Various Composer improvements

plugins/package-managers/bower/src/main/kotlin/Model.kt

@@ -21,13 +21,13 @@ package org.ossreviewtoolkit.plugins.packagemanagers.bower
 
 import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
-import kotlinx.serialization.builtins.ListSerializer
 import kotlinx.serialization.json.Json
 import kotlinx.serialization.json.JsonArray
 import kotlinx.serialization.json.JsonElement
 import kotlinx.serialization.json.JsonObject
 import kotlinx.serialization.json.JsonTransformingSerializer
 import kotlinx.serialization.json.jsonArray
+import kotlinx.serialization.serializer
 
 import org.ossreviewtoolkit.plugins.packagemanagers.bower.PackageMeta.Author
 
@@ -51,7 +51,7 @@ internal data class PackageInfo(
 @Serializable
 internal data class PackageMeta(
     val name: String? = null,
-    @Serializable(with = AuthorListSerializer::class)
+    @Serializable(AuthorListSerializer::class)
     val authors: List<Author> = emptyList(),
     val description: String? = null,
     val license: String? = null,
@@ -98,7 +98,7 @@ internal fun parsePackageInfoJson(json: String): PackageInfo = JSON.decodeFromSt
  * serializer then can be simplified into a single item deserializer. See also
  * https://github.com/Kotlin/kotlinx.serialization/issues/1169#issuecomment-2083213759.
  */
-private object AuthorListSerializer : JsonTransformingSerializer<List<Author>>(ListSerializer(Author.serializer())) {
+private object AuthorListSerializer : JsonTransformingSerializer<List<Author>>(serializer<List<Author>>()) {
     override fun transformDeserialize(element: JsonElement): JsonElement =
         JsonArray(
             element.jsonArray.map { item ->

plugins/package-managers/cocoapods/src/main/kotlin/Podspec.kt

@@ -20,19 +20,19 @@
 package org.ossreviewtoolkit.plugins.packagemanagers.cocoapods
 
 import kotlinx.serialization.Serializable
-import kotlinx.serialization.builtins.serializer
 import kotlinx.serialization.json.Json
 import kotlinx.serialization.json.JsonElement
 import kotlinx.serialization.json.JsonObject
 import kotlinx.serialization.json.JsonPrimitive
 import kotlinx.serialization.json.JsonTransformingSerializer
 import kotlinx.serialization.json.jsonPrimitive
+import kotlinx.serialization.serializer
 
 @Serializable
 internal data class Podspec(
     val name: String = "",
     val version: String = "",
-    @Serializable(with = LicenseSerializer::class)
+    @Serializable(LicenseSerializer::class)
     val license: String = "",
     val summary: String = "",
     val homepage: String = "",
@@ -71,7 +71,7 @@ internal fun String.parsePodspec(): Podspec = JSON.decodeFromString<Podspec>(thi
  * 1. https://github.com/CocoaPods/Specs/blob/f75c24e7e9df1dac6ffa410a6fb30f01e026d4d6/Specs/8/5/e/SocketIOKit/2.0.1/SocketIOKit.podspec.json#L6-L9
  * 2. https://github.com/CocoaPods/Specs/blob/f75c24e7e9df1dac6ffa410a6fb30f01e026d4d6/Specs/8/5/e/FirebaseObjects/0.0.1/FirebaseObjects.podspec.json#L6
  */
-private object LicenseSerializer : JsonTransformingSerializer<String>(String.serializer()) {
+private object LicenseSerializer : JsonTransformingSerializer<String>(serializer<String>()) {
     override fun transformDeserialize(element: JsonElement): JsonElement =
         if (element is JsonObject) {
             element["type"]?.jsonPrimitive ?: JsonPrimitive("")

plugins/package-managers/composer/build.gradle.kts

@@ -20,6 +20,9 @@
 plugins {
     // Apply precompiled plugins.
     id("ort-library-conventions")
+
+    // Apply third-party plugins.
+    alias(libs.plugins.kotlinSerialization)
 }
 
 dependencies {
@@ -37,9 +40,8 @@ dependencies {
     implementation(projects.utils.ortUtils)
     implementation(projects.utils.spdxUtils)
 
-    implementation(libs.jackson.core)
-    implementation(libs.jackson.databind)
-    implementation(libs.jackson.module.kotlin)
+    implementation(libs.kotlinx.serialization.core)
+    implementation(libs.kotlinx.serialization.json)
 
     funTestImplementation(testFixtures(projects.analyzer))
 }

plugins/package-managers/composer/src/main/kotlin/Composer.kt

@@ -46,6 +46,7 @@ import org.ossreviewtoolkit.utils.common.CommandLineTool
 import org.ossreviewtoolkit.utils.common.Os
 import org.ossreviewtoolkit.utils.common.collectMessages
 import org.ossreviewtoolkit.utils.common.splitOnWhitespace
+import org.ossreviewtoolkit.utils.common.stashDirectories
 import org.ossreviewtoolkit.utils.ort.showStackTrace
 
 import org.semver4j.RangesList
@@ -122,12 +123,16 @@ class Composer(
             return listOf(result)
         }
 
-        val lockfile = ensureLockfile(workingDir).let {
-            logger.info { "Parsing lockfile at '$it'..." }
-            parseLockfile(it.readText())
+        val lockfile = stashDirectories(workingDir.resolve("vendor")).use { _ ->
+            ensureLockfile(workingDir).let {
+                logger.info { "Parsing lockfile at '$it'..." }
+                parseLockfile(it.readText())
+            }
         }
 
-        val packages = parseInstalledPackages(lockfile)
+        val packages = (lockfile.packages + lockfile.packagesDev).associate {
+            checkNotNull(it.name) to it.toPackage()
+        }
 
         // Let's also determine the "virtual" (replaced and provided) packages. These can be declared as
         // required, but are not listed in composer.lock as installed.
@@ -233,11 +238,6 @@ class Composer(
         )
     }
 
-    private fun parseInstalledPackages(lockfile: Lockfile): Map<String, Package> =
-        (lockfile.packages + lockfile.packagesDev).associate {
-            checkNotNull(it.name) to it.toPackage()
-        }
-
     private fun ensureLockfile(workingDir: File): File {
         val lockfile = workingDir.resolve(COMPOSER_LOCK_FILE)
 

plugins/package-managers/composer/src/main/kotlin/Model.kt

@@ -19,60 +19,70 @@
 
 package org.ossreviewtoolkit.plugins.packagemanagers.composer
 
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties
-import com.fasterxml.jackson.annotation.JsonProperty
-import com.fasterxml.jackson.module.kotlin.readValue
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonArray
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.JsonTransformingSerializer
+import kotlinx.serialization.serializer
 
-import org.ossreviewtoolkit.model.jsonMapper
-
-@JsonIgnoreProperties(ignoreUnknown = true)
+@Serializable
 internal data class Lockfile(
     val packages: List<PackageInfo> = emptyList(),
-    @JsonProperty("packages-dev")
+    @SerialName("packages-dev")
     val packagesDev: List<PackageInfo> = emptyList()
 )
 
-@JsonIgnoreProperties(ignoreUnknown = true)
+@Serializable
 internal data class PackageInfo(
-    val name: String?,
+    val name: String? = null,
     // See https://getcomposer.org/doc/04-schema.md#version.
-    val version: String?,
-    val homepage: String?,
-    val description: String?,
+    val version: String? = null,
+    val homepage: String? = null,
+    val description: String? = null,
     val source: Source? = null,
     val authors: List<Author> = emptyList(),
+    @Serializable(LicenseListSerializer::class)
     val license: List<String> = emptyList(),
     val provide: Map<String, String> = emptyMap(),
     val replace: Map<String, String> = emptyMap(),
     val require: Map<String, String> = emptyMap(),
-    @JsonProperty("require-dev")
+    @SerialName("require-dev")
     val requireDev: Map<String, String> = emptyMap(),
     val dist: Dist? = null
 ) {
-    @JsonIgnoreProperties(ignoreUnknown = true)
+    @Serializable
     data class Author(
         val name: String? = null,
         val email: String? = null,
         val homepage: String? = null,
         val role: String? = null
     )
 
-    @JsonIgnoreProperties(ignoreUnknown = true)
+    @Serializable
     data class Source(
         val type: String? = null,
         val url: String? = null,
         val reference: String? = null
     )
 
-    @JsonIgnoreProperties(ignoreUnknown = true)
+    @Serializable
     data class Dist(
-        val type: String?,
-        val url: String?,
-        val reference: String?,
-        val shasum: String?
+        val type: String? = null,
+        val url: String? = null,
+        val reference: String? = null,
+        val shasum: String? = null
     )
 }
 
-internal fun parseLockfile(json: String): Lockfile = jsonMapper.readValue<Lockfile>(json)
+private val JSON = Json { ignoreUnknownKeys = true }
+
+private object LicenseListSerializer : JsonTransformingSerializer<List<String>>(serializer<List<String>>()) {
+    override fun transformDeserialize(element: JsonElement): JsonElement =
+        if (element !is JsonArray) JsonArray(listOf(element)) else element
+}
+
+internal fun parseLockfile(json: String): Lockfile = JSON.decodeFromString<Lockfile>(json)
 
-internal fun parsePackageInfo(json: String): PackageInfo = jsonMapper.readValue<PackageInfo>(json)
+internal fun parsePackageInfo(json: String): PackageInfo = JSON.decodeFromString<PackageInfo>(json)

plugins/scanners/scancode/src/main/kotlin/ScanCodeResultModel.kt

@@ -20,11 +20,10 @@
 package org.ossreviewtoolkit.plugins.scanners.scancode
 
 import kotlinx.serialization.Serializable
-import kotlinx.serialization.builtins.ListSerializer
-import kotlinx.serialization.builtins.serializer
 import kotlinx.serialization.json.JsonArray
 import kotlinx.serialization.json.JsonElement
 import kotlinx.serialization.json.JsonTransformingSerializer
+import kotlinx.serialization.serializer
 
 import org.ossreviewtoolkit.utils.spdx.SpdxConstants
 import org.ossreviewtoolkit.utils.spdx.SpdxExpression
@@ -205,7 +204,7 @@ data class LicenseReference(
  * A serializer that wraps an old primitive input option from ScanCode 3 into an array like it is for recent ScanCode
  * versions. Note that the input option format changed before the output format version property was introduced.
  */
-private object InputListSerializer : JsonTransformingSerializer<List<String>>(ListSerializer(String.serializer())) {
+private object InputListSerializer : JsonTransformingSerializer<List<String>>(serializer<List<String>>()) {
     override fun transformDeserialize(element: JsonElement): JsonElement =
         if (element !is JsonArray) JsonArray(listOf(element)) else element
 }