Migrate from Jackson to kotlinx-serialization (KxS)

[sschuberth]

Benefits of kotlinx-serialization:

• Better runtime performance, as no reflection is used
  • https://apiumhub.com/tech-blog-barcelona/json-in-kotlin-comparing-options/
  • https://bladecoder.medium.com/kotlin-json-benchmark-on-android-2022-moshi-vs-kotlin-serialization-18436c0596c3
  • https://www.ericthecoder.com/2020/11/23/benchmarking-kotlin-json-parsers-jackson-kotlin-and-kotlinx-serialization/
• Kotlin/JS/Native support (to share the model e.g. with the web app reporter)
• Easier use with GraalVM native images as no reflection metadata needs to be configured

Blockers for the migration to kotlinx-serialization:

• ~No official YAML support~; unofficial YAML support is JVM only, so no Kotlin/JS
  • Maybe https://github.com/him188/yamlkt could be used
  • Also https://github.com/krzema12/snakeyaml-engine-kmp might become relevant
• ~Aliases only supported for JSON~ Edit: Released in version 1.2
• ~No property naming strategies~; can we live with camel-case instead of snake-case in ORT result files? (Also see https://github.com/oss-review-toolkit/ort/issues/5715) Edit: https://github.com/Kotlin/kotlinx.serialization/pull/2111 has been merged 🎉
• ~DotNet / NuGet currently need to deserialize XML~, but kotlinx-serialization does not support XML (and probably never will)
  • So probably https://github.com/oss-review-toolkit/ort/issues/5038 needs to be addressed first
  • GitRepo also uses XML (migrated to KxS via https://github.com/pdvrieze/xmlutil in https://github.com/oss-review-toolkit/ort/pull/8827)

Current Gradle modules that still depend on Jackson (edited as needed):

• commands-api (and related, 9 imports)
• common-utils (3 imports)
• evaluated-model (30 imports)
• fossid-webapp (34 imports)
• helper-cli (10 imports)
• model (128 imports)
• scanner (15 imports)
• spdx(-utils) (44 imports)
• test-utils (1 import)

[sschuberth]

FYI @mnonnenmacher, as we recently talked about this.

[sschuberth]

My idea is to start with migrating the independent clients from Jackson to kotlinx-serialization, just to see how it looks like and / or what the performance changes are. For the fun of it, I started with the vulnerable-code client in https://github.com/oss-review-toolkit/ort/tree/vc2kxs.

[sschuberth]

For the fun of it, I started with the vulnerable-code client in https://github.com/oss-review-toolkit/ort/tree/vc2kxs.

See https://github.com/oss-review-toolkit/ort/pull/4353.

[sschuberth]

• No property naming strategies
  • Can we live with camel-case instead of snake-case in ORT result files?

Looks like they changed their mind: https://github.com/Kotlin/kotlinx.serialization/pull/2111

[sschuberth]

Looks like they changed their mind: Kotlin/kotlinx.serialization#2111

This has been merged 😀

[sschuberth]

With kotlinx-serialization 1.5.0 setting a JSON naming strategy is now fully supported.

[sschuberth]

An interesting article about why not to use Jackson: https://blog.lahteenmaki.net/making-jackson-tolerable.html