bd4e20e07baf9f2b744c9337ba5866aa0ec3b"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/ssl/ct_log_list.cnf.dist",
+      "SPDXID": "SPDXRef-File-etc-ssl-ct-log-list.cnf.dist-4706267d3fefbca6",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "a2587c4e97408b64274e5e052b74e3754892c13a"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "f1c1803d13d1d0b755b13b23c28bd4e20e07baf9f2b744c9337ba5866aa0ec3b"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/ssl/openssl.cnf",
+      "SPDXID": "SPDXRef-File-etc-ssl-openssl.cnf-e2fe362bf9fd5340",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "c6aaa437fab0d4186ff361da58952c45447f0181"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "3a0c65ff954aff207420846926d31d1b6056be525a0f3d38dff21f5b89f90688"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/ssl/openssl.cnf.dist",
+      "SPDXID": "SPDXRef-File-etc-ssl-openssl.cnf.dist-a2fcecd0c7860aea",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "c6aaa437fab0d4186ff361da58952c45447f0181"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "3a0c65ff954aff207420846926d31d1b6056be525a0f3d38dff21f5b89f90688"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/sysctl.conf",
+      "SPDXID": "SPDXRef-File-etc-sysctl.conf-2eede682f1d2d57e",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "e2ea73ded7e7371664204b148569fb5e88b0f7a8"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "8bba47da45bc8715c69ac904a60410eabffaa7bbbef640f9c1368ab9c48493d0"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/etc/udhcpc/udhcpc.conf",
+      "SPDXID": "SPDXRef-File-etc-udhcpc-udhcpc.conf-a8f34a90829fb0c8",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "9bc069e434228e6ca441848bfb7a6bac23fa148a"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "5b372209e01cda07c87b8afa6d1ab3d7e8daf18a1f2332d744203a6dc289eb1a"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/lib/apk/db/installed",
+      "SPDXID": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "0000000000000000000000000000000000000000"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/lib/ld-musl-aarch64.so.1",
+      "SPDXID": "SPDXRef-File-lib-ld-musl-aarch64.so.1-15ac5a87021c605c",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "50859585e21254306aeb74426d5dd4537cbe3305"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "59420a762274dddac5c3d7d612564d0d6f76c54a0edf0bdf167fea661bb6d6bf"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/lib/libapk.so.2.14.0",
+      "SPDXID": "SPDXRef-File-lib-libapk.so.2.14.0-85382abc3213df0c",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "d6eed4bf4133792285922c44322d42e196405e50"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "3d9d886647cc576d1c3bab0dc1a4d4e752a2f4b7d8bd5c6abfe11acccb3e4409"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/lib/libcrypto.so.3",
+      "SPDXID": "SPDXRef-File-lib-libcrypto.so.3-d7aa31f07714a25f",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "eddc1d6d87670038a43530097662cb6eee36e624"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "0f9439f7e7f83e4ae355fa957ffe6878b03c467cb289dbc56f65ce058729de6d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/lib/libssl.so.3",
+      "SPDXID": "SPDXRef-File-lib-libssl.so.3-942e1a73404f4c12",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "3f1e772e6d4a99fecf0a608f6e42d7da2069c73c"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "5136a0a97053a7694de117eaec692c85bee2062b8e6907dc875599dc56629384"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/lib/libz.so.1.3.1",
+      "SPDXID": "SPDXRef-File-lib-libz.so.1.3.1-cfebf8b5dc1f6374",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "70949f5bdc478b4552562050c43b1e4b6bf014bb"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "540bf9ba24238ac85b21755126dfa3a9c8ca947e0d0c938b6c1fea43d6927a7e"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/lib/sysctl.d/00-alpine.conf",
+      "SPDXID": "SPDXRef-File-lib-sysctl.d-00-alpine.conf-812cee121e721231",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "1e9125cd6d7112098a7c446d4f2ee8a269a7aba7"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "ee169bea2cb6859420b55ca7a9c23fb68b50adc1d26c951f904dec9e8f767380"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/sbin/apk",
+      "SPDXID": "SPDXRef-File-sbin-apk-03a303c2f408ad75",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "191b64288f8976f9cb5875ad24481671998eceed"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "d15d690cdb7e32b735a0b47806710fbfc2f8e7faabe3b3059b2009c8fbda8cdc"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/sbin/ldconfig",
+      "SPDXID": "SPDXRef-File-sbin-ldconfig-6dd00345fd25dfbe",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "2a36b6f8f3992b112450e66ac128c2ea499a103e"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "b4a2c06db38742e8c42c3c9838b285a7d8cdac6c091ff3df5ff9a15f1e41b9c7"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/bin/getconf",
+      "SPDXID": "SPDXRef-File-usr-bin-getconf-aa569a0b492dbc3e",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "a7c92a25adeb9f46272bf52c5d33d3babedb312d"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "5238595ed22353d8c6adb8d78652b3b252f3c2ba6cffdf6eecf419eb78ff0209"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/bin/getent",
+      "SPDXID": "SPDXRef-File-usr-bin-getent-dfc1d5b68ea46609",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "db0ec5b54f31a315956027172ecfee6aa60a2581"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "ace5b03661ca07022837d3d7cd4781cb5a30ef6d3fc5d591d83b9263368ec0ac"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/bin/iconv",
+      "SPDXID": "SPDXRef-File-usr-bin-iconv-b4f317a0c3ae4126",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "913d4848ef8289b2ff1a8f6386c3771380c601bf"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "e6fcc190f17c0dc4fb691256440a6e83dc52e9fb1217e35d2a882e32296c48a6"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/bin/ldd",
+      "SPDXID": "SPDXRef-File-usr-bin-ldd-0f8acf82bbb616a2",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "afe298b72fc708b978a7876f3edf2409bd66841d"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "5f115be8562262bcc50ec469e25c0af2fda3bad72a960c6aa3488acd7a7da8cf"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/bin/scanelf",
+      "SPDXID": "SPDXRef-File-usr-bin-scanelf-42e6597f9fa4518a",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "429e07005a605dcf7afa72a2926033c6c2cfb07d"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "5ef9e7df17d4f20ad9dec44a5fdc39ea581377680cfdc1994ac48986c9254351"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/bin/ssl_client",
+      "SPDXID": "SPDXRef-File-usr-bin-ssl-client-90e1da58238b5003",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "f17cb9d9effd3a5597f5dc79f50349f7b5971d31"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "0094d52eac21454dedd2fce85262bba9e8538f45a3125a9e3a767ba6b8056f67"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/lib/engines-3/afalg.so",
+      "SPDXID": "SPDXRef-File-usr-lib-engines-3-afalg.so-2dd02daf0dc8736e",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "feb5d2147e9a48d12cc936e1ccb8aeedd3e4c330"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "24d5276e7ebb6e2c898d5329ffabb62adb0212a6bf90829b4bf88e692b669b93"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/lib/engines-3/capi.so",
+      "SPDXID": "SPDXRef-File-usr-lib-engines-3-capi.so-ec9b7c1e1d7152b6",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "ddea94ab48fc5f001be7c04733be2232650b2af1"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "936611a77d0786c572fcd931cd745a3e98570c82d1a1f119b8cd12062ff6da58"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/lib/engines-3/loader_attic.so",
+      "SPDXID": "SPDXRef-File-usr-lib-engines-3-loader-attic.so-592a2f6a8711eea8",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "b4be46c34fcb2a01faa45819b05d0904739b0c61"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "5211c7f5c60792672d4b329fc6618f4852e44ad524a480dae785b4c3fdf2e294"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/lib/engines-3/padlock.so",
+      "SPDXID": "SPDXRef-File-usr-lib-engines-3-padlock.so-cb12bf2787e0b4d0",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "867d553d0d11f999eb8b9e69f66421fa0a024eb2"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "129501fb2e14a42fcb8435235ef5811ff1ebc2bbebb6de9ad8d20142cadb7a97"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/lib/ossl-modules/legacy.so",
+      "SPDXID": "SPDXRef-File-usr-lib-ossl-modules-legacy.so-fda2c463fe1d1275",
+      "fileTypes": [
+        "APPLICATION",
+        "BINARY"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "1d8693b5b9b8cb13bb679d5f8bdd92038fe05850"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "96e39fb0e1e386543d6d46259bc3cf77c5b5a938eda714e440ca8066b471c5d2"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-4a6a0840.rsa.pub-410a0a130a42ece8",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "3af08548ef78cfdedcf349880c2c6a1a48763a0e"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "9c102bcc376af1498d549b77bdbfa815ae86faa1d2d82f040e616b18ef2df2d4"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-5243ef4b.rsa.pub-b5b8c9e17450db1c",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "bfb616658cc05a872568b0c8e398c482e23b60dd"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "ebf31683b56410ecc4c00acd9f6e2839e237a3b62b5ae7ef686705c7ba0396a9"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-524d27bb.rsa.pub-050339be1296c5a7",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "053a92f87fd4532850bb31f0881978efe0532ae5"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "1bb2a846c0ea4ca9d0e7862f970863857fc33c32f5506098c636a62a726a847b"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-5261cecb.rsa.pub-3840c02005b419b2",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "3671ae0ec7503b1e193587c1dcdf7b78bc863e42"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "12f899e55a7691225603d6fb3324940fc51cd7f133e7ead788663c2b7eecb00c"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58199dcc.rsa.pub-df4b284ea560bc2f",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "39ac5d72c6ba018a0f74b8b453894edc9db07b5f"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "73867d92083f2f8ab899a26ccda7ef63dfaa0032a938620eda605558958a8041"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58cbb476.rsa.pub-fc38dbb1c534a98b",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "c8fabeb2eeb992c368c77b9707e0d1ecfd7cf905"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "9a4cd858d9710963848e6d5f555325dc199d1c952b01cf6e64da2c15deedbd97"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58e4f17d.rsa.pub-793318842ffeec8c",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "329643357d0b78b1ef48ec155325e25f1d7534dd"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "780b3ed41786772cbc7b68136546fa3f897f28a23b30c72dde6225319c44cfff"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-5e69ca50.rsa.pub-fb2a93a263fc77d5",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "825090fde25bbc0e71a9cb3076316b5afe459e4d"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "59c01c57b446633249f67c04b115dd6787f4378f183dff2bbf65406df93f176d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-60ac2099.rsa.pub-05c47cc8cdd4f66e",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "5d4743128353b6396fad2fa2ba793ace21602295"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "db0b49163f07ffba64a5ca198bcf1688610b0bd1f0d8d5afeaf78559d73f2278"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-6165ee59.rsa.pub-5576929bc9db6198",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "95995311236b7a55933642ffa10ce6014f1af7d0"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "207e4696d3c05f7cb05966aee557307151f1f00217af4143c1bcaf33b8df733f"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-61666e3f.rsa.pub-fdccfa670e123d3d",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "58d5ba4b2f3b1e927721d7a6432f298eedf72a6b"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "128d34d4aec39b0daedea8163cd8dc24dff36fd3d848630ab97eeb1d3084bbb3"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616a9724.rsa.pub-fe0797f3d753de34",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "23d0f2ea1af269c2f66165e0f8a944e96bf011de"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "10877cce0a935e46ad88cb79e174a2491680508eccda08e92bf04fb9bf37fbc1"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616abc23.rsa.pub-83f8824a9e8a4daf",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "3529ec82670c6d4e20ee3e4968db34b551e91d50"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "4a095a9daca86da496a3cd9adcd95ee2197fdbeb84638656d469f05a4d740751"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616ac3bc.rsa.pub-22d34d5fbfa617ab",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "55a301064e11c6fe9ba0f2ca17e234f3943ccb61"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "0caf5662fde45616d88cfd7021b7bda269a2fcaf311e51c48945a967a609ec0b"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616adfeb.rsa.pub-951eb66cb4549509",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "de1241307014aae3dba798e900f163408d98d6f4"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "ebe717d228555aa58133c202314a451f81e71f174781fd7ff8d8970d6cfa60da"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616ae350.rsa.pub-44fa2966c51f0c1f",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "57f6b93fda4a4496fab62844ddef0eeb168f80b5"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "d11f6b21c61b4274e182eb888883a8ba8acdbf820dcc7a6d82a7d9fc2fd2836d"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub",
+      "SPDXID": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616db30d.rsa.pub-b14251d1f8bcfe18",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "df02c9adc2906a3aa5e5ad69f50e3953e65710d0"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "40a216cbd163f22e5f16a9e0929de7cde221b9cbae8e36aa368b1e128afe0a31"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    },
+    {
+      "fileName": "/usr/share/udhcpc/default.script",
+      "SPDXID": "SPDXRef-File-usr-share-udhcpc-default.script-4fc79137008d263f",
+      "fileTypes": [
+        "TEXT"
+      ],
+      "checksums": [
+        {
+          "algorithm": "SHA1",
+          "checksumValue": "1d6a46dde403f14a22e2692cd84dd24af3805216"
+        },
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "c4e5a7c4783a7a73dec48dee009ee687015d2de7ff86b269679b95bef2c60e13"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseInfoInFiles": [
+        "NOASSERTION"
+      ],
+      "copyrightText": "",
+      "comment": "layerID: sha256:50171d1acbd537989c0740e2cba2b8288d1029dde7772c1db0c1288a634201fc"
+    }
+  ],
+  "relationships": [
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-File-lib-ld-musl-aarch64.so.1-15ac5a87021c605c",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-scanelf-54f3623fdd8fb8d4",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-ssl-client-6bbb10e52b8e7eb4",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relatedSpdxElement": "SPDXRef-Package-apk-zlib-d8258d3d7c48cfbf",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-usr-lib-engines-3-afalg.so-2dd02daf0dc8736e",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-etc-ssl-ct-log-list.cnf.dist-4706267d3fefbca6",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-usr-lib-engines-3-loader-attic.so-592a2f6a8711eea8",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-Package-apk-ssl-client-6bbb10e52b8e7eb4",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-etc-ssl-ct-log-list.cnf-7c00b4ab1629d304",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-etc-ssl-openssl.cnf.dist-a2fcecd0c7860aea",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-usr-lib-engines-3-padlock.so-cb12bf2787e0b4d0",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-lib-libcrypto.so.3-d7aa31f07714a25f",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-etc-ssl-openssl.cnf-e2fe362bf9fd5340",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-usr-lib-engines-3-capi.so-ec9b7c1e1d7152b6",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relatedSpdxElement": "SPDXRef-File-usr-lib-ossl-modules-legacy.so-fda2c463fe1d1275",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-524d27bb.rsa.pub-050339be1296c5a7",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-60ac2099.rsa.pub-05c47cc8cdd4f66e",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616ac3bc.rsa.pub-22d34d5fbfa617ab",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-5261cecb.rsa.pub-3840c02005b419b2",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-4a6a0840.rsa.pub-410a0a130a42ece8",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58199dcc.rsa.pub-444fb4815b9c5fa7",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616ae350.rsa.pub-44fa2966c51f0c1f",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-6165ee59.rsa.pub-5576929bc9db6198",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-524d27bb.rsa.pub-6742b949ff851b46",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616ae350.rsa.pub-76207aeaad529724",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58e4f17d.rsa.pub-793318842ffeec8c",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616abc23.rsa.pub-83f8824a9e8a4daf",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616adfeb.rsa.pub-951eb66cb4549509",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616db30d.rsa.pub-b14251d1f8bcfe18",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-5243ef4b.rsa.pub-b5b8c9e17450db1c",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616a9724.rsa.pub-cfc1d017a48ee9e7",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58199dcc.rsa.pub-df4b284ea560bc2f",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616adfeb.rsa.pub-ed83cb346d241bdf",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-5e69ca50.rsa.pub-fb2a93a263fc77d5",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-58cbb476.rsa.pub-fc38dbb1c534a98b",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-61666e3f.rsa.pub-fdccfa670e123d3d",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relatedSpdxElement": "SPDXRef-File-...alpine-devel-lists.alpinelinux.org-616a9724.rsa.pub-fe0797f3d753de34",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "relatedSpdxElement": "SPDXRef-Package-apk-ssl-client-6bbb10e52b8e7eb4",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "relatedSpdxElement": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "relatedSpdxElement": "SPDXRef-File-lib-libssl.so.3-942e1a73404f4c12",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-binsh-1fd95b4d43a9f438",
+      "relatedSpdxElement": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-binsh-1fd95b4d43a9f438",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-binsh-1fd95b4d43a9f438",
+      "relatedSpdxElement": "SPDXRef-File-bin-busybox-909c5f40cb01cb38",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-crontabs-root-351da988aba8a527",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-profile.d-README-3be87e7f154adb63",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-profile.d-20locale.sh-4738cb952eababba",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-modprobe.d-kms.conf-77f620d7a99cffa8",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-lib-sysctl.d-00-alpine.conf-812cee121e721231",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-modprobe.d-aliases.conf-8ac9ab5944e0b537",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-motd-9a55980593b74a03",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-modprobe.d-blacklist.conf-abf9fc46510ff77c",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-modprobe.d-i386.conf-e9054a53c22e88cf",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relatedSpdxElement": "SPDXRef-File-etc-profile.d-color-prompt.sh.disabled-eeb93048af63bf64",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-Package-apk-busybox-binsh-1fd95b4d43a9f438",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-usr-share-udhcpc-default.script-4fc79137008d263f",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-etc-busybox-paths.d-busybox-6a326fdbd2e5a86c",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-bin-busybox-909c5f40cb01cb38",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-etc-udhcpc-udhcpc.conf-a8f34a90829fb0c8",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-etc-network-if-up.d-dad-e17f6cd71c480b11",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-etc-logrotate.d-acpid-e47331443c3f2fdc",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relatedSpdxElement": "SPDXRef-File-etc-securetty-f5826ff16d6eaebb",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-scanelf-54f3623fdd8fb8d4",
+      "relatedSpdxElement": "SPDXRef-File-usr-bin-scanelf-42e6597f9fa4518a",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-scanelf-54f3623fdd8fb8d4",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-scanelf-54f3623fdd8fb8d4",
+      "relatedSpdxElement": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-ssl-client-6bbb10e52b8e7eb4",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-ssl-client-6bbb10e52b8e7eb4",
+      "relatedSpdxElement": "SPDXRef-File-usr-bin-ssl-client-90e1da58238b5003",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relatedSpdxElement": "SPDXRef-File-sbin-apk-03a303c2f408ad75",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relatedSpdxElement": "SPDXRef-File-lib-libapk.so.2.14.0-85382abc3213df0c",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-hosts-097d60485ef1a565",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-fstab-0c5c3473875a5b85",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-hostname-18f4143fa24a5309",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-nsswitch.conf-26adb8feffe4129b",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-inittab-273285a459443001",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-shells-2dc73ba417bebb75",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-sysctl.conf-2eede682f1d2d57e",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-protocols-5f1d8d1482d973b6",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-profile-6dfdb9518e6b63ef",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-passwd-7accffa8923d35e9",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-services-812b3f1a2d583f29",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-shadow-a1d64c72d061cd92",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-group-cc490babc7ba6984",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relatedSpdxElement": "SPDXRef-File-etc-modules-f9e050b82be1ad75",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-ca-certificates-bundle-bf42440dd0b61727",
+      "relatedSpdxElement": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-ca-certificates-bundle-bf42440dd0b61727",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-ca-certificates-bundle-bf42440dd0b61727",
+      "relatedSpdxElement": "SPDXRef-File-etc-ssl-certs-ca-certificates.crt-c7ec96e3f9d22e5e",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relatedSpdxElement": "SPDXRef-File-usr-bin-ldd-0f8acf82bbb616a2",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relatedSpdxElement": "SPDXRef-File-sbin-ldconfig-6dd00345fd25dfbe",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relatedSpdxElement": "SPDXRef-File-usr-bin-getconf-aa569a0b492dbc3e",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relatedSpdxElement": "SPDXRef-File-usr-bin-iconv-b4f317a0c3ae4126",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relatedSpdxElement": "SPDXRef-File-usr-bin-getent-dfc1d5b68ea46609",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-zlib-d8258d3d7c48cfbf",
+      "relatedSpdxElement": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relationshipType": "DEPENDENCY_OF"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-zlib-d8258d3d7c48cfbf",
+      "relatedSpdxElement": "SPDXRef-File-lib-apk-db-installed-8363b4a677041553",
+      "relationshipType": "OTHER",
+      "comment": "evident-by: indicates the package's existence is evident by the given file"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-apk-zlib-d8258d3d7c48cfbf",
+      "relatedSpdxElement": "SPDXRef-File-lib-libz.so.1.3.1-cfebf8b5dc1f6374",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-alpine-baselayout-21e54be9d7ca763c",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-alpine-baselayout-data-9ff96f942d2401f2",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-alpine-keys-0e5100e3d266a135",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-apk-tools-78c55d64ab350462",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-busybox-4cea7ce2e2974c99",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-busybox-binsh-1fd95b4d43a9f438",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-ca-certificates-bundle-bf42440dd0b61727",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-libcrypto3-0cfcda1a242dfd13",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-libssl3-1bffb507b1b535bc",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-musl-03e521237cbed45a",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-musl-utils-c84ae08b59df5c6e",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-scanelf-54f3623fdd8fb8d4",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-ssl-client-6bbb10e52b8e7eb4",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DocumentRoot-Image-alpine",
+      "relatedSpdxElement": "SPDXRef-Package-apk-zlib-d8258d3d7c48cfbf",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-DOCUMENT",
+      "relatedSpdxElement": "SPDXRef-DocumentRoot-Image-alpine",
+      "relationshipType": "DESCRIBES"
+    }
+  ]
+}
diff --git a/attestation/sbom/sbom.go b/attestation/sbom/sbom.go
new file mode 100644
index 00000000..746f4a4b
--- /dev/null
+++ b/attestation/sbom/sbom.go
@@ -0,0 +1,151 @@
+// Copyright 2024 The Witness Contributors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package sbom
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/in-toto/go-witness/attestation"
+	"github.com/in-toto/go-witness/log"
+	"github.com/invopop/jsonschema"
+)
+
+const (
+	Name    = "sbom"
+	Type    = "https://witness.dev/attestations/sbom/v0.1"
+	RunType = attestation.PostProductRunType
+
+	SPDXPredicateType      = "https://spdx.dev/Document"
+	SPDXMimeType           = "application/spdx+json"
+	CycloneDxPredicateType = "https://cyclonedx.org/bom"
+	CycloneDxMimeType      = "application/vnd.cyclonedx+json"
+)
+
+// This is a hacky way to create a compile time error in case the attestor
+// doesn't implement the expected interfaces.
+var (
+	_ attestation.Attestor = &SBOMAttestor{}
+	_ attestation.Exporter = &SBOMAttestor{}
+)
+
+func init() {
+	attestation.RegisterAttestation(Name, Type, RunType, func() attestation.Attestor {
+		return NewSBOMAttestor()
+	})
+}
+
+type Option func(*SBOMAttestor)
+
+func WithExport(export bool) Option {
+	return func(a *SBOMAttestor) {
+		a.export = export
+	}
+}
+
+type SBOMAttestor struct {
+	SBOMDocument  interface{}
+	predicateType string
+	export        bool
+}
+
+func NewSBOMAttestor() *SBOMAttestor {
+	return &SBOMAttestor{
+		predicateType: Type,
+	}
+}
+
+func (a *SBOMAttestor) Name() string {
+	return Name
+}
+
+func (a *SBOMAttestor) Type() string {
+	return a.predicateType
+}
+
+func (a *SBOMAttestor) RunType() attestation.RunType {
+	return RunType
+}
+
+func (a *SBOMAttestor) Export() bool {
+	return a.export
+}
+
+func (a *SBOMAttestor) Schema() *jsonschema.Schema {
+	return jsonschema.Reflect(a)
+}
+
+func (a *SBOMAttestor) Attest(ctx *attestation.AttestationContext) error {
+	if err := a.getCandidate(ctx); err != nil {
+		log.Debugf("(attestation/sbom) error getting candidate: %w", err)
+		return err
+	}
+
+	return nil
+}
+
+func (a *SBOMAttestor) MarshalJSON() ([]byte, error) {
+	return json.Marshal(&a.SBOMDocument)
+}
+
+func (a *SBOMAttestor) UnmarshalJSON(data []byte) error {
+	if err := json.Unmarshal(data, &a.SBOMDocument); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (a *SBOMAttestor) getCandidate(ctx *attestation.AttestationContext) error {
+	products := ctx.Products()
+
+	if len(products) == 0 {
+		return fmt.Errorf("no products to attest")
+	}
+
+	for path, product := range products {
+		if product.MimeType == SPDXMimeType {
+			a.predicateType = SPDXPredicateType
+		} else if product.MimeType == CycloneDxMimeType {
+			a.predicateType = CycloneDxPredicateType
+		} else {
+			continue
+		}
+
+		f, err := os.Open(path)
+		if err != nil {
+			return fmt.Errorf("error opening file: %s", path)
+		}
+
+		sbomBytes, err := io.ReadAll(f)
+		if err != nil {
+			return fmt.Errorf("error reading file: %s", path)
+		}
+
+		var sbomDocument interface{}
+		if err := json.Unmarshal(sbomBytes, &sbomDocument); err != nil {
+			log.Debugf("(attestation/sbom) error unmarshaling SBOM: %w", err)
+			continue
+		}
+
+		a.SBOMDocument = sbomDocument
+
+		return nil
+	}
+
+	return fmt.Errorf("no SBOM file found")
+}
diff --git a/attestation/sbom/sbom_test.go b/attestation/sbom/sbom_test.go
new file mode 100644
index 00000000..573bf352
--- /dev/null
+++ b/attestation/sbom/sbom_test.go
@@ -0,0 +1,160 @@
+// Copyright 2024 The Witness Contributors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package sbom
+
+import (
+	"os"
+	"testing"
+
+	"github.com/in-toto/go-witness/attestation"
+	"github.com/in-toto/go-witness/attestation/product"
+)
+
+const (
+	defaultExport = false
+)
+
+func TestName(t *testing.T) {
+	provenance := NewSBOMAttestor()
+	if provenance.Name() != Name {
+		t.Errorf("expected %s, got %s", Name, provenance.Name())
+	}
+}
+
+func TestType(t *testing.T) {
+	provenance := NewSBOMAttestor()
+	if provenance.Type() != Type {
+		t.Errorf("expected %s, got %s", Type, provenance.Type())
+	}
+}
+
+func TestRunType(t *testing.T) {
+	provenance := NewSBOMAttestor()
+	if provenance.RunType() != RunType {
+		t.Errorf("expected %s, got %s", RunType, provenance.RunType())
+	}
+}
+
+func TestExport(t *testing.T) {
+	provenance := NewSBOMAttestor()
+	if provenance.export != defaultExport {
+		t.Errorf("expected %t, got %t", defaultExport, provenance.export)
+	}
+
+	WithExport(true)(provenance)
+	if !provenance.export {
+		t.Errorf("expected %t, got %t", true, provenance.export)
+	}
+
+	if provenance.Export() != true {
+		t.Errorf("expected %t, got %t", true, provenance.Export())
+	}
+}
+
+func TestAttest(t *testing.T) {
+	var tests = []struct {
+		name          string
+		sbomPath      string
+		sbomFileName  string
+		expectedType  string
+		expectedError *error
+	}{
+		{"SPDX 2.2", "./boms/spdx-2.2/", "alpine.spdx-2-2.json", SPDXPredicateType, nil},
+		{"SPDX 2.3", "./boms/spdx-2.3/", "alpine.spdx-2-3.json", SPDXPredicateType, nil},
+		{"CycloneDx", "./boms/cyclonedx-json/", "alpine.cyclonedx.json", CycloneDxPredicateType, nil},
+		{"CycloneDx XML", "./boms/cyclonedx-xml/", "alpine.cyclonedx.xml", Type, new(error)},
+		{"Bad JSON", "./boms/emptyDir", "bad.json", Type, new(error)},
+	}
+
+	err := os.Mkdir("emptyDir", 0777)
+	if err != nil && !os.IsExist(err) {
+		t.Errorf("could not create empty directory: %s", err.Error())
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			sbom := NewSBOMAttestor()
+			p := product.New()
+
+			ctx, err := attestation.NewContext("test", []attestation.Attestor{p, sbom},
+				attestation.WithWorkingDir(test.sbomPath))
+			if err != nil {
+				t.Errorf("error creating attestation context: %s", err)
+			}
+
+			if err := ctx.RunAttestors(); err != nil {
+				t.Errorf("unexpected error: %s", err)
+			}
+
+			if sbom.predicateType != test.expectedType {
+				t.Errorf("expected SBOM type %s, got %s", test.expectedType, sbom.predicateType)
+			}
+		})
+	}
+}
+
+var testGoodSBOMs = []string{
+	"./boms/spdx-2.2/alpine.spdx-2-2.json",
+	"./boms/spdx-2.3/alpine.spdx-2-3.json",
+	"./boms/cyclonedx-json/alpine.cyclonedx.json",
+}
+
+func TestUnmarshalJSON(t *testing.T) {
+	sbom := NewSBOMAttestor()
+
+	for _, testSBOM := range testGoodSBOMs {
+		json, err := os.ReadFile(testSBOM)
+		if err != nil {
+			t.Errorf("could not read test sbom: %s", err.Error())
+		}
+
+		if err := sbom.UnmarshalJSON(json); err != nil {
+			t.Errorf("unexpected error: %s", err)
+		}
+	}
+}
+
+func TestUnmarshalBadJSON(t *testing.T) {
+	sbom := NewSBOMAttestor()
+
+	json, err := os.ReadFile("./boms/cyclonedx-xml/alpine.cyclonedx.xml")
+	if err != nil {
+		t.Errorf("could not read test sbom: %s", err.Error())
+	}
+
+	if err := sbom.UnmarshalJSON(json); err == nil {
+		t.Error("Expected error")
+	}
+}
+
+func TestMarshalJSON(t *testing.T) {
+	sbom := NewSBOMAttestor()
+
+	for _, testSBOM := range testGoodSBOMs {
+		json, err := os.ReadFile(testSBOM)
+		if err != nil {
+			t.Errorf("could not read test sbom: %s", err.Error())
+		}
+
+		if err := sbom.UnmarshalJSON(json); err != nil {
+			t.Errorf("unexpected error: %s", err)
+		}
+
+		_, err = sbom.MarshalJSON()
+		if err != nil {
+			t.Errorf("unexpected error: %s", err)
+		}
+	}
+}
diff --git a/go.mod b/go.mod
index e1216bae..598f114f 100644
--- a/go.mod
+++ b/go.mod
@@ -10,6 +10,7 @@ require (
 	github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352
 	github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7
 	github.com/edwarnicke/gitoid v0.0.0-20220710194850-1be5bfda1f9d
+	github.com/gabriel-vasile/mimetype v1.4.4
 	github.com/go-git/go-git/v5 v5.11.0
 	github.com/go-jose/go-jose/v3 v3.0.3
 	github.com/in-toto/archivista v0.4.0
@@ -145,7 +146,7 @@ require (
 	github.com/zeebo/errs v1.3.0 // indirect
 	golang.org/x/crypto v0.23.0 // indirect
 	golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8
-	golang.org/x/net v0.24.0 // indirect
+	golang.org/x/net v0.25.0 // indirect
 	golang.org/x/term v0.20.0 // indirect
 	golang.org/x/text v0.15.0 // indirect
 	google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda // indirect
diff --git a/go.sum b/go.sum
index 852f51a1..077b4bdc 100644
--- a/go.sum
+++ b/go.sum
@@ -122,6 +122,8 @@ github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/foxcpp/go-mockdns v1.0.0 h1:7jBqxd3WDWwi/6WhDvacvH1XsN3rOLXyHM1uhvIx6FI=
 github.com/foxcpp/go-mockdns v1.0.0/go.mod h1:lgRN6+KxQBawyIghpnl5CezHFGS9VLzvtVlwxvzXTQ4=
+github.com/gabriel-vasile/mimetype v1.4.4 h1:QjV6pZ7/XZ7ryI2KuyeEDE8wnh7fHP9YnQy+R0LnH8I=
+github.com/gabriel-vasile/mimetype v1.4.4/go.mod h1:JwLei5XPtWdGiMFB5Pjle1oEeoSeEuJfJE+TtfvdB/s=
 github.com/gliderlabs/ssh v0.3.5 h1:OcaySEmAQJgyYcArR+gGGTHCyE7nvhEMTlYY+Dp8CpY=
 github.com/gliderlabs/ssh v0.3.5/go.mod h1:8XB4KraRrX39qHhT6yxPsHedjA08I/uBVwj4xC+/+z4=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
@@ -410,8 +412,8 @@ golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
-golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
+golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.20.0 h1:4mQdhULixXKP1rwYBW0vAijoXnkTG0BLCDRzfe1idMo=
 golang.org/x/oauth2 v0.20.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
diff --git a/imports.go b/imports.go
index ef7a4e71..3edfafc0 100644
--- a/imports.go
+++ b/imports.go
@@ -32,6 +32,7 @@ import (
 	_ "github.com/in-toto/go-witness/attestation/policyverify"
 	_ "github.com/in-toto/go-witness/attestation/product"
 	_ "github.com/in-toto/go-witness/attestation/sarif"
+	_ "github.com/in-toto/go-witness/attestation/sbom"
 	_ "github.com/in-toto/go-witness/attestation/slsa"
 
 	// signer providers
diff --git a/schemagen/sbom.json b/schemagen/sbom.json
new file mode 100644
index 00000000..a74ef29b
--- /dev/null
+++ b/schemagen/sbom.json
@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/in-toto/go-witness/attestation/sbom/sbom-attestor",
+  "$ref": "#/$defs/SBOMAttestor",
+  "$defs": {
+    "SBOMAttestor": {
+      "properties": {
+        "SBOMDocument": true
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "SBOMDocument"
+      ]
+    }
+  }
+}
\ No newline at end of file