Hi, I have just uploaded luatex 0.37.0. This is a beta in the process towards 0.40.0, the version that will be included in texlive 2009. This beta will be shortlived, the plan is to release the next one in about a week. This release is mainly intended to allow testing of two new things: * The new build process, which is based on the one that will be used for texlive 2009. Lots of build-time stuff is overhauled, and that means that the binary itself as well as the build process needs testing. Please try on your system and let us know if something goes amiss. * The new shell_escape = 'p' functionality invented by Karl and Akira. Karl wrote about that:

As I've mentioned to some of you, Akira and I have been implemented a restricted version of \write18: only commands which are explicitly listed in texmf.cnf can be executed. Along with sufficient quoting, I think that this is secure enough that it can be enabled by default, and I plan to do this for TeX Live 2009.

The texmf.cnf variable for 'acceptable commands' is named shell_escape_commands. In luatex, the variables shell_escape and shell_escape_commands will be fetched from the texconfig table in case of a disabled kpathsea (as context mkiv does). The important thing to note is that if you are typesetting a document with luatex (as opposed to executing a texlua script), these variables now also effect the os.execute(), io.popen(), os.exec() and os.spawn() functions. Unless a non-false value of shell_escape has been read from either texmf.cnf or the texconfig table, these functions will not do anything anymore. Nothing has changed for the case where luatex is used as a script interpreter. ============================================================== Luatex beta-0.37.0 was released 20090331 (commit #2194) ============================================================== * Luatex now implements shell_escape = 'p', a new feature in web2c that intends to make \write18 more secure. * Attributes can now have negative values. The special value for 'unset' is lowered to -0x7FFFFFFF (it used to be -1). * The lua 'kpse' library now has an object-oriented interface as companion to the procedural interface. This is useful for e.g. controlling the discovery of mplib files. * The new internal integer parameter \outputbox allows setting of the output box number (default: 255, max: 65535) * The new primitives \Udelimiterunder and \Udelimiterover complete the set of 'StretchStacks' for OpenType Math. * Fixed a bug in font string conversions on the Macintosh that resulted in warnings about 'unaligned pointers being freed'. * Khaled Hosny spotted a bunch of manual errors. * There was bug in the width of math_accent objects when there were super- or subscripts attached to the accentee. * In PDF mode, TRT \leaders were bugged. * The source tree now uses the new texlive build system that Peter Breitenlohner created. * There is now a single build.sh instead of four separate ones. It has a few options: --make : only make, no make distclean; configure --parallel : make -j 2 -l 3.0 --nostrip : do not strip binary --mingw : crosscompile for mingw32 from i386-linux --ppc : crosscompile for ppc osx on intel osx Note: --parallel still sometimes causes crashes due to timing errors, so use that option with care. * Many compiler warnings have been removed (but not all yet). The archives (now including source again) can be downloaded from supelec as usual: http://foundry.supelec.fr/projects/luatex/ You could also check out the sources via anonymous svn: svn co svn://scm.foundry.supelec.fr/svn/luatex/tags/beta-0.37.0 Bugs and feature requests can be added to the issue tracker at http://tracker.luatex.org Have fun, Taco