[tex-live] somewhat broken macOS binaries (was: Stripping LuaTeX with "strip -u -r" to allow loading modules)

Patrick Gundlach patrick at gundla.ch
Mon Apr 24 07:09:13 CEST 2017


To Richard:

> In the meantime I want to return to the security issue which Karl raised in the
> original messages on this issue. I haven't studied the language used by Lua, but it looks like the
> test function could do more or less anything, and your example calls luatex without the
> equivalent of --shell-escape. What am I missing?

your and Karl's concerns are valid, of course. LuaTeX provides the command line switch --safer to disable the module loading.

I fail to understand why security is given if module loading works out of the box on Linux but not on Mac, which is the status quo. 

Patrick





More information about the tex-live mailing list