Error when epoch is missing from the immudb record

[KAWAHARA-souta]

When generating SBOMs for some packages, alma-sbom fails with the following error.

Traceback (most recent call last):
  File "/home/khwarizmi/git/alma-sbom/alma_sbom.py", line 712, in <module>
    cli_main()
  File "/home/khwarizmi/git/alma-sbom/alma_sbom.py", line 687, in cli_main
    sbom = get_info_about_package(
  File "/home/khwarizmi/git/alma-sbom/alma_sbom.py", line 252, in get_info_about_package
    source_rpm, package_nevra = _get_specific_info_about_package(
  File "/home/khwarizmi/git/alma-sbom/alma_sbom.py", line 150, in _get_specific_info_about_pack
age
    epoch=immudb_metadata['epoch'],
KeyError: 'epoch'

step to reproduce:

(env) $ sha256sum ./AlmaLinux-9.4-x86_64-dvd/AppStream/Packages/OpenIPMI-2.0.32-3.el9.i686.rpm
96f79c00cf635268379227f39f4745dedf20d6ad275e37a2d056bd9f4984b5c4  ./AlmaLinux-9.4-x86_64-dvd/AppStream/Packages/OpenIPMI-2.0.32-3.el9.i686.rpm
(env) $ python alma_sbom.py --rpm-package-hash 96f79c00cf635268379227f39f4745dedf20d6ad275e37a2d056bd9f4984b5c4 --file-format cyclonedx-json

The immudb record like below.

{
  'Name': 'OpenIPMI-2.0.32-3.el9.i686.rpm', 
  'Kind': 'file', 
  'Size': 116064, 
  'Hash': '96f79c00cf635268379227f39f4745dedf20d6ad275e37a2d056bd9f4984b5c4', 
  'Metadata': {
    'arch': 'i686', 
    'git_commit': '7366558c4f3b4991ab8f68e25f22515e7133a2c0', 
    'git_ref': 'imports/c9/OpenIPMI-2.0.32-3.el9',
    'git_url': 'https://git.almalinux.org/rpms/OpenIPMI.git', 
    'name': 'OpenIPMI', 
    'release': '3.el9', 
    'sbom_api': '0.2', 
    'source_type': 'git', 
    'sourcerpm': 'OpenIPMI-2.0.32-3.el9.src.rpm', 
    'version': '2.0.32'
  }, 
  'Signer': 'sbom_signer_almalinux', 
  'Original_timestamp': '0001-01-01T00:00:00Z', 
  'timestamp': 1695069406
}

I'm considering two approaches to address this issue:

1. Since epoch is one of the basic version information elements, we could terminate with an error when epoch is missing.
2. From a user's perspective, according to RPM specifications, we could treat a missing epoch as equivalent to 0 and proceed with processing.

I don't fully understand how immudb is handled on ALBS, so I can't determine which approach is correct. This package is included in the 9.4 DVD ISO image, so from the ISO-SBOM specification perspective (#41), I would prefer approach 2, but I'm not sure if this is the right choice.
Do you have any advice?