[NTG-context] Two problems with current ruby scripts

Dear all! THe packages of ConTeXt I am currently preparing are tested by a user and he send back the following questions/comments. Could you please comment on this. For the background: I install all the stubs from scripts/context/stubs/unix into /usr/bin, add a texmfstart stub that calls ruby with the right path to texmfstart.rb. ----- Forwarded message from Mike Bird -----

From: Mike Bird Subject: New texexec very confused To: debian-tex-maint@lists.debian.org Date: Tue, 24 Oct 2006 20:52:30 -0700

The new ruby texexec is very confused. The problem of output defaulting to pdf instead of dvi has already been noted. Here are some additional problems:

Command: texexec --output=dvips foo Should produce: foo.dvi Actually produces: foo.pdf

Command: texexec --dvi foo Should produce: foo.dvi Actually produces: foo.dvi AND OVERWRITES foo.ps

--Mike Bird ----- End forwarded message -----

----- Forwarded message from Mike Bird -----

From: Mike Bird Subject: Is texmfstart secure? To: debian-tex-maint@lists.debian.org Date: Tue, 24 Oct 2006 21:08:53 -0700

Package: context 2006.08.08-0.4

If anyone who knows Ruby has time, can you tell if texmfstart is secure? I was really surprised to see client-server code. Even localhost services can lead to privilege escalation if not careful. For example, /usr/share/texmf/scripts/context/ruby/texmfstart.rb contains the following. I'm not a Ruby programmer but the comment leads me to think there is a potential problem here:

# danger lurking buffer = ' ' * 260 length = filemethod.call(filename,buffer,buffer.size) if length>0 then return buffer.slice(0..length-1)

It looks like PRAGMA is trying to reinvent kpsewhich, integrate internet explorer, launch editors, and do a whole bunch of other stuff I haven't figured out. texexec should be a simple wrapper around tex or pdftex but it works via texmfstart.rb which is 2541 lines of Ruby - and that's a lot of Ruby. It may all be wonderful (I am not a Ruby programmer) but it makes me nervous.

Is an older/simpler texexec still available?

--Mike Bird ----- End forwarded message -----

Best wishes Norbert ------------------------------------------------------------------------------- Dr. Norbert Preining Università di Siena Debian Developer Debian TeX Group gpg DSA: 0x09C5B094 fp: 14DF 2E6C 0307 BE6D AD76 A9C0 D2BF 4AA3 09C5 B094 ------------------------------------------------------------------------------- TABLEY SUPERIOR (n.) The look directed at you in a theatre bar in the interval by people who've already got their drinks. --- Douglas Adams, The Meaning of Liff