We need to examine the jar files included in the EAP distribution and record discrepancies between claircore's reckoning of the purls and what's in the Red Hat VEX.

Some container images that may be relevant:

• registry.redhat.io/jboss-eap-7/eap74-openjdk8-runtime-openshift-rhel8:latest
• registry.redhat.io/jboss-eap-7/eap74-openjdk8-openshift-rhel8:7.4.23
• registry.redhat.io/jboss-eap-7/eap74-openjdk11-runtime-openshift-rhel8:7.4.23
• registry.redhat.io/jboss-eap-7/eap74-openjdk11-openshift-rhel8:7.4.23
• registry.redhat.io/jboss-eap-7/eap74-openjdk17-runtime-openshift-rhel8:latest
• registry.redhat.io/jboss-eap-7/eap74-openjdk17-openshift-rhel8:7.4.23-5.1753741015