Use a single JSON library

[aalmiray]

At the moment both Jackson and GSON are configured as dependencies. It would be better if there was only one dependency for processing JSON. Hopeful Jackson will be the chosen one.

in-toto-java/pom.xml

Lines 57 to 74 in 73afcb4

	<!-- Jackson Dependencies -->
	<dependency>
	<groupId>com.fasterxml.jackson.core</groupId>
	<artifactId>jackson-databind</artifactId>
	<version>2.14.1</version>
	</dependency>
	<dependency>
	<groupId>com.fasterxml.jackson.datatype</groupId>
	<artifactId>jackson-datatype-jsr310</artifactId>
	<version>2.14.1</version>
	</dependency>
	<!-- gson: object to json converter -->
	<dependency>
	<groupId>com.google.code.gson</groupId>
	<artifactId>gson</artifactId>
	<version>2.10.1</version>
	<scope>compile</scope>
	</dependency>

[adityasaky]

Hi @aalmiray, do you think you could submit a patch converging on one library? We essentially have two implementations under the hood due to a major refactor a while ago and looks like this was a side effect. Thanks!

[aalmiray]

Sure. My personal preference would be Jackson as stated before. Does that match the goals of the project?

[adityasaky]

cc @SantiagoTorres @Alos

[Alos]

When I implemented the new version of the client it was my preference to use Jackson too. However, we did not remove gson for "compatibility" reasons. We could spend some time making sure the gson generated JSON matches the one from Jackson, but I think it requires the addition of more detail unit tests (Especially for the legacy stuff)

[adityasaky]

I think switching everything over to jackson is fine. @aalmiray do you want to take a stab at it and working on parts that may have some issues with the switch?

[aalmiray]

@adityasaky Yes, I can work on a spike in the coming weeks. I may come back with questions 😅