org.json should not be used - Update unirest library to new version

[koppor]

org.json is non-free software: https://wiki.debian.org/qa.debian.org/jsonevil

Jackson is the way to go.

[Siedlerchr]

I would prefer gson, I use that in share latex and we already have guava as deps

[stefan-kolb]

Is it this library?! https://github.com/stleary/JSON-java We could make a PR there, if you want to.

[koppor]

[koppor]

More readings:

• License  stleary/JSON-java#331 (comment)
• https://github.com/stleary/JSON-java/wiki/The-JSON-Java-license

[koppor]

https://github.com/openjson/openjson seems to be most modern drop-in alternative.

[Siedlerchr]

The reason I prefer gson over the standard json is because it directly supports generics and allows to have a clear hierarchy (all classes are dervied from JsonElement - such kind of structure does not exist in org.json/openjson) and you can always chain methods, e.g. getAsJsonArray().get(0).getAsInt()
Furthermore it is already java 9 compatible,

[koppor]

@Siedlerchr Feel free to rewrite the code of JabRef to use gson instead of org.json. 😇

[Siedlerchr]

The dependency comes from UniRest. http://unirest.io/java.html
I think we decided on the jabcon to remove that dependency and stick with jersey, the official reference implementation.
https://jersey.github.io/
So I will convert the code to use jersey + gson

[koppor]

Yeah - this is the way to go!

Side story: I tried to replace the dependency by openjson during the gradle build. However, they changed the package name to com.github.openjson. Replacing it by 'com.vaadin.external.google:android-json:0.0.20131108.vaadin1' leads to an additional exception JSONException, which needs to be handled by our code somehow.

[Siedlerchr]

I currently try to use it with gson. It works in general, but is has the disadvantage against the openJson implementation that it does not have these pseudo-optional methods:
OpenJson can return pseudo optionals//defaults e.g. if a field is not present it can return an empty string by default.

[tobiasdiez]

So the only reason why we have to rewrite everything JSON and unirest-related is because of a single stupid line in a license file? Can we not just ignore this as we have done so far?

[koppor]

Yes, because we want to keep JabRef distributed in Linux distributions. Otherwise, JabRef is not open source and free software.

This license is considered non-free by Debian, GNU Project, Fedora, Google, Red Hat legal, Free Software Foundation

Source: https://wiki.debian.org/qa.debian.org/jsonevil

+1 for devcall.

[jonasstein]

Which binary of jabref introduced the non free library first? We have to adjust the license settings in distributions. Please update the wrong LICENSE file according to the real license until it is fixed.
Please inform distributions next time you recognize that your license information was wrong.

[Siedlerchr]

@jonasstein It was an external dependency. See above.
I see there is now https://github.com/OpenUnirest/unirest-java
It also uses org.json, but it seems to be under active developmend. so they could replace it with openjson I hope.

[jonasstein]

@Siedlerchr Excuse me, if I misunderstand your reply. As far I could see you provide a jabref JAR which includes the non free org.json library.

[koppor]

Refs Kong/unirest-java#176.

[koppor]

OK HTTP seems to be the recent "cool" http client: https://square.github.io/okhttp/

Other alternatives: https://github.com/eclipse/microprofile-rest-client#implementations

Indepenent of what we do, we need anADR

[darkdragon-001]

@koppor Kong/unirest-java#176 is resolved and allows use of gson instead of org.json.

[Siedlerchr]

As unirest now has removed org.json it should be safe to upgrade to the newest version.
Note that the library name has changed.

[koppor]

@Siedlerchr Could you provide more details (from which name to which name) or just replace the dependency and make a PR? 😇

[Siedlerchr]

I will try to look into it, if no one else is interested. Could be a good first issue.

See the Upgrade guide: https://github.com/Kong/unirest-java/blob/master/UPGRADE_GUIDE.md
New namespace is now:

<dependency>
    <groupId>com.konghq</groupId>
    <artifactId>unirest-java</artifactId>
    <version>3.1.00</version>
</dependency>

[Siedlerchr]

Thanks to @JoHaHu this issue is now resolved.