olpc-cjson != JSON

[cgwalters]

ref ostreedev/ostree-rs-ext#652 (comment)

Today the image spec talks about canonical JSON and specifically links to the OLPC canonical json but:

Quoting https://docs.rs/olpc-cjson/latest/olpc_cjson/

(specifically, ASCII control characters 0x00–0x1f are printed literally, which is not valid JSON). Therefore, serde_json cannot necessarily deserialize JSON produced by this formatter.

The efforts in this area are clearly a mess; the spec also links to a fork of Go's encoding/json that is very dead. Since TUF also uses it, its ecosystem looks a bit more maintained and hmm, maybe we just need to add a PR to canonical-json to add an option to fix this?

[cgwalters]

Ah ah wait, I see olpc-cjson's repo is now at https://github.com/awslabs/tough which definitely looks maintained.

[cgwalters]

cc awslabs/tough#810