Replace yajl

[saschagrunert]

I'd like to propose replacing yajl with something maintained and more future proof. It looks like we can choose from:

• mu_json
• JSON_checker
• YAJL
• LibU
• json-c
• json-parser
• jsonsl
• WJElement
• M's JSON parser
• cJSON
• Jansson
• jsmn
• parson
• ujson4c
• frozen
• microjson
• mjson
• progbase
• lwjson
• cisson
• nanoJSONc

While projects like json-c seem to be great from a functional perspective, it looks like the rely on CMake, which is not the build system used for this project. Do we have any preference?

Generally I'd like to propose to introduce the new dependency and replace yajl step by step to avoid introducing regressions. This means that we have two JSON libraries in place for a while until we remove it completely from the code.

Would that work?

[rphillips]

Many of these examples are not active projects. cJSON, jansson, or json-c seem like the more obvious choices. Can we carry an autoconf patch for one of these projects? Fedora has cJSON, jansson, and json-c included in the main repo.

An evaluation of how many CVEs have been fixed (and how long) by the projects might be useful too.

[saschagrunert]

jansson seems to be a simple and small replacement. It also supports the current build toolchain. I'm proposing to add that in #139

[saschagrunert]

I had a chat with @giuseppe and we now consider to keep it as-is and maintain the yaijl library in the containers org.

[saschagrunert]

@xw19 would like to dive into that topic, I'm happy to help with that :)

[xw19]

@saschagrunert Yes, I would look into this.

[saschagrunert]

Thanks to @xw19, most of the libocispec work is now done! 🥳

We can try to move the logic into crun now by continuing the work on containers/crun#1608