application-inventory: adjust Release and Version fields

Issue number:

Closes #309

Description of changes:

Right now, application inventory sets Release to the commit sha of the project building the final Bottlerocket image. Instead, this field should be:

git commit sha of the core-kit project if the package came from the core kit
otherwise, Release from the spec of the package

the Version field in app inventory also needs updating. It should be:

core kit release version for a package coming from the core-kit (already implemented)
otherwise, Version from the spec of the package.

Also, remove outdated epoch comment for the inventory query.

Testing done:

Verified produced application inventory is as expected:

{
  "Content": [
    {
      "Name": "acpid",
      "Publisher": "Bottlerocket",
      "Version": "2.0.0",
       // commit that built this core kit
      "Release": "6939dd23",
      "InstalledTime": "2024-06-20T21:14:47Z",
      "ApplicationType": "Unspecified",
      "Architecture": "aarch64",
      "Url": "http://sourceforge.net/projects/acpid2/",
      "Summary": "ACPI event daemon"
    },
...
  // non-core-kit package
    {
      "Name": "bottlerocket-settings-defaults",
      "Publisher": "Bottlerocket",
      // Release and Version pulled directly from the spec
      "Version": "0.0",
      "Release": "0.1718664918.7a7b5dd3.br1",
      "InstalledTime": "2024-06-20T21:14:47Z",
      "ApplicationType": "Unspecified",
      "Architecture": "aarch64",
      "Url": "https://github.com/bottlerocket-os/bottlerocket",
      "Summary": "Settings defaults"
    },

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

bottlerocket-os / twoliter

application-inventory: adjust Release and Version fields #310