diff --git a/file.go b/file.go
index 5c8bd915a..bf154f8d8 100644
--- a/file.go
+++ b/file.go
@@ -5,6 +5,7 @@ type FileKind string
 
 const (
 	FileKindWhiteout = FileKind("whiteout")
+	FileKindRPM      = FileKind("rpm")
 )
 
 // File represents interesting files that are found in the layer.
diff --git a/gobin/gobin.go b/gobin/gobin.go
index a2eb7ff82..0b56bebc9 100644
--- a/gobin/gobin.go
+++ b/gobin/gobin.go
@@ -28,6 +28,7 @@ import (
 
 	"github.com/quay/claircore"
 	"github.com/quay/claircore/indexer"
+	"github.com/quay/claircore/rpm"
 )
 
 // Detector detects go binaries and reports the packages used to build them.
@@ -86,7 +87,8 @@ func (Detector) Scan(ctx context.Context, l *claircore.Layer) ([]*claircore.Pack
 	// Only create a single spool file per call, re-use for every binary.
 	var spool spoolfile
 	walk := func(p string, d fs.DirEntry, err error) error {
-		ctx := zlog.ContextWithValues(ctx, "path", d.Name())
+		ctx := zlog.ContextWithValues(ctx, "filename", d.Name())
+
 		switch {
 		case err != nil:
 			return err
@@ -107,6 +109,18 @@ func (Detector) Scan(ctx context.Context, l *claircore.Layer) ([]*claircore.Pack
 			// Not executable
 			return nil
 		}
+
+		isRPM, err := rpm.FileInstalledByRPM(ctx, l, p)
+		if err != nil {
+			return err
+		}
+		if isRPM {
+			zlog.Debug(ctx).
+				Str("path", p).
+				Msg("file path determined to be of RPM origin")
+			return nil
+		}
+
 		f, err := sys.Open(p)
 		if err != nil {
 			// TODO(crozzy): Remove log line once controller is in a
diff --git a/gobin/gobin_test.go b/gobin/gobin_test.go
index c9c9c2f0e..7e8ccceda 100644
--- a/gobin/gobin_test.go
+++ b/gobin/gobin_test.go
@@ -61,6 +61,12 @@ func TestEmptyFile(t *testing.T) {
 	if err := l.Init(ctx, &test.AnyDescription, f); err != nil {
 		t.Error(err)
 	}
+	t.Cleanup(func() {
+		if err := l.Close(); err != nil {
+			t.Error(err)
+		}
+	})
+
 	var s Detector
 	_, err = s.Scan(ctx, &l)
 	if err != nil {
@@ -138,6 +144,11 @@ func TestScanner(t *testing.T) {
 	if err := l.Init(ctx, &test.AnyDescription, f); err != nil {
 		t.Error(err)
 	}
+	t.Cleanup(func() {
+		if err := l.Close(); err != nil {
+			t.Error(err)
+		}
+	})
 
 	// Run the scanner on the fake layer.
 	var s Detector
diff --git a/nodejs/packagescanner.go b/nodejs/packagescanner.go
index 9613301bc..43d40319b 100644
--- a/nodejs/packagescanner.go
+++ b/nodejs/packagescanner.go
@@ -17,6 +17,7 @@ import (
 	"github.com/Masterminds/semver"
 	"github.com/quay/claircore"
 	"github.com/quay/claircore/indexer"
+	"github.com/quay/claircore/rpm"
 )
 
 const repository = "npm"
@@ -92,6 +93,17 @@ func (s *Scanner) Scan(ctx context.Context, layer *claircore.Layer) ([]*claircor
 	ret := make([]*claircore.Package, 0, len(pkgs))
 	var invalidPkgs []string
 	for _, p := range pkgs {
+		isRPM, err := rpm.FileInstalledByRPM(ctx, layer, p)
+		if err != nil {
+			return nil, err
+		}
+		if isRPM {
+			zlog.Debug(ctx).
+				Str("path", p).
+				Msg("file path determined to be of RPM origin")
+			continue
+		}
+
 		f, err := sys.Open(p)
 		if err != nil {
 			return nil, fmt.Errorf("nodejs: unable to open file %q: %w", p, err)
diff --git a/python/packagescanner.go b/python/packagescanner.go
index fc494062d..d8bdc5f46 100644
--- a/python/packagescanner.go
+++ b/python/packagescanner.go
@@ -19,6 +19,7 @@ import (
 	"github.com/quay/claircore"
 	"github.com/quay/claircore/indexer"
 	"github.com/quay/claircore/pkg/pep440"
+	"github.com/quay/claircore/rpm"
 )
 
 var (
@@ -79,6 +80,16 @@ func (ps *Scanner) Scan(ctx context.Context, layer *claircore.Layer) ([]*clairco
 	}
 	var ret []*claircore.Package
 	for _, n := range ms {
+		isRPM, err := rpm.FileInstalledByRPM(ctx, layer, n)
+		if err != nil {
+			return nil, err
+		}
+		if isRPM {
+			zlog.Debug(ctx).
+				Str("path", n).
+				Msg("file path determined to be of RPM origin")
+			continue
+		}
 		b, err := fs.ReadFile(sys, n)
 		if err != nil {
 			return nil, fmt.Errorf("python: unable to read file: %w", err)
@@ -143,14 +154,14 @@ func findDeliciousEgg(ctx context.Context, sys fs.FS) (out []string, err error)
 	// Is this layer an rpm layer?
 	//
 	// If so, files in the disto-managed directory can be skipped.
-	var rpm bool
+	var isRPM bool
 	for _, p := range []string{
 		"var/lib/rpm/Packages",
 		"var/lib/rpm/rpmdb.sqlite",
 		"var/lib/rpm/Packages.db",
 	} {
 		if fi, err := fs.Stat(sys, p); err == nil && fi.Mode().IsRegular() {
-			rpm = true
+			isRPM = true
 			break
 		}
 	}
@@ -172,12 +183,12 @@ func findDeliciousEgg(ctx context.Context, sys fs.FS) (out []string, err error)
 		switch {
 		case err != nil:
 			return err
-		case (rpm || dpkg) && d.Type().IsDir():
+		case (isRPM || dpkg) && d.Type().IsDir():
 			// Skip one level up from the "packages" directory so the walk also
 			// skips the standard library.
 			var pat string
 			switch {
-			case rpm:
+			case isRPM:
 				pat = `usr/lib*/python[23].*`
 				ev = ev.Bool("rpm_dir", true)
 			case dpkg:
diff --git a/rpm/files.go b/rpm/files.go
new file mode 100644
index 000000000..5be4850b7
--- /dev/null
+++ b/rpm/files.go
@@ -0,0 +1,103 @@
+package rpm
+
+import (
+	"context"
+	"fmt"
+	"io/fs"
+	"sync"
+
+	"github.com/quay/claircore"
+	"github.com/quay/zlog"
+)
+
+// filesCache is used for concurrent access to the map containing layer.Hash -> map RPM files.
+// The value is a map to allow for quick member checking.
+type filesCache struct {
+	c  map[string]map[string]struct{}
+	mu *sync.Mutex
+}
+
+var fc *filesCache
+
+func init() {
+	fc = &filesCache{
+		c:  map[string]map[string]struct{}{},
+		mu: &sync.Mutex{},
+	}
+}
+
+// gc deletes the layer's entry from the map if the ctx is done, this ties the lifecycle of
+// the cached information to the request lifecycle to avoid excessive memory consumption.
+func (fc *filesCache) gc(ctx context.Context, key string) {
+	<-ctx.Done()
+	fc.mu.Lock()
+	defer fc.mu.Unlock()
+	delete(fc.c, key)
+}
+
+// getFiles looks up RPM files that exist in the RPM database using the filesFromDB
+// function and memorizes the result to avoid repeated work for the same claircore.Layer.
+func (fc *filesCache) getFiles(ctx context.Context, layer *claircore.Layer) (map[string]struct{}, error) {
+	if fc == nil {
+		panic("programmer error: filesCache nil")
+	}
+	fc.mu.Lock()
+	defer fc.mu.Unlock()
+	if files, ok := fc.c[layer.Hash.String()]; ok {
+		return files, nil
+	}
+
+	sys, err := layer.FS()
+	if err != nil {
+		return nil, fmt.Errorf("rpm: unable to open layer: %w", err)
+	}
+
+	files := map[string]struct{}{}
+	defer func() {
+		// Defer setting the cache so any early-outs don't have to worry.
+		fc.c[layer.Hash.String()] = files
+	}()
+	go func(ctx context.Context) {
+		fc.gc(ctx, layer.Hash.String())
+	}(ctx)
+
+	found := make([]foundDB, 0)
+	if err := fs.WalkDir(sys, ".", findDBs(ctx, &found, sys)); err != nil {
+		return nil, fmt.Errorf("rpm: error walking fs: %w", err)
+	}
+	if len(found) == 0 {
+		return nil, nil
+	}
+
+	done := map[string]struct{}{}
+	zlog.Debug(ctx).Int("count", len(found)).Msg("found possible databases")
+	for _, db := range found {
+		ctx := zlog.ContextWithValues(ctx, "db", db.String())
+		zlog.Debug(ctx).Msg("examining database")
+		if _, ok := done[db.Path]; ok {
+			zlog.Debug(ctx).Msg("already seen, skipping")
+			continue
+		}
+		done[db.Path] = struct{}{}
+		fs, err := getDBObjects(ctx, sys, db, filesFromDB)
+		if err != nil {
+			return nil, fmt.Errorf("rpm: error getting native DBs: %w", err)
+		}
+		for _, f := range fs {
+			files[f.Path] = struct{}{}
+		}
+	}
+
+	return files, nil
+}
+
+// FileInstalledByRPM takes a claircore.Layer and filepath string and returns a boolean
+// signifying whether that file came from an RPM package.
+func FileInstalledByRPM(ctx context.Context, layer *claircore.Layer, filepath string) (bool, error) {
+	files, err := fc.getFiles(ctx, layer)
+	if err != nil {
+		return false, err
+	}
+	_, exists := files[filepath]
+	return exists, nil
+}
diff --git a/rpm/files_test.go b/rpm/files_test.go
new file mode 100644
index 000000000..0b3389b9a
--- /dev/null
+++ b/rpm/files_test.go
@@ -0,0 +1,78 @@
+package rpm
+
+import (
+	"context"
+	"testing"
+
+	"github.com/quay/claircore"
+	"github.com/quay/claircore/test"
+	"github.com/quay/zlog"
+)
+
+var rpmFilesTestcases = []struct {
+	name     string
+	isRPM    bool
+	filePath string
+	layer    test.LayerRef
+	lenFiles int
+}{
+	{
+		name:     "Found",
+		isRPM:    true,
+		filePath: "usr/lib/node_modules/npm/node_modules/safe-buffer/package.json",
+		layer: test.LayerRef{
+			Registry: "registry.access.redhat.com",
+			Name:     "ubi9/nodejs-18",
+			Digest:   `sha256:1ae06b64755052cef4c32979aded82a18f664c66fa7b50a6d2924afac2849c6e`,
+		},
+		lenFiles: 100,
+	},
+	{
+		name:     "Not found",
+		isRPM:    false,
+		filePath: "usr/lib/node_modules/npm/node_modules/safe-buffer/package.jsonx",
+		layer: test.LayerRef{
+			Registry: "registry.access.redhat.com",
+			Name:     "ubi9/nodejs-18",
+			Digest:   `sha256:1ae06b64755052cef4c32979aded82a18f664c66fa7b50a6d2924afac2849c6e`,
+		},
+		lenFiles: 100,
+	},
+}
+
+func TestIsRPMFile(t *testing.T) {
+	ctx, cancel := context.WithCancel(zlog.Test(context.Background(), t))
+	a := test.NewCachedArena(t)
+
+	for _, tt := range rpmFilesTestcases {
+		t.Run(tt.name, func(t *testing.T) {
+			a.LoadLayerFromRegistry(ctx, t, tt.layer)
+			r := a.Realizer(ctx).(*test.CachedRealizer)
+			t.Cleanup(func() {
+				if err := r.Close(); err != nil {
+					t.Error(err)
+				}
+			})
+
+			realizedLayers, err := r.RealizeDescriptions(ctx, []claircore.LayerDescription{
+				{
+					Digest:    tt.layer.Digest,
+					URI:       "http://example.com",
+					MediaType: test.MediaType,
+					Headers:   make(map[string][]string),
+				},
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			isRPM, err := FileInstalledByRPM(ctx, &realizedLayers[0], tt.filePath)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if tt.isRPM != isRPM {
+				t.Errorf("expected isRPM: %t, got isRPM: %t", tt.isRPM, isRPM)
+			}
+		})
+	}
+	cancel()
+}
diff --git a/rpm/native_db.go b/rpm/native_db.go
index 7aee7b45e..267682745 100644
--- a/rpm/native_db.go
+++ b/rpm/native_db.go
@@ -5,6 +5,8 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"io/fs"
+	"os"
 	"path"
 	"regexp"
 	"runtime/trace"
@@ -14,7 +16,10 @@ import (
 	"golang.org/x/crypto/openpgp/packet"
 
 	"github.com/quay/claircore"
+	"github.com/quay/claircore/rpm/bdb"
 	"github.com/quay/claircore/rpm/internal/rpm"
+	"github.com/quay/claircore/rpm/ndb"
+	"github.com/quay/claircore/rpm/sqlite"
 )
 
 // NativeDB is the interface implemented for in-process RPM database handlers.
@@ -23,6 +28,128 @@ type nativeDB interface {
 	Validate(context.Context) error
 }
 
+// ObjectResponse is a generic object that we're expecting to extract from
+// RPM database, currently either a Package or a File.
+type ObjectResponse interface {
+	[]*claircore.Package | []claircore.File
+}
+
+// getDBObjects does all the dirty work of extracting generic claircore objects
+// from an RPM database. Provide it with a foundDB, the sys and a fn extract function
+// it will create a implementation agnostic nativeDB and extract specific claircore
+// objects from it.
+func getDBObjects[T ObjectResponse](ctx context.Context, sys fs.FS, db foundDB, fn func(context.Context, string, nativeDB) (T, error)) (T, error) {
+	var nat nativeDB
+	switch db.Kind {
+	case kindSQLite:
+		r, err := sys.Open(path.Join(db.Path, `rpmdb.sqlite`))
+		if err != nil {
+			return nil, fmt.Errorf("rpm: error reading sqlite db: %w", err)
+		}
+		defer func() {
+			if err := r.Close(); err != nil {
+				zlog.Warn(ctx).Err(err).Msg("unable to close sqlite db")
+			}
+		}()
+		f, err := os.CreateTemp(os.TempDir(), `rpmdb.sqlite.*`)
+		if err != nil {
+			return nil, fmt.Errorf("rpm: error reading sqlite db: %w", err)
+		}
+		defer func() {
+			if err := os.Remove(f.Name()); err != nil {
+				zlog.Error(ctx).Err(err).Msg("unable to unlink sqlite db")
+			}
+			if err := f.Close(); err != nil {
+				zlog.Warn(ctx).Err(err).Msg("unable to close sqlite db")
+			}
+		}()
+		zlog.Debug(ctx).Str("file", f.Name()).Msg("copying sqlite db out of FS")
+		if _, err := io.Copy(f, r); err != nil {
+			return nil, fmt.Errorf("rpm: error reading sqlite db: %w", err)
+		}
+		if err := f.Sync(); err != nil {
+			return nil, fmt.Errorf("rpm: error reading sqlite db: %w", err)
+		}
+		sdb, err := sqlite.Open(f.Name())
+		if err != nil {
+			return nil, fmt.Errorf("rpm: error reading sqlite db: %w", err)
+		}
+		defer sdb.Close()
+		nat = sdb
+	case kindBDB:
+		f, err := sys.Open(path.Join(db.Path, `Packages`))
+		if err != nil {
+			return nil, fmt.Errorf("rpm: error reading bdb db: %w", err)
+		}
+		defer f.Close()
+		r, done, err := mkAt(ctx, db.Kind, f)
+		if err != nil {
+			return nil, fmt.Errorf("rpm: error reading bdb db: %w", err)
+		}
+		defer done()
+		var bpdb bdb.PackageDB
+		if err := bpdb.Parse(r); err != nil {
+			return nil, fmt.Errorf("rpm: error parsing bdb db: %w", err)
+		}
+		nat = &bpdb
+	case kindNDB:
+		f, err := sys.Open(path.Join(db.Path, `Packages.db`))
+		if err != nil {
+			return nil, fmt.Errorf("rpm: error reading ndb db: %w", err)
+		}
+		defer f.Close()
+		r, done, err := mkAt(ctx, db.Kind, f)
+		if err != nil {
+			return nil, fmt.Errorf("rpm: error reading ndb db: %w", err)
+		}
+		defer done()
+		var npdb ndb.PackageDB
+		if err := npdb.Parse(r); err != nil {
+			return nil, fmt.Errorf("rpm: error parsing ndb db: %w", err)
+		}
+		nat = &npdb
+	default:
+		panic("programmer error: bad kind: " + db.Kind.String())
+	}
+	if err := nat.Validate(ctx); err != nil {
+		zlog.Warn(ctx).
+			Err(err).
+			Msg("rpm: invalid native DB")
+		return nil, nil
+	}
+	ps, err := fn(ctx, db.String(), nat)
+	if err != nil {
+		return nil, fmt.Errorf("rpm: error reading native db: %w", err)
+	}
+
+	return ps, nil
+}
+
+func filesFromDB(ctx context.Context, _ string, db nativeDB) ([]claircore.File, error) {
+	rds, err := db.AllHeaders(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("rpm: error reading headers: %w", err)
+	}
+	fs := []claircore.File{}
+	for _, rd := range rds {
+		var h rpm.Header
+		if err := h.Parse(ctx, rd); err != nil {
+			return nil, err
+		}
+		var info Info
+		if err := info.Load(ctx, &h); err != nil {
+			return nil, err
+		}
+		for _, f := range info.Filenames {
+			fs = append(fs, claircore.File{
+				Kind: claircore.FileKindRPM,
+				Path: f,
+			})
+		}
+	}
+	return fs, nil
+}
+
 // PackagesFromDB extracts the packages from the RPM headers provided by
 // the database.
 func packagesFromDB(ctx context.Context, pkgdb string, db nativeDB) ([]*claircore.Package, error) {
@@ -230,7 +357,8 @@ func init() {
 		`^.*/site-packages/[^/]+\.egg-info/PKG-INFO$`, // Python packages
 		`^.*/package.json$`,                           // npm packages
 		`^.*/[^/]+\.gemspec$`,                         // ruby gems
-		`^/usr/bin/[^/]+$`,                            // any executable
+		`^/usr/s?bin/[^/]+$`,                          // any executable
+		"^/usr/libexec/[^/]+/[^/]+$",                  // sometimes the executables are here too
 	}
 	filePatterns = regexp.MustCompile(strings.Join(pat, `|`))
 }
@@ -299,3 +427,106 @@ func constructHint(b *strings.Builder, info *Info) string {
 	}
 	return b.String()
 }
+
+func findDBs(ctx context.Context, out *[]foundDB, sys fs.FS) fs.WalkDirFunc {
+	return func(p string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
+			return nil
+		}
+
+		dir, n := path.Split(p)
+		dir = path.Clean(dir)
+		switch n {
+		case `Packages`:
+			f, err := sys.Open(p)
+			if err != nil {
+				return err
+			}
+			ok := bdb.CheckMagic(ctx, f)
+			f.Close()
+			if !ok {
+				return nil
+			}
+			*out = append(*out, foundDB{
+				Path: dir,
+				Kind: kindBDB,
+			})
+		case `rpmdb.sqlite`:
+			*out = append(*out, foundDB{
+				Path: dir,
+				Kind: kindSQLite,
+			})
+		case `Packages.db`:
+			f, err := sys.Open(p)
+			if err != nil {
+				return err
+			}
+			ok := ndb.CheckMagic(ctx, f)
+			f.Close()
+			if !ok {
+				return nil
+			}
+			*out = append(*out, foundDB{
+				Path: dir,
+				Kind: kindNDB,
+			})
+		}
+		return nil
+	}
+}
+
+func mkAt(ctx context.Context, k dbKind, f fs.File) (io.ReaderAt, func(), error) {
+	if r, ok := f.(io.ReaderAt); ok {
+		return r, func() {}, nil
+	}
+	spool, err := os.CreateTemp(os.TempDir(), `Packages.`+k.String()+`.`)
+	if err != nil {
+		return nil, nil, fmt.Errorf("rpm: error spooling db: %w", err)
+	}
+	ctx = zlog.ContextWithValues(ctx, "file", spool.Name())
+	if err := os.Remove(spool.Name()); err != nil {
+		zlog.Error(ctx).Err(err).Msg("unable to remove spool; file leaked!")
+	}
+	zlog.Debug(ctx).
+		Msg("copying db out of fs.FS")
+	if _, err := io.Copy(spool, f); err != nil {
+		if err := spool.Close(); err != nil {
+			zlog.Warn(ctx).Err(err).Msg("unable to close spool")
+		}
+		return nil, nil, fmt.Errorf("rpm: error spooling db: %w", err)
+	}
+	return spool, closeSpool(ctx, spool), nil
+}
+
+func closeSpool(ctx context.Context, f *os.File) func() {
+	return func() {
+		if err := f.Close(); err != nil {
+			zlog.Warn(ctx).Err(err).Msg("unable to close spool")
+		}
+	}
+}
+
+type dbKind uint
+
+//go:generate -command stringer go run golang.org/x/tools/cmd/stringer
+//go:generate stringer -linecomment -type dbKind
+
+const (
+	_ dbKind = iota
+
+	kindBDB    // bdb
+	kindSQLite // sqlite
+	kindNDB    // ndb
+)
+
+type foundDB struct {
+	Path string
+	Kind dbKind
+}
+
+func (f foundDB) String() string {
+	return f.Kind.String() + ":" + f.Path
+}
diff --git a/rpm/packagescanner.go b/rpm/packagescanner.go
index 0d48cf9f5..d581f624b 100644
--- a/rpm/packagescanner.go
+++ b/rpm/packagescanner.go
@@ -4,19 +4,13 @@ package rpm
 import (
 	"context"
 	"fmt"
-	"io"
 	"io/fs"
-	"os"
-	"path"
 	"runtime/trace"
 
 	"github.com/quay/zlog"
 
 	"github.com/quay/claircore"
 	"github.com/quay/claircore/indexer"
-	"github.com/quay/claircore/rpm/bdb"
-	"github.com/quay/claircore/rpm/ndb"
-	"github.com/quay/claircore/rpm/sqlite"
 )
 
 const (
@@ -89,194 +83,12 @@ func (ps *Scanner) Scan(ctx context.Context, layer *claircore.Layer) ([]*clairco
 			continue
 		}
 		done[db.Path] = struct{}{}
-
-		var nat nativeDB // see native_db.go:/nativeDB
-		switch db.Kind {
-		case kindSQLite:
-			r, err := sys.Open(path.Join(db.Path, `rpmdb.sqlite`))
-			if err != nil {
-				return nil, fmt.Errorf("rpm: error reading sqlite db: %w", err)
-			}
-			defer func() {
-				if err := r.Close(); err != nil {
-					zlog.Warn(ctx).Err(err).Msg("unable to close sqlite db")
-				}
-			}()
-			f, err := os.CreateTemp(os.TempDir(), `rpmdb.sqlite.*`)
-			if err != nil {
-				return nil, fmt.Errorf("rpm: error reading sqlite db: %w", err)
-			}
-			defer func() {
-				if err := os.Remove(f.Name()); err != nil {
-					zlog.Error(ctx).Err(err).Msg("unable to unlink sqlite db")
-				}
-				if err := f.Close(); err != nil {
-					zlog.Warn(ctx).Err(err).Msg("unable to close sqlite db")
-				}
-			}()
-			zlog.Debug(ctx).Str("file", f.Name()).Msg("copying sqlite db out of FS")
-			if _, err := io.Copy(f, r); err != nil {
-				return nil, fmt.Errorf("rpm: error reading sqlite db: %w", err)
-			}
-			if err := f.Sync(); err != nil {
-				return nil, fmt.Errorf("rpm: error reading sqlite db: %w", err)
-			}
-			sdb, err := sqlite.Open(f.Name())
-			if err != nil {
-				return nil, fmt.Errorf("rpm: error reading sqlite db: %w", err)
-			}
-			defer sdb.Close()
-			nat = sdb
-		case kindBDB:
-			f, err := sys.Open(path.Join(db.Path, `Packages`))
-			if err != nil {
-				return nil, fmt.Errorf("rpm: error reading bdb db: %w", err)
-			}
-			defer f.Close()
-			r, done, err := mkAt(ctx, db.Kind, f)
-			if err != nil {
-				return nil, fmt.Errorf("rpm: error reading bdb db: %w", err)
-			}
-			defer done()
-			var bpdb bdb.PackageDB
-			if err := bpdb.Parse(r); err != nil {
-				return nil, fmt.Errorf("rpm: error parsing bdb db: %w", err)
-			}
-			nat = &bpdb
-		case kindNDB:
-			f, err := sys.Open(path.Join(db.Path, `Packages.db`))
-			if err != nil {
-				return nil, fmt.Errorf("rpm: error reading ndb db: %w", err)
-			}
-			defer f.Close()
-			r, done, err := mkAt(ctx, db.Kind, f)
-			if err != nil {
-				return nil, fmt.Errorf("rpm: error reading ndb db: %w", err)
-			}
-			defer done()
-			var npdb ndb.PackageDB
-			if err := npdb.Parse(r); err != nil {
-				return nil, fmt.Errorf("rpm: error parsing ndb db: %w", err)
-			}
-			nat = &npdb
-		default:
-			panic("programmer error: bad kind: " + db.Kind.String())
-		}
-		if err := nat.Validate(ctx); err != nil {
-			zlog.Warn(ctx).
-				Err(err).
-				Msg("rpm: invalid native DB")
-			continue
-		}
-		ps, err := packagesFromDB(ctx, db.String(), nat)
+		ps, err := getDBObjects(ctx, sys, db, packagesFromDB)
 		if err != nil {
-			return nil, fmt.Errorf("rpm: error reading native db: %w", err)
+			return nil, err
 		}
 		pkgs = append(pkgs, ps...)
 	}
 
 	return pkgs, nil
 }
-
-func findDBs(ctx context.Context, out *[]foundDB, sys fs.FS) fs.WalkDirFunc {
-	return func(p string, d fs.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		if d.IsDir() {
-			return nil
-		}
-
-		dir, n := path.Split(p)
-		dir = path.Clean(dir)
-		switch n {
-		case `Packages`:
-			f, err := sys.Open(p)
-			if err != nil {
-				return err
-			}
-			ok := bdb.CheckMagic(ctx, f)
-			f.Close()
-			if !ok {
-				return nil
-			}
-			*out = append(*out, foundDB{
-				Path: dir,
-				Kind: kindBDB,
-			})
-		case `rpmdb.sqlite`:
-			*out = append(*out, foundDB{
-				Path: dir,
-				Kind: kindSQLite,
-			})
-		case `Packages.db`:
-			f, err := sys.Open(p)
-			if err != nil {
-				return err
-			}
-			ok := ndb.CheckMagic(ctx, f)
-			f.Close()
-			if !ok {
-				return nil
-			}
-			*out = append(*out, foundDB{
-				Path: dir,
-				Kind: kindNDB,
-			})
-		}
-		return nil
-	}
-}
-
-func mkAt(ctx context.Context, k dbKind, f fs.File) (io.ReaderAt, func(), error) {
-	if r, ok := f.(io.ReaderAt); ok {
-		return r, func() {}, nil
-	}
-	spool, err := os.CreateTemp(os.TempDir(), `Packages.`+k.String()+`.`)
-	if err != nil {
-		return nil, nil, fmt.Errorf("rpm: error spooling db: %w", err)
-	}
-	ctx = zlog.ContextWithValues(ctx, "file", spool.Name())
-	if err := os.Remove(spool.Name()); err != nil {
-		zlog.Error(ctx).Err(err).Msg("unable to remove spool; file leaked!")
-	}
-	zlog.Debug(ctx).
-		Msg("copying db out of fs.FS")
-	if _, err := io.Copy(spool, f); err != nil {
-		if err := spool.Close(); err != nil {
-			zlog.Warn(ctx).Err(err).Msg("unable to close spool")
-		}
-		return nil, nil, fmt.Errorf("rpm: error spooling db: %w", err)
-	}
-	return spool, closeSpool(ctx, spool), nil
-}
-
-func closeSpool(ctx context.Context, f *os.File) func() {
-	return func() {
-		if err := f.Close(); err != nil {
-			zlog.Warn(ctx).Err(err).Msg("unable to close spool")
-		}
-	}
-}
-
-type dbKind uint
-
-//go:generate -command stringer go run golang.org/x/tools/cmd/stringer
-//go:generate stringer -linecomment -type dbKind
-
-const (
-	_ dbKind = iota
-
-	kindBDB    // bdb
-	kindSQLite // sqlite
-	kindNDB    // ndb
-)
-
-type foundDB struct {
-	Path string
-	Kind dbKind
-}
-
-func (f foundDB) String() string {
-	return f.Kind.String() + ":" + f.Path
-}
diff --git a/rpm/testdata/Info.Files.BDB.txtar b/rpm/testdata/Info.Files.BDB.txtar
index 6c23f3f56..36a9972ea 100644
--- a/rpm/testdata/Info.Files.BDB.txtar
+++ b/rpm/testdata/Info.Files.BDB.txtar
@@ -1,627 +1,773 @@
 bdb/testdata/ubi8.Packages
 -- want.json --
 {
-	"acl": [
-		"usr/bin/chacl",
-		"usr/bin/getfacl",
-		"usr/bin/setfacl"
-	],
-	"audit-libs": null,
-	"basesystem": null,
-	"bash": [
-		"usr/bin/alias",
-		"usr/bin/bash",
-		"usr/bin/bashbug",
-		"usr/bin/bashbug-64",
-		"usr/bin/bg",
-		"usr/bin/cd",
-		"usr/bin/command",
-		"usr/bin/fc",
-		"usr/bin/fg",
-		"usr/bin/getopts",
-		"usr/bin/hash",
-		"usr/bin/jobs",
-		"usr/bin/read",
-		"usr/bin/sh",
-		"usr/bin/type",
-		"usr/bin/ulimit",
-		"usr/bin/umask",
-		"usr/bin/unalias",
-		"usr/bin/wait"
-	],
-	"brotli": [
-		"usr/bin/brotli"
-	],
-	"bzip2-libs": null,
-	"ca-certificates": [
-		"usr/bin/ca-legacy",
-		"usr/bin/update-ca-trust"
-	],
-	"chkconfig": null,
-	"coreutils-single": [
-		"usr/bin/[",
-		"usr/bin/arch",
-		"usr/bin/b2sum",
-		"usr/bin/base32",
-		"usr/bin/base64",
-		"usr/bin/basename",
-		"usr/bin/cat",
-		"usr/bin/chcon",
-		"usr/bin/chgrp",
-		"usr/bin/chmod",
-		"usr/bin/chown",
-		"usr/bin/cksum",
-		"usr/bin/comm",
-		"usr/bin/coreutils",
-		"usr/bin/cp",
-		"usr/bin/csplit",
-		"usr/bin/cut",
-		"usr/bin/date",
-		"usr/bin/dd",
-		"usr/bin/df",
-		"usr/bin/dir",
-		"usr/bin/dircolors",
-		"usr/bin/dirname",
-		"usr/bin/du",
-		"usr/bin/echo",
-		"usr/bin/env",
-		"usr/bin/expand",
-		"usr/bin/expr",
-		"usr/bin/factor",
-		"usr/bin/false",
-		"usr/bin/fmt",
-		"usr/bin/fold",
-		"usr/bin/groups",
-		"usr/bin/head",
-		"usr/bin/hostid",
-		"usr/bin/id",
-		"usr/bin/install",
-		"usr/bin/join",
-		"usr/bin/link",
-		"usr/bin/ln",
-		"usr/bin/logname",
-		"usr/bin/ls",
-		"usr/bin/md5sum",
-		"usr/bin/mkdir",
-		"usr/bin/mkfifo",
-		"usr/bin/mknod",
-		"usr/bin/mktemp",
-		"usr/bin/mv",
-		"usr/bin/nice",
-		"usr/bin/nl",
-		"usr/bin/nohup",
-		"usr/bin/nproc",
-		"usr/bin/numfmt",
-		"usr/bin/od",
-		"usr/bin/paste",
-		"usr/bin/pathchk",
-		"usr/bin/pinky",
-		"usr/bin/pr",
-		"usr/bin/printenv",
-		"usr/bin/printf",
-		"usr/bin/ptx",
-		"usr/bin/pwd",
-		"usr/bin/readlink",
-		"usr/bin/realpath",
-		"usr/bin/rm",
-		"usr/bin/rmdir",
-		"usr/bin/runcon",
-		"usr/bin/seq",
-		"usr/bin/sha1sum",
-		"usr/bin/sha224sum",
-		"usr/bin/sha256sum",
-		"usr/bin/sha384sum",
-		"usr/bin/sha512sum",
-		"usr/bin/shred",
-		"usr/bin/shuf",
-		"usr/bin/sleep",
-		"usr/bin/sort",
-		"usr/bin/split",
-		"usr/bin/stat",
-		"usr/bin/stdbuf",
-		"usr/bin/stty",
-		"usr/bin/sum",
-		"usr/bin/sync",
-		"usr/bin/tac",
-		"usr/bin/tail",
-		"usr/bin/tee",
-		"usr/bin/test",
-		"usr/bin/timeout",
-		"usr/bin/touch",
-		"usr/bin/tr",
-		"usr/bin/true",
-		"usr/bin/truncate",
-		"usr/bin/tsort",
-		"usr/bin/tty",
-		"usr/bin/uname",
-		"usr/bin/unexpand",
-		"usr/bin/uniq",
-		"usr/bin/unlink",
-		"usr/bin/users",
-		"usr/bin/vdir",
-		"usr/bin/wc",
-		"usr/bin/who",
-		"usr/bin/whoami",
-		"usr/bin/yes"
-	],
-	"cracklib": null,
-	"cracklib-dicts": null,
-	"crypto-policies": null,
-	"crypto-policies-scripts": [
-		"usr/bin/fips-finish-install",
-		"usr/bin/fips-mode-setup",
-		"usr/bin/update-crypto-policies"
-	],
-	"cryptsetup-libs": null,
-	"curl": [
-		"usr/bin/curl"
-	],
-	"cyrus-sasl-lib": null,
-	"dbus": null,
-	"dbus-common": null,
-	"dbus-daemon": [
-		"usr/bin/dbus-cleanup-sockets",
-		"usr/bin/dbus-daemon",
-		"usr/bin/dbus-run-session",
-		"usr/bin/dbus-test-tool"
-	],
-	"dbus-glib": [
-		"usr/bin/dbus-binding-tool"
-	],
-	"dbus-libs": null,
-	"dbus-tools": [
-		"usr/bin/dbus-monitor",
-		"usr/bin/dbus-send",
-		"usr/bin/dbus-update-activation-environment",
-		"usr/bin/dbus-uuidgen"
-	],
-	"device-mapper": null,
-	"device-mapper-libs": null,
-	"dmidecode": null,
-	"dnf": [
-		"usr/bin/dnf"
-	],
-	"dnf-data": null,
-	"dnf-plugin-subscription-manager": null,
-	"elfutils-default-yama-scope": null,
-	"elfutils-libelf": null,
-	"elfutils-libs": null,
-	"expat": [
-		"usr/bin/xmlwf"
-	],
-	"file-libs": null,
-	"filesystem": null,
-	"findutils": [
-		"usr/bin/find",
-		"usr/bin/xargs"
-	],
-	"gawk": [
-		"usr/bin/awk",
-		"usr/bin/gawk"
-	],
-	"gdb-gdbserver": [
-		"usr/bin/gdbserver"
-	],
-	"gdbm": [
-		"usr/bin/gdbm_dump",
-		"usr/bin/gdbm_load",
-		"usr/bin/gdbmtool"
-	],
-	"gdbm-libs": null,
-	"glib2": [
-		"usr/bin/gapplication",
-		"usr/bin/gdbus",
-		"usr/bin/gio",
-		"usr/bin/gio-querymodules-64",
-		"usr/bin/glib-compile-schemas",
-		"usr/bin/gsettings"
-	],
-	"glibc": null,
-	"glibc-common": [
-		"usr/bin/catchsegv",
-		"usr/bin/gencat",
-		"usr/bin/getconf",
-		"usr/bin/getent",
-		"usr/bin/iconv",
-		"usr/bin/ld.so",
-		"usr/bin/ldd",
-		"usr/bin/locale",
-		"usr/bin/localedef",
-		"usr/bin/makedb",
-		"usr/bin/pldd",
-		"usr/bin/sotruss",
-		"usr/bin/sprof",
-		"usr/bin/tzselect"
-	],
-	"glibc-minimal-langpack": null,
-	"gmp": null,
-	"gnupg2": [
-		"usr/bin/dirmngr",
-		"usr/bin/dirmngr-client",
-		"usr/bin/g13",
-		"usr/bin/gpg",
-		"usr/bin/gpg-agent",
-		"usr/bin/gpg-connect-agent",
-		"usr/bin/gpg-wks-server",
-		"usr/bin/gpg-zip",
-		"usr/bin/gpg2",
-		"usr/bin/gpgconf",
-		"usr/bin/gpgparsemail",
-		"usr/bin/gpgsplit",
-		"usr/bin/gpgv",
-		"usr/bin/gpgv2",
-		"usr/bin/watchgnupg"
-	],
-	"gnutls": null,
-	"gobject-introspection": null,
-	"gpgme": [
-		"usr/bin/gpgme-json"
-	],
-	"grep": [
-		"usr/bin/egrep",
-		"usr/bin/fgrep",
-		"usr/bin/grep"
-	],
-	"gzip": [
-		"usr/bin/gunzip",
-		"usr/bin/gzexe",
-		"usr/bin/gzip",
-		"usr/bin/zcat",
-		"usr/bin/zcmp",
-		"usr/bin/zdiff",
-		"usr/bin/zegrep",
-		"usr/bin/zfgrep",
-		"usr/bin/zforce",
-		"usr/bin/zgrep",
-		"usr/bin/zless",
-		"usr/bin/zmore",
-		"usr/bin/znew"
-	],
-	"ima-evm-utils": [
-		"usr/bin/evmctl"
-	],
-	"info": [
-		"usr/bin/info"
-	],
-	"json-c": null,
-	"json-glib": null,
-	"keyutils-libs": null,
-	"kmod-libs": null,
-	"krb5-libs": null,
-	"langpacks-en": null,
-	"libacl": null,
-	"libarchive": null,
-	"libassuan": null,
-	"libattr": null,
-	"libblkid": null,
-	"libcap": null,
-	"libcap-ng": null,
-	"libcom_err": null,
-	"libcomps": null,
-	"libcurl": null,
-	"libdb": null,
-	"libdb-utils": [
-		"usr/bin/db_archive",
-		"usr/bin/db_checkpoint",
-		"usr/bin/db_deadlock",
-		"usr/bin/db_dump",
-		"usr/bin/db_dump185",
-		"usr/bin/db_hotbackup",
-		"usr/bin/db_load",
-		"usr/bin/db_log_verify",
-		"usr/bin/db_printlog",
-		"usr/bin/db_recover",
-		"usr/bin/db_replicate",
-		"usr/bin/db_stat",
-		"usr/bin/db_tuner",
-		"usr/bin/db_upgrade",
-		"usr/bin/db_verify"
-	],
-	"libdnf": null,
-	"libfdisk": null,
-	"libffi": null,
-	"libgcc": null,
-	"libgcrypt": null,
-	"libgpg-error": [
-		"usr/bin/gpg-error"
-	],
-	"libidn2": null,
-	"libksba": null,
-	"libmodulemd": [
-		"usr/bin/modulemd-validator"
-	],
-	"libmount": null,
-	"libnghttp2": null,
-	"libnl3": null,
-	"libnsl2": null,
-	"libpsl": null,
-	"libpwquality": [
-		"usr/bin/pwmake",
-		"usr/bin/pwscore"
-	],
-	"librepo": null,
-	"libreport-filesystem": null,
-	"librhsm": null,
-	"libseccomp": null,
-	"libselinux": null,
-	"libsemanage": null,
-	"libsepol": null,
-	"libsigsegv": null,
-	"libsmartcols": null,
-	"libsolv": null,
-	"libssh": null,
-	"libssh-config": null,
-	"libstdc++": null,
-	"libtasn1": null,
-	"libtirpc": null,
-	"libunistring": null,
-	"libusbx": null,
-	"libuser": [
-		"usr/bin/lchfn",
-		"usr/bin/lchsh"
-	],
-	"libutempter": null,
-	"libuuid": null,
-	"libverto": null,
-	"libxcrypt": null,
-	"libxml2": [
-		"usr/bin/xmlcatalog",
-		"usr/bin/xmllint"
-	],
-	"libyaml": null,
-	"libzstd": null,
-	"lua-libs": null,
-	"lz4-libs": null,
-	"mpfr": null,
-	"ncurses-base": null,
-	"ncurses-libs": null,
-	"nettle": null,
-	"npth": null,
-	"openldap": null,
-	"openssl-libs": null,
-	"p11-kit": [
-		"usr/bin/p11-kit"
-	],
-	"p11-kit-trust": [
-		"usr/bin/trust"
-	],
-	"pam": null,
-	"passwd": [
-		"usr/bin/passwd"
-	],
-	"pcre": null,
-	"pcre2": null,
-	"platform-python": [
-		"usr/bin/pydoc3.6",
-		"usr/bin/pyvenv-3.6",
-		"usr/bin/unversioned-python"
-	],
-	"platform-python-setuptools": null,
-	"popt": null,
-	"publicsuffix-list-dafsa": null,
-	"python3-chardet": [
-		"usr/bin/chardetect",
-		"usr/lib/python3.6/site-packages/chardet-3.0.4-py3.6.egg-info/PKG-INFO"
-	],
-	"python3-cloud-what": null,
-	"python3-dateutil": [
-		"usr/lib/python3.6/site-packages/python_dateutil-2.6.1-py3.6.egg-info/PKG-INFO"
-	],
-	"python3-dbus": [
-		"usr/lib64/python3.6/site-packages/dbus_python-1.2.4-py3.6.egg-info/PKG-INFO"
-	],
-	"python3-decorator": [
-		"usr/lib/python3.6/site-packages/decorator-4.2.1-py3.6.egg-info/PKG-INFO"
-	],
-	"python3-dmidecode": null,
-	"python3-dnf": [
-		"usr/bin/dnf-3"
-	],
-	"python3-dnf-plugins-core": null,
-	"python3-ethtool": [
-		"usr/lib64/python3.6/site-packages/ethtool-0.14-py3.6.egg-info/PKG-INFO"
-	],
-	"python3-gobject-base": null,
-	"python3-gpg": null,
-	"python3-hawkey": null,
-	"python3-idna": [
-		"usr/lib/python3.6/site-packages/idna-2.5-py3.6.egg-info/PKG-INFO"
-	],
-	"python3-iniparse": [
-		"usr/lib/python3.6/site-packages/iniparse-0.4-py3.6.egg-info/PKG-INFO"
-	],
-	"python3-inotify": [
-		"usr/bin/pyinotify",
-		"usr/lib/python3.6/site-packages/pyinotify-0.9.6-py3.6.egg-info/PKG-INFO"
-	],
-	"python3-libcomps": [
-		"usr/lib64/python3.6/site-packages/libcomps-0.1.18-py3.6.egg-info/PKG-INFO"
-	],
-	"python3-libdnf": null,
-	"python3-librepo": null,
-	"python3-libs": null,
-	"python3-libxml2": null,
-	"python3-pip-wheel": null,
-	"python3-pysocks": [
-		"usr/lib/python3.6/site-packages/PySocks-1.6.8-py3.6.egg-info/PKG-INFO"
-	],
-	"python3-requests": [
-		"usr/lib/python3.6/site-packages/requests-2.20.0-py3.6.egg-info/PKG-INFO"
-	],
-	"python3-rpm": null,
-	"python3-setuptools-wheel": null,
-	"python3-six": null,
-	"python3-subscription-manager-rhsm": null,
-	"python3-syspurpose": [
-		"usr/lib/python3.6/site-packages/syspurpose-1.28.29-py3.6.egg-info/PKG-INFO"
-	],
-	"python3-urllib3": [
-		"usr/lib/python3.6/site-packages/urllib3-1.24.2-py3.6.egg-info/PKG-INFO"
-	],
-	"readline": null,
-	"redhat-release": null,
-	"rootfiles": null,
-	"rpm": [
-		"usr/bin/rpm",
-		"usr/bin/rpm2archive",
-		"usr/bin/rpm2cpio",
-		"usr/bin/rpmdb",
-		"usr/bin/rpmkeys",
-		"usr/bin/rpmquery",
-		"usr/bin/rpmverify"
-	],
-	"rpm-build-libs": null,
-	"rpm-libs": null,
-	"sed": [
-		"usr/bin/sed"
-	],
-	"setup": null,
-	"shadow-utils": [
-		"usr/bin/chage",
-		"usr/bin/gpasswd",
-		"usr/bin/lastlog",
-		"usr/bin/newgidmap",
-		"usr/bin/newgrp",
-		"usr/bin/newuidmap",
-		"usr/bin/sg"
-	],
-	"sqlite-libs": null,
-	"subscription-manager": [
-		"usr/bin/rct",
-		"usr/bin/rhsm-debug",
-		"usr/bin/rhsmcertd",
-		"usr/bin/subscription-manager",
-		"usr/lib64/python3.6/site-packages/subscription_manager-1.28.29-py3.6.egg-info/PKG-INFO"
-	],
-	"subscription-manager-rhsm-certificates": null,
-	"systemd": [
-		"usr/bin/busctl",
-		"usr/bin/coredumpctl",
-		"usr/bin/hostnamectl",
-		"usr/bin/journalctl",
-		"usr/bin/localectl",
-		"usr/bin/loginctl",
-		"usr/bin/resolvectl",
-		"usr/bin/systemctl",
-		"usr/bin/systemd-analyze",
-		"usr/bin/systemd-ask-password",
-		"usr/bin/systemd-cat",
-		"usr/bin/systemd-cgls",
-		"usr/bin/systemd-cgtop",
-		"usr/bin/systemd-delta",
-		"usr/bin/systemd-detect-virt",
-		"usr/bin/systemd-escape",
-		"usr/bin/systemd-firstboot",
-		"usr/bin/systemd-inhibit",
-		"usr/bin/systemd-machine-id-setup",
-		"usr/bin/systemd-mount",
-		"usr/bin/systemd-notify",
-		"usr/bin/systemd-path",
-		"usr/bin/systemd-resolve",
-		"usr/bin/systemd-run",
-		"usr/bin/systemd-socket-activate",
-		"usr/bin/systemd-stdio-bridge",
-		"usr/bin/systemd-sysusers",
-		"usr/bin/systemd-tmpfiles",
-		"usr/bin/systemd-tty-ask-password-agent",
-		"usr/bin/systemd-umount",
-		"usr/bin/timedatectl"
-	],
-	"systemd-libs": null,
-	"systemd-pam": null,
-	"tar": [
-		"usr/bin/gtar",
-		"usr/bin/tar"
-	],
-	"tpm2-tss": null,
-	"tzdata": null,
-	"usermode": [
-		"usr/bin/consolehelper"
-	],
-	"util-linux": [
-		"usr/bin/cal",
-		"usr/bin/chmem",
-		"usr/bin/chrt",
-		"usr/bin/col",
-		"usr/bin/colcrt",
-		"usr/bin/colrm",
-		"usr/bin/column",
-		"usr/bin/dmesg",
-		"usr/bin/eject",
-		"usr/bin/fallocate",
-		"usr/bin/fincore",
-		"usr/bin/findmnt",
-		"usr/bin/flock",
-		"usr/bin/getopt",
-		"usr/bin/hexdump",
-		"usr/bin/i386",
-		"usr/bin/ionice",
-		"usr/bin/ipcmk",
-		"usr/bin/ipcrm",
-		"usr/bin/ipcs",
-		"usr/bin/isosize",
-		"usr/bin/kill",
-		"usr/bin/last",
-		"usr/bin/lastb",
-		"usr/bin/linux32",
-		"usr/bin/linux64",
-		"usr/bin/logger",
-		"usr/bin/login",
-		"usr/bin/look",
-		"usr/bin/lsblk",
-		"usr/bin/lscpu",
-		"usr/bin/lsipc",
-		"usr/bin/lslocks",
-		"usr/bin/lslogins",
-		"usr/bin/lsmem",
-		"usr/bin/lsns",
-		"usr/bin/mcookie",
-		"usr/bin/mesg",
-		"usr/bin/more",
-		"usr/bin/mount",
-		"usr/bin/mountpoint",
-		"usr/bin/namei",
-		"usr/bin/nsenter",
-		"usr/bin/prlimit",
-		"usr/bin/raw",
-		"usr/bin/rename",
-		"usr/bin/renice",
-		"usr/bin/rev",
-		"usr/bin/script",
-		"usr/bin/scriptreplay",
-		"usr/bin/setarch",
-		"usr/bin/setpriv",
-		"usr/bin/setsid",
-		"usr/bin/setterm",
-		"usr/bin/su",
-		"usr/bin/taskset",
-		"usr/bin/ul",
-		"usr/bin/umount",
-		"usr/bin/uname26",
-		"usr/bin/unshare",
-		"usr/bin/utmpdump",
-		"usr/bin/uuidgen",
-		"usr/bin/uuidparse",
-		"usr/bin/wall",
-		"usr/bin/wdctl",
-		"usr/bin/whereis",
-		"usr/bin/write",
-		"usr/bin/x86_64"
-	],
-	"vim-minimal": [
-		"usr/bin/ex",
-		"usr/bin/rvi",
-		"usr/bin/rview",
-		"usr/bin/vi",
-		"usr/bin/view"
-	],
-	"virt-what": null,
-	"which": [
-		"usr/bin/which"
-	],
-	"xz-libs": null,
-	"yum": [
-		"usr/bin/yum"
-	],
-	"zlib": null
+  "acl": [
+    "usr/bin/chacl",
+    "usr/bin/getfacl",
+    "usr/bin/setfacl"
+  ],
+  "audit-libs": null,
+  "basesystem": null,
+  "bash": [
+    "usr/bin/alias",
+    "usr/bin/bash",
+    "usr/bin/bashbug",
+    "usr/bin/bashbug-64",
+    "usr/bin/bg",
+    "usr/bin/cd",
+    "usr/bin/command",
+    "usr/bin/fc",
+    "usr/bin/fg",
+    "usr/bin/getopts",
+    "usr/bin/hash",
+    "usr/bin/jobs",
+    "usr/bin/read",
+    "usr/bin/sh",
+    "usr/bin/type",
+    "usr/bin/ulimit",
+    "usr/bin/umask",
+    "usr/bin/unalias",
+    "usr/bin/wait"
+  ],
+  "brotli": [
+    "usr/bin/brotli"
+  ],
+  "bzip2-libs": null,
+  "ca-certificates": [
+    "usr/bin/ca-legacy",
+    "usr/bin/update-ca-trust"
+  ],
+  "chkconfig": [
+    "usr/sbin/alternatives",
+    "usr/sbin/chkconfig",
+    "usr/sbin/update-alternatives"
+  ],
+  "coreutils-single": [
+    "usr/bin/[",
+    "usr/bin/arch",
+    "usr/bin/b2sum",
+    "usr/bin/base32",
+    "usr/bin/base64",
+    "usr/bin/basename",
+    "usr/bin/cat",
+    "usr/bin/chcon",
+    "usr/bin/chgrp",
+    "usr/bin/chmod",
+    "usr/bin/chown",
+    "usr/bin/cksum",
+    "usr/bin/comm",
+    "usr/bin/coreutils",
+    "usr/bin/cp",
+    "usr/bin/csplit",
+    "usr/bin/cut",
+    "usr/bin/date",
+    "usr/bin/dd",
+    "usr/bin/df",
+    "usr/bin/dir",
+    "usr/bin/dircolors",
+    "usr/bin/dirname",
+    "usr/bin/du",
+    "usr/bin/echo",
+    "usr/bin/env",
+    "usr/bin/expand",
+    "usr/bin/expr",
+    "usr/bin/factor",
+    "usr/bin/false",
+    "usr/bin/fmt",
+    "usr/bin/fold",
+    "usr/bin/groups",
+    "usr/bin/head",
+    "usr/bin/hostid",
+    "usr/bin/id",
+    "usr/bin/install",
+    "usr/bin/join",
+    "usr/bin/link",
+    "usr/bin/ln",
+    "usr/bin/logname",
+    "usr/bin/ls",
+    "usr/bin/md5sum",
+    "usr/bin/mkdir",
+    "usr/bin/mkfifo",
+    "usr/bin/mknod",
+    "usr/bin/mktemp",
+    "usr/bin/mv",
+    "usr/bin/nice",
+    "usr/bin/nl",
+    "usr/bin/nohup",
+    "usr/bin/nproc",
+    "usr/bin/numfmt",
+    "usr/bin/od",
+    "usr/bin/paste",
+    "usr/bin/pathchk",
+    "usr/bin/pinky",
+    "usr/bin/pr",
+    "usr/bin/printenv",
+    "usr/bin/printf",
+    "usr/bin/ptx",
+    "usr/bin/pwd",
+    "usr/bin/readlink",
+    "usr/bin/realpath",
+    "usr/bin/rm",
+    "usr/bin/rmdir",
+    "usr/bin/runcon",
+    "usr/bin/seq",
+    "usr/bin/sha1sum",
+    "usr/bin/sha224sum",
+    "usr/bin/sha256sum",
+    "usr/bin/sha384sum",
+    "usr/bin/sha512sum",
+    "usr/bin/shred",
+    "usr/bin/shuf",
+    "usr/bin/sleep",
+    "usr/bin/sort",
+    "usr/bin/split",
+    "usr/bin/stat",
+    "usr/bin/stdbuf",
+    "usr/bin/stty",
+    "usr/bin/sum",
+    "usr/bin/sync",
+    "usr/bin/tac",
+    "usr/bin/tail",
+    "usr/bin/tee",
+    "usr/bin/test",
+    "usr/bin/timeout",
+    "usr/bin/touch",
+    "usr/bin/tr",
+    "usr/bin/true",
+    "usr/bin/truncate",
+    "usr/bin/tsort",
+    "usr/bin/tty",
+    "usr/bin/uname",
+    "usr/bin/unexpand",
+    "usr/bin/uniq",
+    "usr/bin/unlink",
+    "usr/bin/users",
+    "usr/bin/vdir",
+    "usr/bin/wc",
+    "usr/bin/who",
+    "usr/bin/whoami",
+    "usr/bin/yes",
+    "usr/libexec/coreutils/libstdbuf.so",
+    "usr/sbin/chroot"
+  ],
+  "cracklib": [
+    "usr/sbin/cracklib-check",
+    "usr/sbin/cracklib-format",
+    "usr/sbin/cracklib-packer",
+    "usr/sbin/cracklib-unpacker",
+    "usr/sbin/create-cracklib-dict"
+  ],
+  "cracklib-dicts": [
+    "usr/sbin/mkdict",
+    "usr/sbin/packer"
+  ],
+  "crypto-policies": null,
+  "crypto-policies-scripts": [
+    "usr/bin/fips-finish-install",
+    "usr/bin/fips-mode-setup",
+    "usr/bin/update-crypto-policies"
+  ],
+  "cryptsetup-libs": null,
+  "curl": [
+    "usr/bin/curl"
+  ],
+  "cyrus-sasl-lib": [
+    "usr/sbin/sasldblistusers2",
+    "usr/sbin/saslpasswd2"
+  ],
+  "dbus": null,
+  "dbus-common": null,
+  "dbus-daemon": [
+    "usr/bin/dbus-cleanup-sockets",
+    "usr/bin/dbus-daemon",
+    "usr/bin/dbus-run-session",
+    "usr/bin/dbus-test-tool",
+    "usr/libexec/dbus-1/dbus-daemon-launch-helper"
+  ],
+  "dbus-glib": [
+    "usr/bin/dbus-binding-tool"
+  ],
+  "dbus-libs": null,
+  "dbus-tools": [
+    "usr/bin/dbus-monitor",
+    "usr/bin/dbus-send",
+    "usr/bin/dbus-update-activation-environment",
+    "usr/bin/dbus-uuidgen"
+  ],
+  "device-mapper": [
+    "usr/sbin/blkdeactivate",
+    "usr/sbin/dmfilemapd",
+    "usr/sbin/dmsetup",
+    "usr/sbin/dmstats"
+  ],
+  "device-mapper-libs": null,
+  "dmidecode": [
+    "usr/sbin/biosdecode",
+    "usr/sbin/dmidecode",
+    "usr/sbin/ownership",
+    "usr/sbin/vpddecode"
+  ],
+  "dnf": [
+    "usr/bin/dnf"
+  ],
+  "dnf-data": null,
+  "dnf-plugin-subscription-manager": null,
+  "elfutils-default-yama-scope": null,
+  "elfutils-libelf": null,
+  "elfutils-libs": null,
+  "expat": [
+    "usr/bin/xmlwf"
+  ],
+  "file-libs": null,
+  "filesystem": null,
+  "findutils": [
+    "usr/bin/find",
+    "usr/bin/xargs"
+  ],
+  "gawk": [
+    "usr/bin/awk",
+    "usr/bin/gawk",
+    "usr/libexec/awk/grcat",
+    "usr/libexec/awk/pwcat"
+  ],
+  "gdb-gdbserver": [
+    "usr/bin/gdbserver"
+  ],
+  "gdbm": [
+    "usr/bin/gdbm_dump",
+    "usr/bin/gdbm_load",
+    "usr/bin/gdbmtool"
+  ],
+  "gdbm-libs": null,
+  "glib2": [
+    "usr/bin/gapplication",
+    "usr/bin/gdbus",
+    "usr/bin/gio",
+    "usr/bin/gio-querymodules-64",
+    "usr/bin/glib-compile-schemas",
+    "usr/bin/gsettings"
+  ],
+  "glibc": [
+    "usr/libexec/getconf/POSIX_V6_LP64_OFF64",
+    "usr/libexec/getconf/POSIX_V7_LP64_OFF64",
+    "usr/libexec/getconf/XBS5_LP64_OFF64",
+    "usr/sbin/iconvconfig"
+  ],
+  "glibc-common": [
+    "usr/bin/catchsegv",
+    "usr/bin/gencat",
+    "usr/bin/getconf",
+    "usr/bin/getent",
+    "usr/bin/iconv",
+    "usr/bin/ld.so",
+    "usr/bin/ldd",
+    "usr/bin/locale",
+    "usr/bin/localedef",
+    "usr/bin/makedb",
+    "usr/bin/pldd",
+    "usr/bin/sotruss",
+    "usr/bin/sprof",
+    "usr/bin/tzselect",
+    "usr/sbin/build-locale-archive",
+    "usr/sbin/zdump",
+    "usr/sbin/zic"
+  ],
+  "glibc-minimal-langpack": null,
+  "gmp": null,
+  "gnupg2": [
+    "usr/bin/dirmngr",
+    "usr/bin/dirmngr-client",
+    "usr/bin/g13",
+    "usr/bin/gpg",
+    "usr/bin/gpg-agent",
+    "usr/bin/gpg-connect-agent",
+    "usr/bin/gpg-wks-server",
+    "usr/bin/gpg-zip",
+    "usr/bin/gpg2",
+    "usr/bin/gpgconf",
+    "usr/bin/gpgparsemail",
+    "usr/bin/gpgsplit",
+    "usr/bin/gpgv",
+    "usr/bin/gpgv2",
+    "usr/bin/watchgnupg",
+    "usr/sbin/addgnupghome",
+    "usr/sbin/applygnupgdefaults",
+    "usr/sbin/g13-syshelp"
+  ],
+  "gnutls": null,
+  "gobject-introspection": null,
+  "gpgme": [
+    "usr/bin/gpgme-json"
+  ],
+  "grep": [
+    "usr/bin/egrep",
+    "usr/bin/fgrep",
+    "usr/bin/grep"
+  ],
+  "gzip": [
+    "usr/bin/gunzip",
+    "usr/bin/gzexe",
+    "usr/bin/gzip",
+    "usr/bin/zcat",
+    "usr/bin/zcmp",
+    "usr/bin/zdiff",
+    "usr/bin/zegrep",
+    "usr/bin/zfgrep",
+    "usr/bin/zforce",
+    "usr/bin/zgrep",
+    "usr/bin/zless",
+    "usr/bin/zmore",
+    "usr/bin/znew"
+  ],
+  "ima-evm-utils": [
+    "usr/bin/evmctl"
+  ],
+  "info": [
+    "usr/bin/info",
+    "usr/sbin/fix-info-dir"
+  ],
+  "json-c": null,
+  "json-glib": null,
+  "keyutils-libs": null,
+  "kmod-libs": null,
+  "krb5-libs": null,
+  "langpacks-en": null,
+  "libacl": null,
+  "libarchive": null,
+  "libassuan": null,
+  "libattr": null,
+  "libblkid": null,
+  "libcap": [
+    "usr/sbin/capsh",
+    "usr/sbin/getcap",
+    "usr/sbin/getpcaps",
+    "usr/sbin/setcap"
+  ],
+  "libcap-ng": null,
+  "libcom_err": null,
+  "libcomps": null,
+  "libcurl": null,
+  "libdb": null,
+  "libdb-utils": [
+    "usr/bin/db_archive",
+    "usr/bin/db_checkpoint",
+    "usr/bin/db_deadlock",
+    "usr/bin/db_dump",
+    "usr/bin/db_dump185",
+    "usr/bin/db_hotbackup",
+    "usr/bin/db_load",
+    "usr/bin/db_log_verify",
+    "usr/bin/db_printlog",
+    "usr/bin/db_recover",
+    "usr/bin/db_replicate",
+    "usr/bin/db_stat",
+    "usr/bin/db_tuner",
+    "usr/bin/db_upgrade",
+    "usr/bin/db_verify"
+  ],
+  "libdnf": null,
+  "libfdisk": null,
+  "libffi": null,
+  "libgcc": null,
+  "libgcrypt": null,
+  "libgpg-error": [
+    "usr/bin/gpg-error"
+  ],
+  "libidn2": null,
+  "libksba": null,
+  "libmodulemd": [
+    "usr/bin/modulemd-validator"
+  ],
+  "libmount": null,
+  "libnghttp2": null,
+  "libnl3": null,
+  "libnsl2": null,
+  "libpsl": null,
+  "libpwquality": [
+    "usr/bin/pwmake",
+    "usr/bin/pwscore"
+  ],
+  "librepo": null,
+  "libreport-filesystem": null,
+  "librhsm": null,
+  "libseccomp": null,
+  "libselinux": null,
+  "libsemanage": null,
+  "libsepol": null,
+  "libsigsegv": null,
+  "libsmartcols": null,
+  "libsolv": null,
+  "libssh": null,
+  "libssh-config": null,
+  "libstdc++": null,
+  "libtasn1": null,
+  "libtirpc": null,
+  "libunistring": null,
+  "libusbx": null,
+  "libuser": [
+    "usr/bin/lchfn",
+    "usr/bin/lchsh",
+    "usr/sbin/lchage",
+    "usr/sbin/lgroupadd",
+    "usr/sbin/lgroupdel",
+    "usr/sbin/lgroupmod",
+    "usr/sbin/lid",
+    "usr/sbin/lnewusers",
+    "usr/sbin/lpasswd",
+    "usr/sbin/luseradd",
+    "usr/sbin/luserdel",
+    "usr/sbin/lusermod"
+  ],
+  "libutempter": [
+    "usr/libexec/utempter/utempter"
+  ],
+  "libuuid": null,
+  "libverto": null,
+  "libxcrypt": null,
+  "libxml2": [
+    "usr/bin/xmlcatalog",
+    "usr/bin/xmllint"
+  ],
+  "libyaml": null,
+  "libzstd": null,
+  "lua-libs": null,
+  "lz4-libs": null,
+  "mpfr": null,
+  "ncurses-base": null,
+  "ncurses-libs": null,
+  "nettle": null,
+  "npth": null,
+  "openldap": null,
+  "openssl-libs": null,
+  "p11-kit": [
+    "usr/bin/p11-kit",
+    "usr/libexec/p11-kit/p11-kit-remote"
+  ],
+  "p11-kit-trust": [
+    "usr/bin/trust",
+    "usr/libexec/p11-kit/trust-extract-compat"
+  ],
+  "pam": [
+    "usr/sbin/faillock",
+    "usr/sbin/mkhomedir_helper",
+    "usr/sbin/pam_console_apply",
+    "usr/sbin/pam_timestamp_check",
+    "usr/sbin/pwhistory_helper",
+    "usr/sbin/unix_chkpwd",
+    "usr/sbin/unix_update"
+  ],
+  "passwd": [
+    "usr/bin/passwd"
+  ],
+  "pcre": null,
+  "pcre2": null,
+  "platform-python": [
+    "usr/bin/pydoc3.6",
+    "usr/bin/pyvenv-3.6",
+    "usr/bin/unversioned-python"
+  ],
+  "platform-python-setuptools": null,
+  "popt": null,
+  "publicsuffix-list-dafsa": null,
+  "python3-chardet": [
+    "usr/bin/chardetect",
+    "usr/lib/python3.6/site-packages/chardet-3.0.4-py3.6.egg-info/PKG-INFO"
+  ],
+  "python3-cloud-what": null,
+  "python3-dateutil": [
+    "usr/lib/python3.6/site-packages/python_dateutil-2.6.1-py3.6.egg-info/PKG-INFO"
+  ],
+  "python3-dbus": [
+    "usr/lib64/python3.6/site-packages/dbus_python-1.2.4-py3.6.egg-info/PKG-INFO"
+  ],
+  "python3-decorator": [
+    "usr/lib/python3.6/site-packages/decorator-4.2.1-py3.6.egg-info/PKG-INFO"
+  ],
+  "python3-dmidecode": null,
+  "python3-dnf": [
+    "usr/bin/dnf-3"
+  ],
+  "python3-dnf-plugins-core": null,
+  "python3-ethtool": [
+    "usr/lib64/python3.6/site-packages/ethtool-0.14-py3.6.egg-info/PKG-INFO",
+    "usr/sbin/pethtool",
+    "usr/sbin/pifconfig"
+  ],
+  "python3-gobject-base": null,
+  "python3-gpg": null,
+  "python3-hawkey": null,
+  "python3-idna": [
+    "usr/lib/python3.6/site-packages/idna-2.5-py3.6.egg-info/PKG-INFO"
+  ],
+  "python3-iniparse": [
+    "usr/lib/python3.6/site-packages/iniparse-0.4-py3.6.egg-info/PKG-INFO"
+  ],
+  "python3-inotify": [
+    "usr/bin/pyinotify",
+    "usr/lib/python3.6/site-packages/pyinotify-0.9.6-py3.6.egg-info/PKG-INFO"
+  ],
+  "python3-libcomps": [
+    "usr/lib64/python3.6/site-packages/libcomps-0.1.18-py3.6.egg-info/PKG-INFO"
+  ],
+  "python3-libdnf": null,
+  "python3-librepo": null,
+  "python3-libs": null,
+  "python3-libxml2": null,
+  "python3-pip-wheel": null,
+  "python3-pysocks": [
+    "usr/lib/python3.6/site-packages/PySocks-1.6.8-py3.6.egg-info/PKG-INFO"
+  ],
+  "python3-requests": [
+    "usr/lib/python3.6/site-packages/requests-2.20.0-py3.6.egg-info/PKG-INFO"
+  ],
+  "python3-rpm": null,
+  "python3-setuptools-wheel": null,
+  "python3-six": null,
+  "python3-subscription-manager-rhsm": null,
+  "python3-syspurpose": [
+    "usr/lib/python3.6/site-packages/syspurpose-1.28.29-py3.6.egg-info/PKG-INFO",
+    "usr/sbin/syspurpose"
+  ],
+  "python3-urllib3": [
+    "usr/lib/python3.6/site-packages/urllib3-1.24.2-py3.6.egg-info/PKG-INFO"
+  ],
+  "readline": null,
+  "redhat-release": null,
+  "rootfiles": null,
+  "rpm": [
+    "usr/bin/rpm",
+    "usr/bin/rpm2archive",
+    "usr/bin/rpm2cpio",
+    "usr/bin/rpmdb",
+    "usr/bin/rpmkeys",
+    "usr/bin/rpmquery",
+    "usr/bin/rpmverify"
+  ],
+  "rpm-build-libs": null,
+  "rpm-libs": null,
+  "sed": [
+    "usr/bin/sed"
+  ],
+  "setup": null,
+  "shadow-utils": [
+    "usr/bin/chage",
+    "usr/bin/gpasswd",
+    "usr/bin/lastlog",
+    "usr/bin/newgidmap",
+    "usr/bin/newgrp",
+    "usr/bin/newuidmap",
+    "usr/bin/sg",
+    "usr/sbin/adduser",
+    "usr/sbin/chgpasswd",
+    "usr/sbin/chpasswd",
+    "usr/sbin/groupadd",
+    "usr/sbin/groupdel",
+    "usr/sbin/groupmems",
+    "usr/sbin/groupmod",
+    "usr/sbin/grpck",
+    "usr/sbin/grpconv",
+    "usr/sbin/grpunconv",
+    "usr/sbin/newusers",
+    "usr/sbin/pwck",
+    "usr/sbin/pwconv",
+    "usr/sbin/pwunconv",
+    "usr/sbin/useradd",
+    "usr/sbin/userdel",
+    "usr/sbin/usermod",
+    "usr/sbin/vigr",
+    "usr/sbin/vipw"
+  ],
+  "sqlite-libs": null,
+  "subscription-manager": [
+    "usr/bin/rct",
+    "usr/bin/rhsm-debug",
+    "usr/bin/rhsmcertd",
+    "usr/bin/subscription-manager",
+    "usr/lib64/python3.6/site-packages/subscription_manager-1.28.29-py3.6.egg-info/PKG-INFO",
+    "usr/sbin/subscription-manager"
+  ],
+  "subscription-manager-rhsm-certificates": null,
+  "systemd": [
+    "usr/bin/busctl",
+    "usr/bin/coredumpctl",
+    "usr/bin/hostnamectl",
+    "usr/bin/journalctl",
+    "usr/bin/localectl",
+    "usr/bin/loginctl",
+    "usr/bin/resolvectl",
+    "usr/bin/systemctl",
+    "usr/bin/systemd-analyze",
+    "usr/bin/systemd-ask-password",
+    "usr/bin/systemd-cat",
+    "usr/bin/systemd-cgls",
+    "usr/bin/systemd-cgtop",
+    "usr/bin/systemd-delta",
+    "usr/bin/systemd-detect-virt",
+    "usr/bin/systemd-escape",
+    "usr/bin/systemd-firstboot",
+    "usr/bin/systemd-inhibit",
+    "usr/bin/systemd-machine-id-setup",
+    "usr/bin/systemd-mount",
+    "usr/bin/systemd-notify",
+    "usr/bin/systemd-path",
+    "usr/bin/systemd-resolve",
+    "usr/bin/systemd-run",
+    "usr/bin/systemd-socket-activate",
+    "usr/bin/systemd-stdio-bridge",
+    "usr/bin/systemd-sysusers",
+    "usr/bin/systemd-tmpfiles",
+    "usr/bin/systemd-tty-ask-password-agent",
+    "usr/bin/systemd-umount",
+    "usr/bin/timedatectl",
+    "usr/sbin/halt",
+    "usr/sbin/init",
+    "usr/sbin/poweroff",
+    "usr/sbin/reboot",
+    "usr/sbin/resolvconf",
+    "usr/sbin/runlevel",
+    "usr/sbin/shutdown",
+    "usr/sbin/telinit"
+  ],
+  "systemd-libs": null,
+  "systemd-pam": null,
+  "tar": [
+    "usr/bin/gtar",
+    "usr/bin/tar"
+  ],
+  "tpm2-tss": null,
+  "tzdata": null,
+  "usermode": [
+    "usr/bin/consolehelper",
+    "usr/sbin/userhelper"
+  ],
+  "util-linux": [
+    "usr/bin/cal",
+    "usr/bin/chmem",
+    "usr/bin/chrt",
+    "usr/bin/col",
+    "usr/bin/colcrt",
+    "usr/bin/colrm",
+    "usr/bin/column",
+    "usr/bin/dmesg",
+    "usr/bin/eject",
+    "usr/bin/fallocate",
+    "usr/bin/fincore",
+    "usr/bin/findmnt",
+    "usr/bin/flock",
+    "usr/bin/getopt",
+    "usr/bin/hexdump",
+    "usr/bin/i386",
+    "usr/bin/ionice",
+    "usr/bin/ipcmk",
+    "usr/bin/ipcrm",
+    "usr/bin/ipcs",
+    "usr/bin/isosize",
+    "usr/bin/kill",
+    "usr/bin/last",
+    "usr/bin/lastb",
+    "usr/bin/linux32",
+    "usr/bin/linux64",
+    "usr/bin/logger",
+    "usr/bin/login",
+    "usr/bin/look",
+    "usr/bin/lsblk",
+    "usr/bin/lscpu",
+    "usr/bin/lsipc",
+    "usr/bin/lslocks",
+    "usr/bin/lslogins",
+    "usr/bin/lsmem",
+    "usr/bin/lsns",
+    "usr/bin/mcookie",
+    "usr/bin/mesg",
+    "usr/bin/more",
+    "usr/bin/mount",
+    "usr/bin/mountpoint",
+    "usr/bin/namei",
+    "usr/bin/nsenter",
+    "usr/bin/prlimit",
+    "usr/bin/raw",
+    "usr/bin/rename",
+    "usr/bin/renice",
+    "usr/bin/rev",
+    "usr/bin/script",
+    "usr/bin/scriptreplay",
+    "usr/bin/setarch",
+    "usr/bin/setpriv",
+    "usr/bin/setsid",
+    "usr/bin/setterm",
+    "usr/bin/su",
+    "usr/bin/taskset",
+    "usr/bin/ul",
+    "usr/bin/umount",
+    "usr/bin/uname26",
+    "usr/bin/unshare",
+    "usr/bin/utmpdump",
+    "usr/bin/uuidgen",
+    "usr/bin/uuidparse",
+    "usr/bin/wall",
+    "usr/bin/wdctl",
+    "usr/bin/whereis",
+    "usr/bin/write",
+    "usr/bin/x86_64",
+    "usr/sbin/addpart",
+    "usr/sbin/agetty",
+    "usr/sbin/blkdiscard",
+    "usr/sbin/blkid",
+    "usr/sbin/blkzone",
+    "usr/sbin/blockdev",
+    "usr/sbin/cfdisk",
+    "usr/sbin/chcpu",
+    "usr/sbin/clock",
+    "usr/sbin/ctrlaltdel",
+    "usr/sbin/delpart",
+    "usr/sbin/fdformat",
+    "usr/sbin/fdisk",
+    "usr/sbin/findfs",
+    "usr/sbin/fsck",
+    "usr/sbin/fsck.cramfs",
+    "usr/sbin/fsck.minix",
+    "usr/sbin/fsfreeze",
+    "usr/sbin/fstrim",
+    "usr/sbin/hwclock",
+    "usr/sbin/ldattach",
+    "usr/sbin/losetup",
+    "usr/sbin/mkfs",
+    "usr/sbin/mkfs.cramfs",
+    "usr/sbin/mkfs.minix",
+    "usr/sbin/mkswap",
+    "usr/sbin/nologin",
+    "usr/sbin/partx",
+    "usr/sbin/pivot_root",
+    "usr/sbin/readprofile",
+    "usr/sbin/resizepart",
+    "usr/sbin/rfkill",
+    "usr/sbin/rtcwake",
+    "usr/sbin/runuser",
+    "usr/sbin/sfdisk",
+    "usr/sbin/sulogin",
+    "usr/sbin/swaplabel",
+    "usr/sbin/swapoff",
+    "usr/sbin/swapon",
+    "usr/sbin/switch_root",
+    "usr/sbin/wipefs",
+    "usr/sbin/zramctl"
+  ],
+  "vim-minimal": [
+    "usr/bin/ex",
+    "usr/bin/rvi",
+    "usr/bin/rview",
+    "usr/bin/vi",
+    "usr/bin/view"
+  ],
+  "virt-what": [
+    "usr/sbin/virt-what"
+  ],
+  "which": [
+    "usr/bin/which"
+  ],
+  "xz-libs": null,
+  "yum": [
+    "usr/bin/yum"
+  ],
+  "zlib": null
 }
diff --git a/rpm/testdata/Info.Files.NDB.txtar b/rpm/testdata/Info.Files.NDB.txtar
index 98d3eb199..8c9bb03da 100644
--- a/rpm/testdata/Info.Files.NDB.txtar
+++ b/rpm/testdata/Info.Files.NDB.txtar
@@ -1,471 +1,558 @@
 ndb/testdata/Packages.db
 -- want.json --
 {
-	"aaa_base": [
-		"usr/bin/chkconfig",
-		"usr/bin/filesize",
-		"usr/bin/get_kernel_version",
-		"usr/bin/mkinfodir",
-		"usr/bin/old",
-		"usr/bin/rpmlocate",
-		"usr/bin/safe-rm",
-		"usr/bin/safe-rmdir"
-	],
-	"bash": [
-		"usr/bin/bash",
-		"usr/bin/bashbug",
-		"usr/bin/rbash"
-	],
-	"bash-sh": [
-		"usr/bin/sh"
-	],
-	"boost-license1_66_0": null,
-	"ca-certificates": null,
-	"ca-certificates-mozilla": null,
-	"container-suseconnect": [
-		"usr/bin/container-suseconnect"
-	],
-	"coreutils": [
-		"usr/bin/[",
-		"usr/bin/arch",
-		"usr/bin/b2sum",
-		"usr/bin/base32",
-		"usr/bin/base64",
-		"usr/bin/basename",
-		"usr/bin/basenc",
-		"usr/bin/cat",
-		"usr/bin/chcon",
-		"usr/bin/chgrp",
-		"usr/bin/chmod",
-		"usr/bin/chown",
-		"usr/bin/chroot",
-		"usr/bin/cksum",
-		"usr/bin/comm",
-		"usr/bin/cp",
-		"usr/bin/csplit",
-		"usr/bin/cut",
-		"usr/bin/date",
-		"usr/bin/dd",
-		"usr/bin/df",
-		"usr/bin/dir",
-		"usr/bin/dircolors",
-		"usr/bin/dirname",
-		"usr/bin/du",
-		"usr/bin/echo",
-		"usr/bin/env",
-		"usr/bin/expand",
-		"usr/bin/expr",
-		"usr/bin/factor",
-		"usr/bin/false",
-		"usr/bin/fmt",
-		"usr/bin/fold",
-		"usr/bin/groups",
-		"usr/bin/head",
-		"usr/bin/hostid",
-		"usr/bin/id",
-		"usr/bin/install",
-		"usr/bin/join",
-		"usr/bin/link",
-		"usr/bin/ln",
-		"usr/bin/logname",
-		"usr/bin/ls",
-		"usr/bin/md5sum",
-		"usr/bin/mkdir",
-		"usr/bin/mkfifo",
-		"usr/bin/mknod",
-		"usr/bin/mktemp",
-		"usr/bin/mv",
-		"usr/bin/nice",
-		"usr/bin/nl",
-		"usr/bin/nohup",
-		"usr/bin/nproc",
-		"usr/bin/numfmt",
-		"usr/bin/od",
-		"usr/bin/paste",
-		"usr/bin/pathchk",
-		"usr/bin/pinky",
-		"usr/bin/pr",
-		"usr/bin/printenv",
-		"usr/bin/printf",
-		"usr/bin/ptx",
-		"usr/bin/pwd",
-		"usr/bin/readlink",
-		"usr/bin/realpath",
-		"usr/bin/rm",
-		"usr/bin/rmdir",
-		"usr/bin/runcon",
-		"usr/bin/seq",
-		"usr/bin/sha1sum",
-		"usr/bin/sha224sum",
-		"usr/bin/sha256sum",
-		"usr/bin/sha384sum",
-		"usr/bin/sha512sum",
-		"usr/bin/shred",
-		"usr/bin/shuf",
-		"usr/bin/sleep",
-		"usr/bin/sort",
-		"usr/bin/split",
-		"usr/bin/stat",
-		"usr/bin/stdbuf",
-		"usr/bin/stty",
-		"usr/bin/sum",
-		"usr/bin/sync",
-		"usr/bin/tac",
-		"usr/bin/tail",
-		"usr/bin/tee",
-		"usr/bin/test",
-		"usr/bin/timeout",
-		"usr/bin/touch",
-		"usr/bin/tr",
-		"usr/bin/true",
-		"usr/bin/truncate",
-		"usr/bin/tsort",
-		"usr/bin/tty",
-		"usr/bin/uname",
-		"usr/bin/unexpand",
-		"usr/bin/uniq",
-		"usr/bin/unlink",
-		"usr/bin/uptime",
-		"usr/bin/users",
-		"usr/bin/vdir",
-		"usr/bin/wc",
-		"usr/bin/who",
-		"usr/bin/whoami",
-		"usr/bin/yes"
-	],
-	"cpio": [
-		"usr/bin/cpio"
-	],
-	"cracklib": null,
-	"cracklib-dict-small": null,
-	"crypto-policies": null,
-	"curl": [
-		"usr/bin/curl"
-	],
-	"diffutils": [
-		"usr/bin/cmp",
-		"usr/bin/diff",
-		"usr/bin/diff3",
-		"usr/bin/sdiff"
-	],
-	"file-magic": null,
-	"filesystem": null,
-	"fillup": [
-		"usr/bin/fillup"
-	],
-	"findutils": [
-		"usr/bin/find",
-		"usr/bin/xargs"
-	],
-	"glibc": [
-		"usr/bin/gencat",
-		"usr/bin/getconf",
-		"usr/bin/getent",
-		"usr/bin/iconv",
-		"usr/bin/ldd",
-		"usr/bin/locale",
-		"usr/bin/localedef"
-	],
-	"gpg2": [
-		"usr/bin/g13",
-		"usr/bin/gpg",
-		"usr/bin/gpg-agent",
-		"usr/bin/gpg-connect-agent",
-		"usr/bin/gpg-wks-server",
-		"usr/bin/gpg-zip",
-		"usr/bin/gpg2",
-		"usr/bin/gpgconf",
-		"usr/bin/gpgparsemail",
-		"usr/bin/gpgscm",
-		"usr/bin/gpgsm",
-		"usr/bin/gpgsplit",
-		"usr/bin/gpgtar",
-		"usr/bin/gpgv",
-		"usr/bin/gpgv2",
-		"usr/bin/kbxutil",
-		"usr/bin/scdaemon",
-		"usr/bin/watchgnupg"
-	],
-	"grep": [
-		"usr/bin/egrep",
-		"usr/bin/fgrep",
-		"usr/bin/grep"
-	],
-	"info": [
-		"usr/bin/info",
-		"usr/bin/install-info"
-	],
-	"krb5": null,
-	"kubic-locale-archive": null,
-	"libacl1": null,
-	"libassuan0": null,
-	"libattr1": null,
-	"libaudit1": null,
-	"libaugeas0": null,
-	"libblkid1": null,
-	"libboost_system1_66_0": null,
-	"libboost_thread1_66_0": null,
-	"libbrotlicommon1": null,
-	"libbrotlidec1": null,
-	"libbz2-1": null,
-	"libcap-ng0": null,
-	"libcap2": null,
-	"libcom_err2": null,
-	"libcrack2": null,
-	"libcrypt1": null,
-	"libcurl4": null,
-	"libdw1": null,
-	"libeconf0": null,
-	"libelf1": null,
-	"libfdisk1": null,
-	"libffi7": null,
-	"libgcc_s1": null,
-	"libgcrypt20": null,
-	"libgcrypt20-hmac": null,
-	"libglib-2_0-0": null,
-	"libgmp10": null,
-	"libgpg-error0": null,
-	"libgpgme11": null,
-	"libidn2-0": null,
-	"libkeyutils1": null,
-	"libksba8": null,
-	"libldap-2_4-2": null,
-	"libldap-data": null,
-	"liblua5_3-5": null,
-	"liblz4-1": null,
-	"liblzma5": null,
-	"libmagic1": null,
-	"libmount1": null,
-	"libncurses6": null,
-	"libnghttp2-14": null,
-	"libnpth0": null,
-	"libnsl2": null,
-	"libopenssl1_1": null,
-	"libopenssl1_1-hmac": null,
-	"libp11-kit0": null,
-	"libpcre1": null,
-	"libpopt0": null,
-	"libprocps7": null,
-	"libprotobuf-lite20": null,
-	"libproxy1": null,
-	"libpsl5": null,
-	"libreadline7": null,
-	"libsasl2-3": null,
-	"libselinux1": null,
-	"libsemanage1": null,
-	"libsepol1": null,
-	"libsigc-2_0-0": null,
-	"libsmartcols1": null,
-	"libsolv-tools": [
-		"usr/bin/appdata2solv",
-		"usr/bin/comps2solv",
-		"usr/bin/deltainfoxml2solv",
-		"usr/bin/dumpsolv",
-		"usr/bin/installcheck",
-		"usr/bin/mergesolv",
-		"usr/bin/repo2solv",
-		"usr/bin/repo2solv.sh",
-		"usr/bin/repomdxml2solv",
-		"usr/bin/rpmdb2solv",
-		"usr/bin/rpmmd2solv",
-		"usr/bin/rpms2solv",
-		"usr/bin/susetags2solv",
-		"usr/bin/testsolv",
-		"usr/bin/updateinfoxml2solv"
-	],
-	"libsqlite3-0": null,
-	"libssh-config": null,
-	"libssh4": null,
-	"libstdc++6": null,
-	"libsystemd0": null,
-	"libtasn1": [
-		"usr/bin/asn1Coding",
-		"usr/bin/asn1Decoding",
-		"usr/bin/asn1Parser"
-	],
-	"libtasn1-6": null,
-	"libtirpc-netconfig": null,
-	"libtirpc3": null,
-	"libudev1": null,
-	"libunistring2": null,
-	"libusb-1_0-0": null,
-	"libutempter0": null,
-	"libuuid1": null,
-	"libverto1": null,
-	"libxml2-2": null,
-	"libyaml-cpp0_6": null,
-	"libz1": null,
-	"libzio1": null,
-	"libzstd1": null,
-	"libzypp": [
-		"usr/bin/zypp-CheckAccessDeleted",
-		"usr/bin/zypp-NameReqPrv"
-	],
-	"login_defs": null,
-	"ncurses-utils": [
-		"usr/bin/clear",
-		"usr/bin/infocmp",
-		"usr/bin/reset",
-		"usr/bin/tabs",
-		"usr/bin/toe",
-		"usr/bin/tput",
-		"usr/bin/tset"
-	],
-	"netcfg": null,
-	"openssl-1_1": [
-		"usr/bin/c_rehash",
-		"usr/bin/fips_standalone_hmac",
-		"usr/bin/openssl"
-	],
-	"p11-kit": null,
-	"p11-kit-tools": [
-		"usr/bin/p11-kit",
-		"usr/bin/trust"
-	],
-	"pam": null,
-	"patterns-base-fips": null,
-	"perl-base": [
-		"usr/bin/perl",
-		"usr/bin/perl5.26.1"
-	],
-	"permissions": [
-		"usr/bin/chkstat"
-	],
-	"pinentry": [
-		"usr/bin/pinentry",
-		"usr/bin/pinentry-curses",
-		"usr/bin/pinentry-tty"
-	],
-	"procps": [
-		"usr/bin/free",
-		"usr/bin/pgrep",
-		"usr/bin/pkill",
-		"usr/bin/pmap",
-		"usr/bin/ps",
-		"usr/bin/pwdx",
-		"usr/bin/skill",
-		"usr/bin/slabtop",
-		"usr/bin/snice",
-		"usr/bin/tload",
-		"usr/bin/top",
-		"usr/bin/vmstat",
-		"usr/bin/w",
-		"usr/bin/watch"
-	],
-	"rpm-config-SUSE": null,
-	"rpm-ndb": [
-		"usr/bin/gendiff",
-		"usr/bin/rpm",
-		"usr/bin/rpm2cpio",
-		"usr/bin/rpmdb",
-		"usr/bin/rpmgraph",
-		"usr/bin/rpmkeys",
-		"usr/bin/rpmqpack",
-		"usr/bin/rpmquery",
-		"usr/bin/rpmsign",
-		"usr/bin/rpmspec",
-		"usr/bin/rpmverify"
-	],
-	"sed": [
-		"usr/bin/sed"
-	],
-	"shadow": [
-		"usr/bin/chage",
-		"usr/bin/chfn",
-		"usr/bin/chsh",
-		"usr/bin/expiry",
-		"usr/bin/gpasswd",
-		"usr/bin/lastlog",
-		"usr/bin/newgidmap",
-		"usr/bin/newgrp",
-		"usr/bin/newuidmap",
-		"usr/bin/passwd",
-		"usr/bin/sg"
-	],
-	"skelcd-EULA-bci": null,
-	"sles-release": null,
-	"suse-build-key": null,
-	"system-group-hardware": null,
-	"system-user-root": null,
-	"sysuser-shadow": null,
-	"terminfo-base": null,
-	"timezone": [
-		"usr/bin/tzselect"
-	],
-	"util-linux": [
-		"usr/bin/cal",
-		"usr/bin/chmem",
-		"usr/bin/choom",
-		"usr/bin/chrt",
-		"usr/bin/col",
-		"usr/bin/colcrt",
-		"usr/bin/colrm",
-		"usr/bin/column",
-		"usr/bin/dmesg",
-		"usr/bin/eject",
-		"usr/bin/fallocate",
-		"usr/bin/fincore",
-		"usr/bin/flock",
-		"usr/bin/getopt",
-		"usr/bin/hardlink",
-		"usr/bin/hexdump",
-		"usr/bin/i386",
-		"usr/bin/ionice",
-		"usr/bin/ipcmk",
-		"usr/bin/ipcrm",
-		"usr/bin/ipcs",
-		"usr/bin/irqtop",
-		"usr/bin/isosize",
-		"usr/bin/kill",
-		"usr/bin/last",
-		"usr/bin/lastb",
-		"usr/bin/line",
-		"usr/bin/linux32",
-		"usr/bin/linux64",
-		"usr/bin/look",
-		"usr/bin/lscpu",
-		"usr/bin/lsipc",
-		"usr/bin/lsirq",
-		"usr/bin/lslocks",
-		"usr/bin/lsmem",
-		"usr/bin/lsns",
-		"usr/bin/mcookie",
-		"usr/bin/mesg",
-		"usr/bin/more",
-		"usr/bin/mount",
-		"usr/bin/mountpoint",
-		"usr/bin/namei",
-		"usr/bin/nsenter",
-		"usr/bin/prlimit",
-		"usr/bin/rename",
-		"usr/bin/renice",
-		"usr/bin/rev",
-		"usr/bin/script",
-		"usr/bin/scriptlive",
-		"usr/bin/scriptreplay",
-		"usr/bin/setarch",
-		"usr/bin/setpriv",
-		"usr/bin/setsid",
-		"usr/bin/setterm",
-		"usr/bin/su",
-		"usr/bin/taskset",
-		"usr/bin/uclampset",
-		"usr/bin/ul",
-		"usr/bin/umount",
-		"usr/bin/uname26",
-		"usr/bin/unshare",
-		"usr/bin/utmpdump",
-		"usr/bin/uuidgen",
-		"usr/bin/uuidparse",
-		"usr/bin/wall",
-		"usr/bin/wdctl",
-		"usr/bin/whereis",
-		"usr/bin/write",
-		"usr/bin/x86_64"
-	],
-	"zypper": [
-		"usr/bin/installation_sources",
-		"usr/bin/yzpper",
-		"usr/bin/zypper"
-	]
+  "aaa_base": [
+    "usr/bin/chkconfig",
+    "usr/bin/filesize",
+    "usr/bin/get_kernel_version",
+    "usr/bin/mkinfodir",
+    "usr/bin/old",
+    "usr/bin/rpmlocate",
+    "usr/bin/safe-rm",
+    "usr/bin/safe-rmdir",
+    "usr/sbin/refresh_initrd",
+    "usr/sbin/service",
+    "usr/sbin/smart_agetty",
+    "usr/sbin/sysconf_addword"
+  ],
+  "bash": [
+    "usr/bin/bash",
+    "usr/bin/bashbug",
+    "usr/bin/rbash"
+  ],
+  "bash-sh": [
+    "usr/bin/sh"
+  ],
+  "boost-license1_66_0": null,
+  "ca-certificates": [
+    "usr/sbin/rcca-certificates",
+    "usr/sbin/update-ca-certificates"
+  ],
+  "ca-certificates-mozilla": null,
+  "container-suseconnect": [
+    "usr/bin/container-suseconnect"
+  ],
+  "coreutils": [
+    "usr/bin/[",
+    "usr/bin/arch",
+    "usr/bin/b2sum",
+    "usr/bin/base32",
+    "usr/bin/base64",
+    "usr/bin/basename",
+    "usr/bin/basenc",
+    "usr/bin/cat",
+    "usr/bin/chcon",
+    "usr/bin/chgrp",
+    "usr/bin/chmod",
+    "usr/bin/chown",
+    "usr/bin/chroot",
+    "usr/bin/cksum",
+    "usr/bin/comm",
+    "usr/bin/cp",
+    "usr/bin/csplit",
+    "usr/bin/cut",
+    "usr/bin/date",
+    "usr/bin/dd",
+    "usr/bin/df",
+    "usr/bin/dir",
+    "usr/bin/dircolors",
+    "usr/bin/dirname",
+    "usr/bin/du",
+    "usr/bin/echo",
+    "usr/bin/env",
+    "usr/bin/expand",
+    "usr/bin/expr",
+    "usr/bin/factor",
+    "usr/bin/false",
+    "usr/bin/fmt",
+    "usr/bin/fold",
+    "usr/bin/groups",
+    "usr/bin/head",
+    "usr/bin/hostid",
+    "usr/bin/id",
+    "usr/bin/install",
+    "usr/bin/join",
+    "usr/bin/link",
+    "usr/bin/ln",
+    "usr/bin/logname",
+    "usr/bin/ls",
+    "usr/bin/md5sum",
+    "usr/bin/mkdir",
+    "usr/bin/mkfifo",
+    "usr/bin/mknod",
+    "usr/bin/mktemp",
+    "usr/bin/mv",
+    "usr/bin/nice",
+    "usr/bin/nl",
+    "usr/bin/nohup",
+    "usr/bin/nproc",
+    "usr/bin/numfmt",
+    "usr/bin/od",
+    "usr/bin/paste",
+    "usr/bin/pathchk",
+    "usr/bin/pinky",
+    "usr/bin/pr",
+    "usr/bin/printenv",
+    "usr/bin/printf",
+    "usr/bin/ptx",
+    "usr/bin/pwd",
+    "usr/bin/readlink",
+    "usr/bin/realpath",
+    "usr/bin/rm",
+    "usr/bin/rmdir",
+    "usr/bin/runcon",
+    "usr/bin/seq",
+    "usr/bin/sha1sum",
+    "usr/bin/sha224sum",
+    "usr/bin/sha256sum",
+    "usr/bin/sha384sum",
+    "usr/bin/sha512sum",
+    "usr/bin/shred",
+    "usr/bin/shuf",
+    "usr/bin/sleep",
+    "usr/bin/sort",
+    "usr/bin/split",
+    "usr/bin/stat",
+    "usr/bin/stdbuf",
+    "usr/bin/stty",
+    "usr/bin/sum",
+    "usr/bin/sync",
+    "usr/bin/tac",
+    "usr/bin/tail",
+    "usr/bin/tee",
+    "usr/bin/test",
+    "usr/bin/timeout",
+    "usr/bin/touch",
+    "usr/bin/tr",
+    "usr/bin/true",
+    "usr/bin/truncate",
+    "usr/bin/tsort",
+    "usr/bin/tty",
+    "usr/bin/uname",
+    "usr/bin/unexpand",
+    "usr/bin/uniq",
+    "usr/bin/unlink",
+    "usr/bin/uptime",
+    "usr/bin/users",
+    "usr/bin/vdir",
+    "usr/bin/wc",
+    "usr/bin/who",
+    "usr/bin/whoami",
+    "usr/bin/yes"
+  ],
+  "cpio": [
+    "usr/bin/cpio"
+  ],
+  "cracklib": [
+    "usr/sbin/cracklib-check",
+    "usr/sbin/cracklib-format",
+    "usr/sbin/cracklib-packer",
+    "usr/sbin/cracklib-unpacker",
+    "usr/sbin/create-cracklib-dict",
+    "usr/sbin/mkdict",
+    "usr/sbin/packer"
+  ],
+  "cracklib-dict-small": null,
+  "crypto-policies": null,
+  "curl": [
+    "usr/bin/curl"
+  ],
+  "diffutils": [
+    "usr/bin/cmp",
+    "usr/bin/diff",
+    "usr/bin/diff3",
+    "usr/bin/sdiff"
+  ],
+  "file-magic": null,
+  "filesystem": null,
+  "fillup": [
+    "usr/bin/fillup"
+  ],
+  "findutils": [
+    "usr/bin/find",
+    "usr/bin/xargs"
+  ],
+  "glibc": [
+    "usr/bin/gencat",
+    "usr/bin/getconf",
+    "usr/bin/getent",
+    "usr/bin/iconv",
+    "usr/bin/ldd",
+    "usr/bin/locale",
+    "usr/bin/localedef",
+    "usr/sbin/iconvconfig"
+  ],
+  "gpg2": [
+    "usr/bin/g13",
+    "usr/bin/gpg",
+    "usr/bin/gpg-agent",
+    "usr/bin/gpg-connect-agent",
+    "usr/bin/gpg-wks-server",
+    "usr/bin/gpg-zip",
+    "usr/bin/gpg2",
+    "usr/bin/gpgconf",
+    "usr/bin/gpgparsemail",
+    "usr/bin/gpgscm",
+    "usr/bin/gpgsm",
+    "usr/bin/gpgsplit",
+    "usr/bin/gpgtar",
+    "usr/bin/gpgv",
+    "usr/bin/gpgv2",
+    "usr/bin/kbxutil",
+    "usr/bin/scdaemon",
+    "usr/bin/watchgnupg",
+    "usr/sbin/addgnupghome",
+    "usr/sbin/applygnupgdefaults",
+    "usr/sbin/g13-syshelp"
+  ],
+  "grep": [
+    "usr/bin/egrep",
+    "usr/bin/fgrep",
+    "usr/bin/grep"
+  ],
+  "info": [
+    "usr/bin/info",
+    "usr/bin/install-info"
+  ],
+  "krb5": null,
+  "kubic-locale-archive": null,
+  "libacl1": null,
+  "libassuan0": null,
+  "libattr1": null,
+  "libaudit1": null,
+  "libaugeas0": null,
+  "libblkid1": null,
+  "libboost_system1_66_0": null,
+  "libboost_thread1_66_0": null,
+  "libbrotlicommon1": null,
+  "libbrotlidec1": null,
+  "libbz2-1": null,
+  "libcap-ng0": null,
+  "libcap2": null,
+  "libcom_err2": null,
+  "libcrack2": null,
+  "libcrypt1": null,
+  "libcurl4": null,
+  "libdw1": null,
+  "libeconf0": null,
+  "libelf1": null,
+  "libfdisk1": null,
+  "libffi7": null,
+  "libgcc_s1": null,
+  "libgcrypt20": null,
+  "libgcrypt20-hmac": null,
+  "libglib-2_0-0": null,
+  "libgmp10": null,
+  "libgpg-error0": null,
+  "libgpgme11": null,
+  "libidn2-0": null,
+  "libkeyutils1": null,
+  "libksba8": null,
+  "libldap-2_4-2": null,
+  "libldap-data": null,
+  "liblua5_3-5": null,
+  "liblz4-1": null,
+  "liblzma5": null,
+  "libmagic1": null,
+  "libmount1": null,
+  "libncurses6": null,
+  "libnghttp2-14": null,
+  "libnpth0": null,
+  "libnsl2": null,
+  "libopenssl1_1": null,
+  "libopenssl1_1-hmac": null,
+  "libp11-kit0": null,
+  "libpcre1": null,
+  "libpopt0": null,
+  "libprocps7": null,
+  "libprotobuf-lite20": null,
+  "libproxy1": null,
+  "libpsl5": null,
+  "libreadline7": null,
+  "libsasl2-3": null,
+  "libselinux1": null,
+  "libsemanage1": null,
+  "libsepol1": null,
+  "libsigc-2_0-0": null,
+  "libsmartcols1": null,
+  "libsolv-tools": [
+    "usr/bin/appdata2solv",
+    "usr/bin/comps2solv",
+    "usr/bin/deltainfoxml2solv",
+    "usr/bin/dumpsolv",
+    "usr/bin/installcheck",
+    "usr/bin/mergesolv",
+    "usr/bin/repo2solv",
+    "usr/bin/repo2solv.sh",
+    "usr/bin/repomdxml2solv",
+    "usr/bin/rpmdb2solv",
+    "usr/bin/rpmmd2solv",
+    "usr/bin/rpms2solv",
+    "usr/bin/susetags2solv",
+    "usr/bin/testsolv",
+    "usr/bin/updateinfoxml2solv"
+  ],
+  "libsqlite3-0": null,
+  "libssh-config": null,
+  "libssh4": null,
+  "libstdc++6": null,
+  "libsystemd0": null,
+  "libtasn1": [
+    "usr/bin/asn1Coding",
+    "usr/bin/asn1Decoding",
+    "usr/bin/asn1Parser"
+  ],
+  "libtasn1-6": null,
+  "libtirpc-netconfig": null,
+  "libtirpc3": null,
+  "libudev1": null,
+  "libunistring2": null,
+  "libusb-1_0-0": null,
+  "libutempter0": null,
+  "libuuid1": null,
+  "libverto1": null,
+  "libxml2-2": null,
+  "libyaml-cpp0_6": null,
+  "libz1": null,
+  "libzio1": null,
+  "libzstd1": null,
+  "libzypp": [
+    "usr/bin/zypp-CheckAccessDeleted",
+    "usr/bin/zypp-NameReqPrv"
+  ],
+  "login_defs": null,
+  "ncurses-utils": [
+    "usr/bin/clear",
+    "usr/bin/infocmp",
+    "usr/bin/reset",
+    "usr/bin/tabs",
+    "usr/bin/toe",
+    "usr/bin/tput",
+    "usr/bin/tset"
+  ],
+  "netcfg": null,
+  "openssl-1_1": [
+    "usr/bin/c_rehash",
+    "usr/bin/fips_standalone_hmac",
+    "usr/bin/openssl"
+  ],
+  "p11-kit": null,
+  "p11-kit-tools": [
+    "usr/bin/p11-kit",
+    "usr/bin/trust"
+  ],
+  "pam": null,
+  "patterns-base-fips": null,
+  "perl-base": [
+    "usr/bin/perl",
+    "usr/bin/perl5.26.1"
+  ],
+  "permissions": [
+    "usr/bin/chkstat"
+  ],
+  "pinentry": [
+    "usr/bin/pinentry",
+    "usr/bin/pinentry-curses",
+    "usr/bin/pinentry-tty"
+  ],
+  "procps": [
+    "usr/bin/free",
+    "usr/bin/pgrep",
+    "usr/bin/pkill",
+    "usr/bin/pmap",
+    "usr/bin/ps",
+    "usr/bin/pwdx",
+    "usr/bin/skill",
+    "usr/bin/slabtop",
+    "usr/bin/snice",
+    "usr/bin/tload",
+    "usr/bin/top",
+    "usr/bin/vmstat",
+    "usr/bin/w",
+    "usr/bin/watch",
+    "usr/sbin/sysctl"
+  ],
+  "rpm-config-SUSE": null,
+  "rpm-ndb": [
+    "usr/bin/gendiff",
+    "usr/bin/rpm",
+    "usr/bin/rpm2cpio",
+    "usr/bin/rpmdb",
+    "usr/bin/rpmgraph",
+    "usr/bin/rpmkeys",
+    "usr/bin/rpmqpack",
+    "usr/bin/rpmquery",
+    "usr/bin/rpmsign",
+    "usr/bin/rpmspec",
+    "usr/bin/rpmverify",
+    "usr/sbin/rpmconfigcheck"
+  ],
+  "sed": [
+    "usr/bin/sed"
+  ],
+  "shadow": [
+    "usr/bin/chage",
+    "usr/bin/chfn",
+    "usr/bin/chsh",
+    "usr/bin/expiry",
+    "usr/bin/gpasswd",
+    "usr/bin/lastlog",
+    "usr/bin/newgidmap",
+    "usr/bin/newgrp",
+    "usr/bin/newuidmap",
+    "usr/bin/passwd",
+    "usr/bin/sg",
+    "usr/sbin/chpasswd",
+    "usr/sbin/groupadd",
+    "usr/sbin/groupdel",
+    "usr/sbin/groupmod",
+    "usr/sbin/grpck",
+    "usr/sbin/newusers",
+    "usr/sbin/pwck",
+    "usr/sbin/pwconv",
+    "usr/sbin/pwunconv",
+    "usr/sbin/useradd",
+    "usr/sbin/useradd.local",
+    "usr/sbin/userdel",
+    "usr/sbin/userdel-post.local",
+    "usr/sbin/userdel-pre.local",
+    "usr/sbin/usermod",
+    "usr/sbin/vigr",
+    "usr/sbin/vipw"
+  ],
+  "skelcd-EULA-bci": null,
+  "sles-release": null,
+  "suse-build-key": null,
+  "system-group-hardware": null,
+  "system-user-root": null,
+  "sysuser-shadow": [
+    "usr/sbin/sysusers2shadow"
+  ],
+  "terminfo-base": null,
+  "timezone": [
+    "usr/bin/tzselect",
+    "usr/sbin/zdump",
+    "usr/sbin/zic"
+  ],
+  "util-linux": [
+    "usr/bin/cal",
+    "usr/bin/chmem",
+    "usr/bin/choom",
+    "usr/bin/chrt",
+    "usr/bin/col",
+    "usr/bin/colcrt",
+    "usr/bin/colrm",
+    "usr/bin/column",
+    "usr/bin/dmesg",
+    "usr/bin/eject",
+    "usr/bin/fallocate",
+    "usr/bin/fincore",
+    "usr/bin/flock",
+    "usr/bin/getopt",
+    "usr/bin/hardlink",
+    "usr/bin/hexdump",
+    "usr/bin/i386",
+    "usr/bin/ionice",
+    "usr/bin/ipcmk",
+    "usr/bin/ipcrm",
+    "usr/bin/ipcs",
+    "usr/bin/irqtop",
+    "usr/bin/isosize",
+    "usr/bin/kill",
+    "usr/bin/last",
+    "usr/bin/lastb",
+    "usr/bin/line",
+    "usr/bin/linux32",
+    "usr/bin/linux64",
+    "usr/bin/look",
+    "usr/bin/lscpu",
+    "usr/bin/lsipc",
+    "usr/bin/lsirq",
+    "usr/bin/lslocks",
+    "usr/bin/lsmem",
+    "usr/bin/lsns",
+    "usr/bin/mcookie",
+    "usr/bin/mesg",
+    "usr/bin/more",
+    "usr/bin/mount",
+    "usr/bin/mountpoint",
+    "usr/bin/namei",
+    "usr/bin/nsenter",
+    "usr/bin/prlimit",
+    "usr/bin/rename",
+    "usr/bin/renice",
+    "usr/bin/rev",
+    "usr/bin/script",
+    "usr/bin/scriptlive",
+    "usr/bin/scriptreplay",
+    "usr/bin/setarch",
+    "usr/bin/setpriv",
+    "usr/bin/setsid",
+    "usr/bin/setterm",
+    "usr/bin/su",
+    "usr/bin/taskset",
+    "usr/bin/uclampset",
+    "usr/bin/ul",
+    "usr/bin/umount",
+    "usr/bin/uname26",
+    "usr/bin/unshare",
+    "usr/bin/utmpdump",
+    "usr/bin/uuidgen",
+    "usr/bin/uuidparse",
+    "usr/bin/wall",
+    "usr/bin/wdctl",
+    "usr/bin/whereis",
+    "usr/bin/write",
+    "usr/bin/x86_64",
+    "usr/sbin/addpart",
+    "usr/sbin/agetty",
+    "usr/sbin/blkdiscard",
+    "usr/sbin/blkid",
+    "usr/sbin/blkzone",
+    "usr/sbin/blockdev",
+    "usr/sbin/cfdisk",
+    "usr/sbin/chcpu",
+    "usr/sbin/ctrlaltdel",
+    "usr/sbin/delpart",
+    "usr/sbin/fdformat",
+    "usr/sbin/fdisk",
+    "usr/sbin/findfs",
+    "usr/sbin/flushb",
+    "usr/sbin/fsck",
+    "usr/sbin/fsck.cramfs",
+    "usr/sbin/fsck.minix",
+    "usr/sbin/fsfreeze",
+    "usr/sbin/fstrim",
+    "usr/sbin/hwclock",
+    "usr/sbin/ldattach",
+    "usr/sbin/losetup",
+    "usr/sbin/mkfs",
+    "usr/sbin/mkfs.bfs",
+    "usr/sbin/mkfs.cramfs",
+    "usr/sbin/mkfs.minix",
+    "usr/sbin/mkswap",
+    "usr/sbin/nologin",
+    "usr/sbin/partx",
+    "usr/sbin/pivot_root",
+    "usr/sbin/readprofile",
+    "usr/sbin/resizepart",
+    "usr/sbin/rfkill",
+    "usr/sbin/rtcwake",
+    "usr/sbin/runuser",
+    "usr/sbin/sfdisk",
+    "usr/sbin/sulogin",
+    "usr/sbin/swaplabel",
+    "usr/sbin/swapoff",
+    "usr/sbin/swapon",
+    "usr/sbin/switch_root",
+    "usr/sbin/tunelp",
+    "usr/sbin/wipefs",
+    "usr/sbin/zramctl"
+  ],
+  "zypper": [
+    "usr/bin/installation_sources",
+    "usr/bin/yzpper",
+    "usr/bin/zypper",
+    "usr/sbin/zypp-refresh"
+  ]
 }
diff --git a/rpm/testdata/Info.Files.SQLite.txtar b/rpm/testdata/Info.Files.SQLite.txtar
index 796303325..b32c2d321 100644
--- a/rpm/testdata/Info.Files.SQLite.txtar
+++ b/rpm/testdata/Info.Files.SQLite.txtar
@@ -1,314 +1,339 @@
 sqlite/testdata/rpmdb.sqlite
 -- want.json --
 {
-	"alternatives": null,
-	"audit-libs": null,
-	"basesystem": null,
-	"bash": [
-		"usr/bin/alias",
-		"usr/bin/bash",
-		"usr/bin/bashbug",
-		"usr/bin/bashbug-64",
-		"usr/bin/bg",
-		"usr/bin/cd",
-		"usr/bin/command",
-		"usr/bin/fc",
-		"usr/bin/fg",
-		"usr/bin/getopts",
-		"usr/bin/hash",
-		"usr/bin/jobs",
-		"usr/bin/read",
-		"usr/bin/sh",
-		"usr/bin/type",
-		"usr/bin/ulimit",
-		"usr/bin/umask",
-		"usr/bin/unalias",
-		"usr/bin/wait"
-	],
-	"bzip2-libs": null,
-	"ca-certificates": [
-		"usr/bin/ca-legacy",
-		"usr/bin/update-ca-trust"
-	],
-	"coreutils": [
-		"usr/bin/[",
-		"usr/bin/arch",
-		"usr/bin/b2sum",
-		"usr/bin/base32",
-		"usr/bin/base64",
-		"usr/bin/basename",
-		"usr/bin/basenc",
-		"usr/bin/cat",
-		"usr/bin/chcon",
-		"usr/bin/chgrp",
-		"usr/bin/chmod",
-		"usr/bin/chown",
-		"usr/bin/cksum",
-		"usr/bin/comm",
-		"usr/bin/cp",
-		"usr/bin/csplit",
-		"usr/bin/cut",
-		"usr/bin/date",
-		"usr/bin/dd",
-		"usr/bin/df",
-		"usr/bin/dir",
-		"usr/bin/dircolors",
-		"usr/bin/dirname",
-		"usr/bin/du",
-		"usr/bin/echo",
-		"usr/bin/env",
-		"usr/bin/expand",
-		"usr/bin/expr",
-		"usr/bin/factor",
-		"usr/bin/false",
-		"usr/bin/fmt",
-		"usr/bin/fold",
-		"usr/bin/groups",
-		"usr/bin/head",
-		"usr/bin/hostid",
-		"usr/bin/id",
-		"usr/bin/install",
-		"usr/bin/join",
-		"usr/bin/link",
-		"usr/bin/ln",
-		"usr/bin/logname",
-		"usr/bin/ls",
-		"usr/bin/md5sum",
-		"usr/bin/mkdir",
-		"usr/bin/mkfifo",
-		"usr/bin/mknod",
-		"usr/bin/mktemp",
-		"usr/bin/mv",
-		"usr/bin/nice",
-		"usr/bin/nl",
-		"usr/bin/nohup",
-		"usr/bin/nproc",
-		"usr/bin/numfmt",
-		"usr/bin/od",
-		"usr/bin/paste",
-		"usr/bin/pathchk",
-		"usr/bin/pinky",
-		"usr/bin/pr",
-		"usr/bin/printenv",
-		"usr/bin/printf",
-		"usr/bin/ptx",
-		"usr/bin/pwd",
-		"usr/bin/readlink",
-		"usr/bin/realpath",
-		"usr/bin/rm",
-		"usr/bin/rmdir",
-		"usr/bin/runcon",
-		"usr/bin/seq",
-		"usr/bin/sha1sum",
-		"usr/bin/sha224sum",
-		"usr/bin/sha256sum",
-		"usr/bin/sha384sum",
-		"usr/bin/sha512sum",
-		"usr/bin/shred",
-		"usr/bin/shuf",
-		"usr/bin/sleep",
-		"usr/bin/sort",
-		"usr/bin/split",
-		"usr/bin/stat",
-		"usr/bin/stdbuf",
-		"usr/bin/stty",
-		"usr/bin/sum",
-		"usr/bin/sync",
-		"usr/bin/tac",
-		"usr/bin/tail",
-		"usr/bin/tee",
-		"usr/bin/test",
-		"usr/bin/timeout",
-		"usr/bin/touch",
-		"usr/bin/tr",
-		"usr/bin/true",
-		"usr/bin/truncate",
-		"usr/bin/tsort",
-		"usr/bin/tty",
-		"usr/bin/uname",
-		"usr/bin/unexpand",
-		"usr/bin/uniq",
-		"usr/bin/unlink",
-		"usr/bin/users",
-		"usr/bin/vdir",
-		"usr/bin/wc",
-		"usr/bin/who",
-		"usr/bin/whoami",
-		"usr/bin/yes"
-	],
-	"coreutils-common": null,
-	"crypto-policies": null,
-	"curl": [
-		"usr/bin/curl"
-	],
-	"cyrus-sasl-lib": [
-		"usr/bin/cyrusbdb2current"
-	],
-	"dejavu-sans-fonts": null,
-	"dnf-data": null,
-	"fedora-gpg-keys": null,
-	"fedora-release-common": null,
-	"fedora-release-container": null,
-	"fedora-release-identity-container": null,
-	"fedora-repos": null,
-	"file-libs": null,
-	"filesystem": null,
-	"fonts-filesystem": null,
-	"gawk": [
-		"usr/bin/awk",
-		"usr/bin/gawk"
-	],
-	"gdbm-libs": null,
-	"glib2": [
-		"usr/bin/gapplication",
-		"usr/bin/gdbus",
-		"usr/bin/gio",
-		"usr/bin/gio-querymodules-64",
-		"usr/bin/glib-compile-schemas",
-		"usr/bin/gsettings"
-	],
-	"glibc": null,
-	"glibc-common": [
-		"usr/bin/catchsegv",
-		"usr/bin/gencat",
-		"usr/bin/getconf",
-		"usr/bin/getent",
-		"usr/bin/iconv",
-		"usr/bin/ld.so",
-		"usr/bin/ldd",
-		"usr/bin/locale",
-		"usr/bin/localedef",
-		"usr/bin/pldd",
-		"usr/bin/sotruss",
-		"usr/bin/sprof",
-		"usr/bin/tzselect",
-		"usr/bin/zdump"
-	],
-	"glibc-minimal-langpack": null,
-	"gmp": null,
-	"gnupg2": [
-		"usr/bin/dirmngr",
-		"usr/bin/dirmngr-client",
-		"usr/bin/g13",
-		"usr/bin/gpg",
-		"usr/bin/gpg-agent",
-		"usr/bin/gpg-card",
-		"usr/bin/gpg-connect-agent",
-		"usr/bin/gpg-wks-client",
-		"usr/bin/gpg-wks-server",
-		"usr/bin/gpg2",
-		"usr/bin/gpgconf",
-		"usr/bin/gpgparsemail",
-		"usr/bin/gpgsplit",
-		"usr/bin/gpgtar",
-		"usr/bin/gpgv",
-		"usr/bin/gpgv2",
-		"usr/bin/watchgnupg"
-	],
-	"gnutls": null,
-	"gobject-introspection": null,
-	"gpgme": [
-		"usr/bin/gpgme-json"
-	],
-	"grep": [
-		"usr/bin/egrep",
-		"usr/bin/fgrep",
-		"usr/bin/grep"
-	],
-	"json-c": null,
-	"keyutils-libs": null,
-	"krb5-libs": null,
-	"langpacks-core-en": null,
-	"langpacks-core-font-en": null,
-	"langpacks-en": null,
-	"libacl": null,
-	"libarchive": null,
-	"libassuan": null,
-	"libattr": null,
-	"libblkid": null,
-	"libbrotli": null,
-	"libcap": null,
-	"libcap-ng": null,
-	"libcom_err": null,
-	"libcurl": null,
-	"libdnf": null,
-	"libffi": null,
-	"libgcc": null,
-	"libgcrypt": null,
-	"libgpg-error": [
-		"usr/bin/gpg-error"
-	],
-	"libidn2": null,
-	"libksba": null,
-	"libmodulemd": [
-		"usr/bin/modulemd-validator"
-	],
-	"libmount": null,
-	"libnghttp2": null,
-	"libpeas": null,
-	"libpsl": null,
-	"librepo": null,
-	"libreport-filesystem": null,
-	"libselinux": null,
-	"libsepol": null,
-	"libsigsegv": null,
-	"libsmartcols": null,
-	"libsolv": null,
-	"libssh": null,
-	"libssh-config": null,
-	"libstdc++": null,
-	"libtasn1": null,
-	"libunistring": null,
-	"libuuid": null,
-	"libverto": null,
-	"libxcrypt": null,
-	"libxml2": [
-		"usr/bin/xmlcatalog",
-		"usr/bin/xmllint"
-	],
-	"libyaml": null,
-	"libzstd": null,
-	"lua-libs": null,
-	"lz4-libs": null,
-	"microdnf": [
-		"usr/bin/microdnf"
-	],
-	"mpfr": null,
-	"ncurses-base": null,
-	"ncurses-libs": null,
-	"nettle": null,
-	"npth": null,
-	"openldap": null,
-	"openssl-libs": null,
-	"p11-kit": [
-		"usr/bin/p11-kit"
-	],
-	"p11-kit-trust": [
-		"usr/bin/trust"
-	],
-	"pcre": null,
-	"pcre2": null,
-	"pcre2-syntax": null,
-	"popt": null,
-	"publicsuffix-list-dafsa": null,
-	"readline": null,
-	"rpm": [
-		"usr/bin/rpm",
-		"usr/bin/rpm2archive",
-		"usr/bin/rpm2cpio",
-		"usr/bin/rpmdb",
-		"usr/bin/rpmkeys",
-		"usr/bin/rpmquery",
-		"usr/bin/rpmverify"
-	],
-	"rpm-libs": null,
-	"sed": [
-		"usr/bin/sed"
-	],
-	"setup": null,
-	"sqlite-libs": null,
-	"tzdata": null,
-	"xz-libs": null,
-	"zchunk-libs": null,
-	"zlib": null
+  "alternatives": [
+    "usr/sbin/alternatives",
+    "usr/sbin/update-alternatives"
+  ],
+  "audit-libs": null,
+  "basesystem": null,
+  "bash": [
+    "usr/bin/alias",
+    "usr/bin/bash",
+    "usr/bin/bashbug",
+    "usr/bin/bashbug-64",
+    "usr/bin/bg",
+    "usr/bin/cd",
+    "usr/bin/command",
+    "usr/bin/fc",
+    "usr/bin/fg",
+    "usr/bin/getopts",
+    "usr/bin/hash",
+    "usr/bin/jobs",
+    "usr/bin/read",
+    "usr/bin/sh",
+    "usr/bin/type",
+    "usr/bin/ulimit",
+    "usr/bin/umask",
+    "usr/bin/unalias",
+    "usr/bin/wait"
+  ],
+  "bzip2-libs": null,
+  "ca-certificates": [
+    "usr/bin/ca-legacy",
+    "usr/bin/update-ca-trust"
+  ],
+  "coreutils": [
+    "usr/bin/[",
+    "usr/bin/arch",
+    "usr/bin/b2sum",
+    "usr/bin/base32",
+    "usr/bin/base64",
+    "usr/bin/basename",
+    "usr/bin/basenc",
+    "usr/bin/cat",
+    "usr/bin/chcon",
+    "usr/bin/chgrp",
+    "usr/bin/chmod",
+    "usr/bin/chown",
+    "usr/bin/cksum",
+    "usr/bin/comm",
+    "usr/bin/cp",
+    "usr/bin/csplit",
+    "usr/bin/cut",
+    "usr/bin/date",
+    "usr/bin/dd",
+    "usr/bin/df",
+    "usr/bin/dir",
+    "usr/bin/dircolors",
+    "usr/bin/dirname",
+    "usr/bin/du",
+    "usr/bin/echo",
+    "usr/bin/env",
+    "usr/bin/expand",
+    "usr/bin/expr",
+    "usr/bin/factor",
+    "usr/bin/false",
+    "usr/bin/fmt",
+    "usr/bin/fold",
+    "usr/bin/groups",
+    "usr/bin/head",
+    "usr/bin/hostid",
+    "usr/bin/id",
+    "usr/bin/install",
+    "usr/bin/join",
+    "usr/bin/link",
+    "usr/bin/ln",
+    "usr/bin/logname",
+    "usr/bin/ls",
+    "usr/bin/md5sum",
+    "usr/bin/mkdir",
+    "usr/bin/mkfifo",
+    "usr/bin/mknod",
+    "usr/bin/mktemp",
+    "usr/bin/mv",
+    "usr/bin/nice",
+    "usr/bin/nl",
+    "usr/bin/nohup",
+    "usr/bin/nproc",
+    "usr/bin/numfmt",
+    "usr/bin/od",
+    "usr/bin/paste",
+    "usr/bin/pathchk",
+    "usr/bin/pinky",
+    "usr/bin/pr",
+    "usr/bin/printenv",
+    "usr/bin/printf",
+    "usr/bin/ptx",
+    "usr/bin/pwd",
+    "usr/bin/readlink",
+    "usr/bin/realpath",
+    "usr/bin/rm",
+    "usr/bin/rmdir",
+    "usr/bin/runcon",
+    "usr/bin/seq",
+    "usr/bin/sha1sum",
+    "usr/bin/sha224sum",
+    "usr/bin/sha256sum",
+    "usr/bin/sha384sum",
+    "usr/bin/sha512sum",
+    "usr/bin/shred",
+    "usr/bin/shuf",
+    "usr/bin/sleep",
+    "usr/bin/sort",
+    "usr/bin/split",
+    "usr/bin/stat",
+    "usr/bin/stdbuf",
+    "usr/bin/stty",
+    "usr/bin/sum",
+    "usr/bin/sync",
+    "usr/bin/tac",
+    "usr/bin/tail",
+    "usr/bin/tee",
+    "usr/bin/test",
+    "usr/bin/timeout",
+    "usr/bin/touch",
+    "usr/bin/tr",
+    "usr/bin/true",
+    "usr/bin/truncate",
+    "usr/bin/tsort",
+    "usr/bin/tty",
+    "usr/bin/uname",
+    "usr/bin/unexpand",
+    "usr/bin/uniq",
+    "usr/bin/unlink",
+    "usr/bin/users",
+    "usr/bin/vdir",
+    "usr/bin/wc",
+    "usr/bin/who",
+    "usr/bin/whoami",
+    "usr/bin/yes",
+    "usr/libexec/coreutils/libstdbuf.so",
+    "usr/sbin/chroot"
+  ],
+  "coreutils-common": null,
+  "crypto-policies": null,
+  "curl": [
+    "usr/bin/curl"
+  ],
+  "cyrus-sasl-lib": [
+    "usr/bin/cyrusbdb2current",
+    "usr/sbin/sasldblistusers2",
+    "usr/sbin/saslpasswd2"
+  ],
+  "dejavu-sans-fonts": null,
+  "dnf-data": null,
+  "fedora-gpg-keys": null,
+  "fedora-release-common": null,
+  "fedora-release-container": null,
+  "fedora-release-identity-container": null,
+  "fedora-repos": null,
+  "file-libs": null,
+  "filesystem": null,
+  "fonts-filesystem": null,
+  "gawk": [
+    "usr/bin/awk",
+    "usr/bin/gawk",
+    "usr/libexec/awk/grcat",
+    "usr/libexec/awk/pwcat"
+  ],
+  "gdbm-libs": null,
+  "glib2": [
+    "usr/bin/gapplication",
+    "usr/bin/gdbus",
+    "usr/bin/gio",
+    "usr/bin/gio-querymodules-64",
+    "usr/bin/glib-compile-schemas",
+    "usr/bin/gsettings"
+  ],
+  "glibc": [
+    "usr/libexec/getconf/POSIX_V6_LP64_OFF64",
+    "usr/libexec/getconf/POSIX_V7_LP64_OFF64",
+    "usr/libexec/getconf/XBS5_LP64_OFF64",
+    "usr/sbin/iconvconfig"
+  ],
+  "glibc-common": [
+    "usr/bin/catchsegv",
+    "usr/bin/gencat",
+    "usr/bin/getconf",
+    "usr/bin/getent",
+    "usr/bin/iconv",
+    "usr/bin/ld.so",
+    "usr/bin/ldd",
+    "usr/bin/locale",
+    "usr/bin/localedef",
+    "usr/bin/pldd",
+    "usr/bin/sotruss",
+    "usr/bin/sprof",
+    "usr/bin/tzselect",
+    "usr/bin/zdump",
+    "usr/sbin/zic"
+  ],
+  "glibc-minimal-langpack": null,
+  "gmp": null,
+  "gnupg2": [
+    "usr/bin/dirmngr",
+    "usr/bin/dirmngr-client",
+    "usr/bin/g13",
+    "usr/bin/gpg",
+    "usr/bin/gpg-agent",
+    "usr/bin/gpg-card",
+    "usr/bin/gpg-connect-agent",
+    "usr/bin/gpg-wks-client",
+    "usr/bin/gpg-wks-server",
+    "usr/bin/gpg2",
+    "usr/bin/gpgconf",
+    "usr/bin/gpgparsemail",
+    "usr/bin/gpgsplit",
+    "usr/bin/gpgtar",
+    "usr/bin/gpgv",
+    "usr/bin/gpgv2",
+    "usr/bin/watchgnupg",
+    "usr/sbin/addgnupghome",
+    "usr/sbin/applygnupgdefaults",
+    "usr/sbin/g13-syshelp"
+  ],
+  "gnutls": null,
+  "gobject-introspection": null,
+  "gpgme": [
+    "usr/bin/gpgme-json"
+  ],
+  "grep": [
+    "usr/bin/egrep",
+    "usr/bin/fgrep",
+    "usr/bin/grep"
+  ],
+  "json-c": null,
+  "keyutils-libs": null,
+  "krb5-libs": null,
+  "langpacks-core-en": null,
+  "langpacks-core-font-en": null,
+  "langpacks-en": null,
+  "libacl": null,
+  "libarchive": null,
+  "libassuan": null,
+  "libattr": null,
+  "libblkid": null,
+  "libbrotli": null,
+  "libcap": [
+    "usr/sbin/capsh",
+    "usr/sbin/getcap",
+    "usr/sbin/getpcaps",
+    "usr/sbin/setcap"
+  ],
+  "libcap-ng": null,
+  "libcom_err": null,
+  "libcurl": null,
+  "libdnf": null,
+  "libffi": null,
+  "libgcc": null,
+  "libgcrypt": null,
+  "libgpg-error": [
+    "usr/bin/gpg-error"
+  ],
+  "libidn2": null,
+  "libksba": null,
+  "libmodulemd": [
+    "usr/bin/modulemd-validator"
+  ],
+  "libmount": null,
+  "libnghttp2": null,
+  "libpeas": null,
+  "libpsl": null,
+  "librepo": null,
+  "libreport-filesystem": null,
+  "libselinux": null,
+  "libsepol": null,
+  "libsigsegv": null,
+  "libsmartcols": null,
+  "libsolv": null,
+  "libssh": null,
+  "libssh-config": null,
+  "libstdc++": null,
+  "libtasn1": null,
+  "libunistring": null,
+  "libuuid": null,
+  "libverto": null,
+  "libxcrypt": null,
+  "libxml2": [
+    "usr/bin/xmlcatalog",
+    "usr/bin/xmllint"
+  ],
+  "libyaml": null,
+  "libzstd": null,
+  "lua-libs": null,
+  "lz4-libs": null,
+  "microdnf": [
+    "usr/bin/microdnf"
+  ],
+  "mpfr": null,
+  "ncurses-base": null,
+  "ncurses-libs": null,
+  "nettle": null,
+  "npth": null,
+  "openldap": null,
+  "openssl-libs": null,
+  "p11-kit": [
+    "usr/bin/p11-kit",
+    "usr/libexec/p11-kit/p11-kit-remote"
+  ],
+  "p11-kit-trust": [
+    "usr/bin/trust",
+    "usr/libexec/p11-kit/trust-extract-compat"
+  ],
+  "pcre": null,
+  "pcre2": null,
+  "pcre2-syntax": null,
+  "popt": null,
+  "publicsuffix-list-dafsa": null,
+  "readline": null,
+  "rpm": [
+    "usr/bin/rpm",
+    "usr/bin/rpm2archive",
+    "usr/bin/rpm2cpio",
+    "usr/bin/rpmdb",
+    "usr/bin/rpmkeys",
+    "usr/bin/rpmquery",
+    "usr/bin/rpmverify"
+  ],
+  "rpm-libs": null,
+  "sed": [
+    "usr/bin/sed"
+  ],
+  "setup": null,
+  "sqlite-libs": null,
+  "tzdata": null,
+  "xz-libs": null,
+  "zchunk-libs": null,
+  "zlib": null
 }
diff --git a/ruby/packagescanner.go b/ruby/packagescanner.go
index 3e3d02aa2..130793d88 100644
--- a/ruby/packagescanner.go
+++ b/ruby/packagescanner.go
@@ -16,6 +16,7 @@ import (
 
 	"github.com/quay/claircore"
 	"github.com/quay/claircore/indexer"
+	"github.com/quay/claircore/rpm"
 )
 
 var (
@@ -103,6 +104,16 @@ func (ps *Scanner) Scan(ctx context.Context, layer *claircore.Layer) ([]*clairco
 
 	var ret []*claircore.Package
 	for _, g := range gs {
+		isRPM, err := rpm.FileInstalledByRPM(ctx, layer, g)
+		if err != nil {
+			return nil, fmt.Errorf("ruby: unable to check RPM db: %w", err)
+		}
+		if isRPM {
+			zlog.Debug(ctx).
+				Str("path", g).
+				Msg("file path determined to be of RPM origin")
+			continue
+		}
 		f, err := sys.Open(g)
 		if err != nil {
 			return nil, fmt.Errorf("ruby: unable to open file: %w", err)