Ghostscript new (minor) version

[Tomas Rokicki]

Given recent events (xz), I'm hoping we vet those changes and this new
release
*extremely* carefully . . .

-tom

On Fri, May 17, 2024 at 10:27 AM Bruno Voisin via tex-live <tex-live at tug.org>
wrote:

> A new minor version 10.03.1 of Ghostscript has just been released,
> addressing security issues in version 10.03.0. It is not yet visible at the
> main Ghostscript site <https://www.ghostscript.com>, but it is already
> available at
>
> https://github.com/ArtifexSoftware/ghostpdl-downloads/releases
>
> (as prerelease).
>
> More important possibly for TeX and friends is a change already in the
> GitHub development repository, which will be included in the next major
> release 10.04.0 this fall: the impossibility to change the output device
> through PostScript code, unless the new device has been declared upon
> launch through a new option "--permit-devices=".
>
> For the technically inclined, see
>
>
> https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=6e3108b270e926a2dcf3a632e6a298753d935b0c
>
> https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=6e11faa76ce31b87132fa840aeecbd4440d8f55a
>
> I don't know whether there are scripts or apps in TeX Live that use
> PostScript code to change Ghostscript's output device. I thought dvisvgm
> might, for PS-to-SVG conversion; but having compiled the development
> Ghostscript code, it seems dvisvgm is unaffected by the change and works
> with gs exactly the same as before.
>
> Bruno Voisin
>


-- 
-  https://cube20.org/ <http://cube20.org/>  -  https://golly.sf.net/
<http://golly.sf.net/>  - https://alpha.twizzle.net/
/ -
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://tug.org/pipermail/tex-live/attachments/20240517/38f3beb7/attachment.htm>