syft convert cycloneDx Metadata is lost after reconvert

[henrysachs]

What happened:

regarding #3574 after converting from cycloneDx to syft-json to cycloneDx the metadata object is empty.

What you expected to happen:

I would love to keep the metadata somehow

Steps to reproduce the issue:

convert the following sbom https://github.com/CycloneDX/bom-examples/blob/master/SBOM/keycloak-10.0.2/bom.json from cdx to syft to cdx and inspect the metadata section

syft convert bom.json -o syft-json > bom-syft.json
syft convert bom-syft.json -o cyclonedx-json

Anything else we need to know?:

Environment:

• Output of syft version:

Application: syft
Version:    1.18.1
BuildDate:  2024-12-13T18:41:10Z
GitCommit:  5e16e5031a13f8a11057feb8544decebfc43b4ed
GitDescription: v1.18.1
Platform:   darwin/arm64
GoVersion:  go1.23.4
Compiler:   gc

• OS (e.g: cat /etc/os-release or similar):