Syft convert from cdx.json -> syft.json -> cdx.json fails

What happened:

I tried to convert a cyclone dx json to syft-json and back to cyclone dx, after that i received an error from syft

[0000] ERROR failed to decode SBOM: unable to decode syft-json document: unable to find source metadata type=""

What you expected to happen:

I receive a file in the CycloneDX JSON format

Steps to reproduce the issue:

taken the example cyclonedx json from: https://github.com/CycloneDX/bom-examples/blob/master/SBOM/keycloak-10.0.2/bom.json

syft convert bom.json -o syft-json > bom-syft.json
syft convert bom-syft.json -o cyclonedx-json

Anything else we need to know?:

I already dug a bit deeper into this and its because the whole source area is empty as soon as you write "directory" into type for example everything works

Environment:

• Output of syft version:

Application: syft
Version:    1.18.1
BuildDate:  2024-12-13T18:41:10Z
GitCommit:  5e16e5031a13f8a11057feb8544decebfc43b4ed
GitDescription: v1.18.1
Platform:   darwin/arm64
GoVersion:  go1.23.4
Compiler:   gc

• OS (e.g: cat /etc/os-release or similar):
  MacOs 15.2

Start by reproducing the conversion with the linked CycloneDX example and the commands shown: CycloneDX JSON to syft-json and back to cyclonedx-json. Trace how the source metadata is encoded and decoded, especially the empty source area and missing type. Done means the round trip produces a valid CycloneDX JSON file without the source metadata error.