[tex-live] TL2017/LuaTeX "bug" (but also probably in all other distributions as well)

[Patrick Gundlach]

Hello Karl, hello all,


> Hi Patrick - sorry, but I am not enthused about distributing an
> unstripped luatex in TL.


> There's the annoyance of a special case in the
> build,

annoyance? It is an advertised feature of LuaTeX which works on Linux and Windows, but not on Mac. So I'd consider this a bug. If I remember correctly, linking on OS X works for some modules but not for others. 

> and the downside of occupying extra space for the benefit of a
> tiny percentage of users.

a) I am not sure if this actually increases size of the binary (significantly) First this seems to be a problem on OS X only and I have read some reports that this does not increase the size, depending on the command line arguments given to strip. But I have to investigate further. This comes up on the LuaTeX mailing list once in a while and on the web (tex.stackexchange.com). 

b) How many users must be affected by a bug to work on a fix (which is a very trivial fix)?


> In addition, being able to load .so files is immediately and completely
> insecure, so the fact that it fails with the TL does not seem bad to
> me.

so is linking to .so files worse than shell escape?

Both can be switched on and off, so in a secure sensitive environment one can turn it off. And I can't see a security gain if this works on Windows and Linux, but not on Mac.

> Overall, it seems to me that people who want to use .so files should be
> able to build from the sources themselves, or get a binary
> elsewhere.

I disagree. Being able to use software like mysql directly from TeX is a \HUGE benefit of LuaTeX. I have gotten several emails in the last years discussing the ability do this. 

Sorry that I keep insisting, I believe this would be a very good thing if we can fix this.

Patrick