osbuild2: use source-array-ref for rpm stage inputs

The (new) source-array-ref object is an array of objects, which allows
for input references to have options (metadata) but still maintain their
order when (de)serialised.

Fixes https://github.com/osbuild/osbuild-composer/issues/2577
Related to https://github.com/osbuild/osbuild/pull/1003

internal/osbuild2/rpm_stage.go

@@ -49,7 +49,7 @@ type RPMStageInput struct {
 
 	// Collection of references. Each reference defines a package to be
 	// installed, with optional metadata.
-	References RPMStageReferences `json:"references"`
+	References RPMStageSourceArrayRefs `json:"references"`
 }
 
 func (RPMStageInput) isStageInput() {}
@@ -181,13 +181,17 @@ func NewRpmStageSourceFilesInputs(specs []rpmmd.PackageSpec) *RPMStageInputs {
 	return &RPMStageInputs{Packages: stageInput}
 }
 
-func pkgRefs(specs []rpmmd.PackageSpec) RPMStageReferences {
-	refs := make(RPMStageReferences, len(specs))
-	for _, pkg := range specs {
-		refs[pkg.Checksum] = &RPMStageSourceOptions{}
+func pkgRefs(specs []rpmmd.PackageSpec) RPMStageSourceArrayRefs {
+	refs := make(RPMStageSourceArrayRefs, len(specs))
+	for idx, pkg := range specs {
+		refs[idx] = &RPMStageSourceArrayRef{
+			ID: pkg.Checksum,
+		}
 		if pkg.CheckGPG {
-			refs[pkg.Checksum].Metadata = &RPMStageReferenceMetadata{
-				CheckGPG: pkg.CheckGPG,
+			refs[idx].Options = &RPMStageSourceOptions{
+				Metadata: &RPMStageReferenceMetadata{
+					CheckGPG: pkg.CheckGPG,
+				},
 			}
 		}
 	}

internal/osbuild2/stage_test.go

@@ -817,11 +817,16 @@ func TestStageV2_UnmarshalJSON(t *testing.T) {
 				Type: "org.osbuild.rpm",
 				Inputs: &RPMStageInputs{
 					Packages: &RPMStageInput{
-						References: RPMStageReferences{
-							"checksum1": &RPMStageSourceOptions{},
-							"checksum2": &RPMStageSourceOptions{
-								Metadata: &RPMStageReferenceMetadata{
-									CheckGPG: true,
+						References: RPMStageSourceArrayRefs{
+							&RPMStageSourceArrayRef{
+								ID: "checksum1",
+							},
+							&RPMStageSourceArrayRef{
+								ID: "checksum2",
+								Options: &RPMStageSourceOptions{
+									Metadata: &RPMStageReferenceMetadata{
+										CheckGPG: true,
+									},
 								},
 							},
 						},
@@ -832,7 +837,7 @@ func TestStageV2_UnmarshalJSON(t *testing.T) {
 				},
 			},
 			args: args{
-				data: []byte(`{"type":"org.osbuild.rpm","inputs":{"packages":{"type":"","origin":"","references":{"checksum1":{},"checksum2":{"metadata":{"rpm.check_gpg":true}}}}},"options":{"gpgkeys":["key1","key2"]}}`),
+				data: []byte(`{"type":"org.osbuild.rpm","inputs":{"packages":{"type":"","origin":"","references":[{"id":"checksum1"},{"id":"checksum2","options":{"metadata":{"rpm.check_gpg":true}}}]}},"options":{"gpgkeys":["key1","key2"]}}`),
 			},
 		},
 		{