[abhinavgautam01]

Closes #21

Summary

The CycloneDX XSD defines element children as an xs:sequence, so the XML encoder must emit them in schema order. cdxComponentXML wrote <licenses> after <purl>, which made any component with both a PURL and a license fail validation against the 1.5 XSD.

• Reorder cdxComponentXML to follow the XSD component sequence: supplier, author, name, version, description, hashes, licenses, copyright, purl, pedigree, externalReferences, properties, components. This fixes the reachable licenses case plus the misplaced supplier, author, hashes and copyright.
• Reorder cdxMetadataXML so manufacture precedes supplier, as the XSD metadata sequence requires. Encode does not emit manufacture today, so this is preventive.

Only struct field order changes. Decoding is unaffected because encoding/xml matches elements by name regardless of order. JSON output is unchanged.

Tests

• The issue's reproduction through Encode: a package with a PURL and a license now emits name, version, licenses, purl, properties.
• Every supported component element, checked against the exact XSD order.
• Every supported metadata element, checked against the exact XSD order.
• A document in the element order emitted by earlier versions still parses with all fields intact.

The three order tests fail without the fix. Existing parse tests pass unchanged.

Verification

• gofmt, go vet, go mod tidy -diff
• go test -race ./...
• golangci-lint run ./...
• The issue's reproduction, the sample SBOM used in the encode tests and a document populating every supported component and metadata element all validate against the CycloneDX 1.5 XSD.
• git-pkgs builds and its SBOM tests pass against this branch.

[andrew]

Order matches the 1.5 XSD for both component and metadata. One small thing for next time: the comment on cdxComponentXML (cyclonedx.go:57-58) could be the single line // Element order follows the CycloneDX XSD component sequence. to match the metadata one. "Decoding does not depend on element order" is the reasoning for the change rather than something the struct needs to say.