The regex to detect which files are installed via RPMs is missing some executables because it is expecting the path to start with / but the evaluated path has the / trimmed off. This could affect the false-positive detection logic because claircore wouldn't be able to correctly identify if a language level package is coming from RPM (and therefore discount it).