Migrate from Jackson to kotlinx-serialization (KxS)

[sschuberth]

Benefits of kotlinx-serialization:

• Better runtime performance, as no reflection is used
  • https://apiumhub.com/tech-blog-barcelona/json-in-kotlin-comparing-options/
  • https://bladecoder.medium.com/kotlin-json-benchmark-on-android-2022-moshi-vs-kotlin-serialization-18436c0596c3
  • https://www.ericthecoder.com/2020/11/23/benchmarking-kotlin-json-parsers-jackson-kotlin-and-kotlinx-serialization/
• Kotlin/JS/Native support (to share the model e.g. with the web app reporter)
• Easier use with GraalVM native images as no reflection metadata needs to be configured

Blockers for the migration to kotlinx-serialization:

• No official YAML support; unofficial YAML support is JVM only, so no Kotlin/JS
  • Maybe https://github.com/him188/yamlkt could be used
  • Also https://github.com/krzema12/snakeyaml-engine-kmp might become relevant
• Aliases only supported for JSON
  Edit: Released in version 1.2
• No property naming strategies; can we live with camel-case instead of snake-case in ORT result files? (Also see Use camel case instead of snake case for all YAML configuration files #5715)
  Edit: Provide support for JsonNamingStrategy  Kotlin/kotlinx.serialization#2111 has been merged 🎉
• DotNet / NuGet currently need to deserialize XML, but kotlinx-serialization does not support XML (and probably never will)
  • So probably Reimplement NuGet support #5038 needs to be addressed first
  • GitRepo also uses XML (migrated to KxS via https://github.com/pdvrieze/xmlutil in Migrate git-repo manifest parsing from Jackson to KxS #8827)

Current Gradle modules that still depend on Jackson (edit as needed, tick when done):

• commands-api (and related, 9 imports)
• common-utils (3 imports)
• evaluated-model (30 imports)
• fossid-webapp (34 imports)
• helper-cli (10 imports)
• model (128 imports)
• scanner (15 imports)
• spdx(-utils) (44 imports)
• test-utils (1 import)

[sschuberth]

FYI @mnonnenmacher, as we recently talked about this.

[sschuberth]

My idea is to start with migrating the independent clients from Jackson to kotlinx-serialization, just to see how it looks like and / or what the performance changes are. For the fun of it, I started with the vulnerable-code client in https://github.com/oss-review-toolkit/ort/tree/vc2kxs.

[sschuberth]

For the fun of it, I started with the vulnerable-code client in https://github.com/oss-review-toolkit/ort/tree/vc2kxs.

See #4353.

[sschuberth]

• No property naming strategies
  • Can we live with camel-case instead of snake-case in ORT result files?

Looks like they changed their mind: Kotlin/kotlinx.serialization#2111