feat: add --[no-]shell-escape flag

.github/Dockerfile.base

@@ -8,10 +8,10 @@ FROM debian:trixie-slim
 #
 # For details, see workflows/base.yml.
 
-ENV LC_ALL C.UTF-8
-ENV DEBIAN_FRONTEND noninteractive
+ENV LC_ALL=C.UTF-8 \
+		DEBIAN_FRONTEND=noninteractive
 
-RUN <<-eot
+RUN <<-BASH
 	set -ex
 
   cat <<-'DPKG' >/etc/dpkg/dpkg.cfg.d/texd-minimal
@@ -29,6 +29,7 @@ DPKG
 		chktex \
 		cm-super \
 		context \
+		curl \
 		dvidvi \
 		dvipng \
 		feynmf \
@@ -74,4 +75,4 @@ DPKG
 
 	apt-get autoremove --yes
 	rm -rf /var/lib/apt/lists/* /var/cache/apt/*
-eot
+BASH

.github/Dockerfile.release

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.4
 ARG GO_VERSION=1.26
 ARG IS_RELEASE=0
-FROM golang:${GO_VERSION}-trixie as builder
+FROM golang:${GO_VERSION}-trixie AS builder
 
 # This Dockerfile is used by GitHub Actions to build the
 # ghcr.io/digineo/texd:latest image whenever there is a commit pushed
@@ -15,7 +15,7 @@ FROM golang:${GO_VERSION}-trixie as builder
 WORKDIR /work
 ADD . /work/
 
-RUN <<-eot
+RUN <<-BASH
 	set -ex
 
 	if [ "${IS_RELEASE}" = "1" ]; then
@@ -26,7 +26,7 @@ RUN <<-eot
 	make build
 
 	./texd --version
-eot
+BASH
 
 FROM ghcr.io/digineo/texd:base
 

README.md

@@ -181,6 +181,19 @@ $ docker run --rm -t ghcr.io/digineo/texd:latest -h
 
   This has no effect when no image tags are given to the command line.
 
+- `--shell-escape` and `--no-shell-escape` (Default: both omitted)
+
+  By default, (La)TeX allows some "trusted" binaries, e.g. `bibtex` and `kpsewhich`, to be executed
+  during the compilation process, since these are sometimes required for packages to work.
+
+  If you want to prohibit the execution of these programs, pass `--no-shell-escape` to `texd`. Note
+  that, as mentioned, some packages will stop working.
+
+  On the other hand, if you want to allow arbitrary command execution (!), for example with
+  `os.execute` in `lualatex`, you may pass `--shell-escape`. Be careful, here be dragons.
+
+  Also note that `--shell-escape` and `--no-shell-escape` are mutually exclusive.
+
 > Note: This option listing might be outdated. Run `texd --help` to get the up-to-date listing.
 
 ## HTTP API

cmd/texd/config.go

@@ -0,0 +1,72 @@
+package main
+
+import (
+	"runtime"
+	"time"
+
+	"github.com/digineo/texd/service"
+	"github.com/digineo/texd/tex"
+	"github.com/docker/go-units"
+	"go.uber.org/zap/zapcore"
+)
+
+const (
+	defaultQueueTimeout       = 10 * time.Second
+	defaultMaxJobSize         = 50 * units.MiB
+	defaultCompileTimeout     = time.Minute
+	defaultRetentionPoolSize  = 100 * units.MiB
+	defaultRetentionPoolItems = 1000
+)
+
+// config holds all command-line configuration.
+type config struct {
+	// Server options
+	addr           string
+	queueLength    int
+	queueTimeout   time.Duration
+	maxJobSize     string // human-readable size
+	compileTimeout time.Duration
+
+	// TeX options
+	engine      string
+	shellEscape int // 0=default, 1=enable, -1=disable
+	jobDir      string
+	keepJobs    int
+
+	// Docker options
+	pull   bool
+	images []string // remaining args after flag parsing
+
+	// Reference store
+	storageDSN  string
+	retPolicy   int
+	retPolItems int
+	retPolSize  string // human-readable size
+
+	// Misc
+	logLevel    string
+	showVersion bool
+}
+
+// defaultConfig returns a config with default values.
+func defaultConfig() *config {
+	return &config{
+		addr:           ":2201",
+		queueLength:    runtime.GOMAXPROCS(0),
+		queueTimeout:   defaultQueueTimeout,
+		maxJobSize:     units.BytesSize(float64(defaultMaxJobSize)),
+		compileTimeout: defaultCompileTimeout,
+		engine:         tex.DefaultEngine.Name(),
+		shellEscape:    0,
+		jobDir:         "",
+		keepJobs:       service.KeepJobsNever,
+		pull:           false,
+		images:         nil,
+		storageDSN:     "",
+		retPolicy:      0,
+		retPolItems:    defaultRetentionPoolItems,
+		retPolSize:     units.BytesSize(float64(defaultRetentionPoolSize)),
+		logLevel:       zapcore.InfoLevel.String(),
+		showVersion:    false,
+	}
+}

cmd/texd/config_test.go

@@ -0,0 +1,30 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/digineo/texd/service"
+	"github.com/digineo/texd/tex"
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/zap/zapcore"
+)
+
+func TestDefaultConfig(t *testing.T) {
+	cfg := defaultConfig()
+
+	assert.Equal(t, ":2201", cfg.addr)
+	assert.Greater(t, cfg.queueLength, 0)
+	assert.Equal(t, defaultQueueTimeout, cfg.queueTimeout)
+	assert.Equal(t, defaultCompileTimeout, cfg.compileTimeout)
+	assert.Equal(t, tex.DefaultEngine.Name(), cfg.engine)
+	assert.Equal(t, 0, cfg.shellEscape)
+	assert.Equal(t, "", cfg.jobDir)
+	assert.Equal(t, service.KeepJobsNever, cfg.keepJobs)
+	assert.False(t, cfg.pull)
+	assert.Nil(t, cfg.images)
+	assert.Equal(t, "", cfg.storageDSN)
+	assert.Equal(t, 0, cfg.retPolicy)
+	assert.Equal(t, 1000, cfg.retPolItems)
+	assert.Equal(t, zapcore.InfoLevel.String(), cfg.logLevel)
+	assert.False(t, cfg.showVersion)
+}