Release commit created with Cranko.

+++ cranko-release-info-v1
[[projects]]
qnames = ["tectonic_xdv", "cargo"]
version = "0.1.12"
age = 6

[[projects]]
qnames = ["tectonic_errors", "cargo"]
version = "0.2.0"
age = 6

[[projects]]
qnames = ["tectonic_status_base", "cargo"]
version = "0.2.0"
age = 0

[[projects]]
qnames = ["tectonic_io_base", "cargo"]
version = "0.3.0"
age = 0

[[projects]]
qnames = ["tectonic_geturl", "cargo"]
version = "0.2.1"
age = 0

[[projects]]
qnames = ["tectonic_docmodel", "cargo"]
version = "0.1.0"
age = 0

[[projects]]
qnames = ["tectonic_dep_support", "cargo"]
version = "0.1.0"
age = 10

[[projects]]
qnames = ["tectonic_cfg_support", "cargo"]
version = "0.1.3"
age = 6

[[projects]]
qnames = ["tectonic_bundles", "cargo"]
version = "0.1.0"
age = 0

[[projects]]
qnames = ["tectonic_bridge_icu", "cargo"]
version = "0.2.0"
age = 6

[[projects]]
qnames = ["tectonic_bridge_graphite2", "cargo"]
version = "0.2.0"
age = 6

[[projects]]
qnames = ["tectonic_bridge_harfbuzz", "cargo"]
version = "0.2.2"
age = 2

[[projects]]
qnames = ["tectonic_bridge_freetype2", "cargo"]
version = "0.2.0"
age = 6

[[projects]]
qnames = ["tectonic_bridge_flate", "cargo"]
version = "0.1.1"
age = 7

[[projects]]
qnames = ["tectonic_bridge_core", "cargo"]
version = "0.2.0"
age = 0

[[projects]]
qnames = ["tectonic_xetex_layout", "cargo"]
version = "0.1.0"
age = 6

[[projects]]
qnames = ["tectonic_pdf_io", "cargo"]
version = "0.1.0"
age = 6

[[projects]]
qnames = ["tectonic_engine_xetex", "cargo"]
version = "0.1.1"
age = 0

[[projects]]
qnames = ["tectonic_engine_xdvipdfmx", "cargo"]
version = "0.1.0"
age = 6

[[projects]]
qnames = ["tectonic_engine_bibtex", "cargo"]
version = "0.1.1"
age = 5

[[projects]]
qnames = ["tectonic", "cargo"]
version = "0.6.0"
age = 0

+++

CARGO_README.md

@@ -57,8 +57,10 @@ sub-crates:
 - [`tectonic_bridge_graphite2`](https://crates.io/crates/tectonic_bridge_graphite2)
 - [`tectonic_bridge_harfbuzz`](https://crates.io/crates/tectonic_bridge_harfbuzz)
 - [`tectonic_bridge_icu`](https://crates.io/crates/tectonic_bridge_icu)
+- [`tectonic_bundles`](https://crates.io/crates/tectonic_bundles)
 - [`tectonic_cfg_support`](https://crates.io/crates/tectonic_cfg_support)
 - [`tectonic_dep_support`](https://crates.io/crates/tectonic_dep_support)
+- [`tectonic_docmodel`](https://crates.io/crates/tectonic_docmodel)
 - [`tectonic_engine_bibtex`](https://crates.io/crates/tectonic_engine_bibtex)
 - [`tectonic_engine_xdvipdfmx`](https://crates.io/crates/tectonic_engine_xdvipdfmx)
 - [`tectonic_engine_xetex`](https://crates.io/crates/tectonic_engine_xetex)

CHANGELOG.md

@@ -1,3 +1,60 @@
+# tectonic 0.6.0 (2021-06-15)
+
+This release adds some helpful new utilities and internal cleanups, which
+involve breaking API changes (see below).
+
+- New V2 command `tectonic -X show user-cache-dir` to print out the
+  location of the per-user cache directory. FAQ, answered! (@pkgw, #786)
+- New V2 command `tectonic -X bundle search` to print out listings of files
+  contained in the "bundle" of TeX support files. If run in a workspace
+  containing a `Tectonic.toml` file, the workspace’s bundle is queried;
+  otherwise, the default bundle is queried. (@pkgw, #786)
+- New V2 command `tectonic -X bundle cat` to print out one of the support files,
+  with the same general behavior as the `search` command. You could also use
+  this to ensure that a particular file has been loaded into the local cache.
+  (@pkgw, #786).
+- Improved security model regarding the "shell-escape" feature, which has the
+  potential to be abused by untrusted inputs. A new `--untrusted` argument to
+  the V1 CLI and `tectonic -X build` disables the use of shell-escape, and any
+  other known-insecure features, regardless of the presence of `-Z shell-escape`
+  or any other options. Therefore, if you're writing a script that processes
+  untrusted input, if you make sure to run `tectonic --untrusted ...` you can be
+  confident that further command-line arguments can't undo your sandboxing.
+  Furthermore, if the environment variable `$TECTONIC_UNTRUSTED_MODE` is set to
+  a non-empty value, the effect is as if `--untrusted` had been provided.
+  (@pkgw, #787)
+- You know what ... get rid of the "beta" message in the V1 CLI.
+- Fix SyncTeX output, we hope (e.g., #720, #744; @hulloanson, @pkgw, #762).
+  Tectonic's SyncTeX files should now include correct, absolute filesystem paths
+  when appropriate.
+- Fix some broken low-level XeTeX built-ins, reported by @burrbull (@pkgw, #714,
+  #783)
+
+A few more more words on the security model: the terminology is a bit slippery
+here since we of course never intend to deliver a product that has security
+flaws. But features like shell-escape, while providing useful functionality, can
+certainly be abused to do malicious things given a hostile input. The default UX
+aims to be conservative about these features, but if a user wants to enable
+them, we'll allow them -- in the same way that Rust/Cargo will compile and run
+`build.rs` scripts that in principle could do just about anything on your
+machine. Our main security distinction is therefore whether the input is trusted
+by the user running Tectonic. The decision of whether to "trust" an input or not
+is something that fundamentally has to be made at a level higher above Tectonic
+itself. Therefore the goal of Tectonic in this area is to provide the user with
+straightforward and effective tools to express that decision.
+
+For developers, this release adds two new Cargo crates to the Tectonic
+ecosystem: `tectonic_docmodel`, allowing manipulation of `Tectonic.toml` files
+and their related data structures; and `tectonic_bundles`, allowing manipulation
+of the Tectonic support file bundles. In both cases, third-party tools might
+wish to use these formats without having to pull in all of the heavyweight
+dependencies of the main `tectonic` crate. And in both cases, the separation has
+led to many API improvements and cleanups that greatly improve the overall code
+structure. These changes break the API of the `tectonic` crate by removing some
+old modules and changing the particular traits and types used to implement these
+systems. (@pkgw, #785, #786)
+
+
 # tectonic 0.5.2 (2021-06-08)
 
 - Update dependencies, including [`watchexec`]. We believe that this should fix

Cargo.toml

@@ -4,7 +4,7 @@
 
 [package]
 name = "tectonic"
-version = "0.5.2"
+version = "0.6.0"
 authors = ["Peter Williams <[email protected]>"]
 description = """
 A modernized, complete, embeddable TeX/LaTeX engine. Tectonic is forked from the XeTeX
@@ -32,8 +32,10 @@ members = [
   "crates/bridge_graphite2",
   "crates/bridge_harfbuzz",
   "crates/bridge_icu",
+  "crates/bundles",
   "crates/cfg_support",
   "crates/dep_support",
+  "crates/docmodel",
   "crates/engine_bibtex",
   "crates/engine_xdvipdfmx",
   "crates/engine_xetex",
@@ -51,7 +53,6 @@ name = "tectonic"
 crate-type = ["rlib"]
 
 [dependencies]
-app_dirs = { version = "2", package = "app_dirs2" }
 atty = "0.2"
 byte-unit = "^4.0"
 cfg-if = "1.0"
@@ -65,13 +66,15 @@ open = "1.4.0"
 serde = { version = "^1.0", features = ["derive"], optional = true }
 sha2 = "^0.9"
 structopt = "0.3"
-tectonic_bridge_core = { path = "crates/bridge_core", version =">=0.1.0,<1"}
+tectonic_bridge_core = { path = "crates/bridge_core", version =">=0.2.0,<1"}
+tectonic_bundles = { path = "crates/bundles", version =">=0.1.0,<1", default-features = false }
+tectonic_docmodel = { path = "crates/docmodel", version =">=0.1.0,<1", optional = true }
 tectonic_engine_bibtex = { path = "crates/engine_bibtex", version =">=0.1.0,<1"}
 tectonic_engine_xdvipdfmx = { path = "crates/engine_xdvipdfmx", version =">=0.1.0,<1"}
-tectonic_engine_xetex = { path = "crates/engine_xetex", version =">=0.1.0,<1"}
+tectonic_engine_xetex = { path = "crates/engine_xetex", version =">=0.1.1,<1"}
 tectonic_errors = { path = "crates/errors", version =">=0.1.0,<1"}
 tectonic_geturl = { path = "crates/geturl", version =">=0.2.0,<1", default-features = false }
-tectonic_io_base = { path = "crates/io_base", version =">=0.2.0,<1"}
+tectonic_io_base = { path = "crates/io_base", version =">=0.3.0,<1"}
 tectonic_status_base = { path = "crates/status_base", version =">=0.1.0,<1"}
 tectonic_xdv = { path = "crates/xdv", version =">=0.1.9,<1"}
 tectonic_xetex_layout = { path = "crates/xetex_layout", version =">=0.1.0,<1"}
@@ -85,17 +88,20 @@ zip = { version = "^0.5", default-features = false, features = ["deflate"] }
 [features]
 default = ["geturl-reqwest", "serialization"]
 
-# Note: we used to have this to couple "serde" and "serde-derive", but we've
-# adopted the newer scheme to avoid having to depend on both -- should maybe
-# just get rid of this feature:
-serialization = ["serde", "toml"]
+# The main motivation for this feature was to be able to compile without
+# proc-macros (via serde-derive), for statically-linked targets which can't use
+# them. In the CI, we now build for statically-linked targets using a
+# cross-compilation model that allows us to have proc-macros anyway. So maybe
+# this feature should go away? It's kind of annoying to support, and at this
+# point proc-macros may have snuck into the dependency tree elsewhere, anyway.
+serialization = ["serde", "tectonic_docmodel", "toml"]
 
 external-harfbuzz = ["tectonic_engine_xetex/external-harfbuzz"]
 
-geturl-curl = ["tectonic_geturl/curl"]
-geturl-reqwest = ["tectonic_geturl/reqwest"]
+geturl-curl = ["tectonic_bundles/geturl-curl", "tectonic_geturl/curl"]
+geturl-reqwest = ["tectonic_bundles/geturl-reqwest", "tectonic_geturl/reqwest"]
 
-native-tls-vendored = ["tectonic_geturl/native-tls-vendored"]
+native-tls-vendored = ["tectonic_bundles/native-tls-vendored", "tectonic_geturl/native-tls-vendored"]
 
 # developer feature to compile with the necessary flags for profiling tectonic.
 profile = []
@@ -119,19 +125,21 @@ x86_64-unknown-linux-gnu = { install = ["fontconfig","freetype","harfbuzz[icu,gr
 x86_64-pc-windows-msvc = { triplet = "x64-windows-static", install = ["fontconfig","freetype","harfbuzz[icu,graphite2]"] }
 
 [package.metadata.internal_dep_versions]
-tectonic_bridge_core = "thiscommit:2021-06-02:Oiyoowe2"
+tectonic_bridge_core = "thiscommit:2021-06-14:3sp2O1O"
 tectonic_bridge_flate = "thiscommit:2021-01-01:eer4ahL4"
 tectonic_bridge_graphite2 = "2c1ffcd702a662c003bd3d7d0ca4d169784cb6ad"
 tectonic_bridge_harfbuzz = "2c1ffcd702a662c003bd3d7d0ca4d169784cb6ad"
 tectonic_bridge_icu = "2c1ffcd702a662c003bd3d7d0ca4d169784cb6ad"
+tectonic_bundles = "thiscommit:2021-06-13:Q0esYor"
 tectonic_cfg_support = "thiscommit:aeRoo7oa"
 tectonic_dep_support = "5faf4205bdd3d31101b749fc32857dd746f9e5bc"
+tectonic_docmodel = "cd77b60d48b1ae3ef80d708e6858ea91cd9fa812"
 tectonic_engine_bibtex = "thiscommit:2021-01-17:KuhaeG1e"
 tectonic_engine_xdvipdfmx = "7dcbc52e58f9774b3d592919a9105377faeac509"
-tectonic_engine_xetex = "thiscommit:2021-06-02:nahbie2O"
+tectonic_engine_xetex = "b7a4085fa67c831d4532da6661bddafd1f9c24ff"
 tectonic_errors = "317ae79ceaa2593fb56090e37bf1f5cc24213dd9"
 tectonic_geturl = "thiscommit:2021-01-16:Aikoob9c"
-tectonic_io_base = "thiscommit:2021-01-16:SaeK7eex"
+tectonic_io_base = "thiscommit:2021-06-13:XFjtSsZ"
 tectonic_status_base = "317ae79ceaa2593fb56090e37bf1f5cc24213dd9"
 tectonic_xdv = "c91f2ef37858d1a0a724a5c3ddc2f7ea46373c77"
 tectonic_xetex_layout = "2c1ffcd702a662c003bd3d7d0ca4d169784cb6ad"

crates/bridge_core/CHANGELOG.md

@@ -1,3 +1,15 @@
+# tectonic_bridge_core 0.2.0 (2021-06-15)
+
+- Add a security infrastructure that gives a systematic way to control whether
+  features that can be abused by untrusted inputs, like shell-escape, are
+  enabled. The default is to disable all such features. Callers can request to
+  allow their use, but we use a centralized approach that ensures that such
+  requests will always be denied if the environment variable
+  `$TECTONIC_UNTRUSTED_MODE` is set to a nonempty value (@pkgw, #787).
+- Add a C API allowing us to expose the filesystem paths for just-opened
+  inputs. This is needed for correct SyncTeX support (@hullanson, @pkgw, #762).
+
+
 # tectonic_bridge_core 0.1.0 (2021-06-03)
 
 This is the first release of the "core" bridge crate. It provides a baseline of

crates/bridge_core/Cargo.toml

@@ -5,7 +5,7 @@
 
 [package]
 name = "tectonic_bridge_core"
-version = "0.1.0"
+version = "0.2.0"
 authors = ["Peter Williams <[email protected]>"]
 description = """
 Exposing core backend APIs to the Tectonic C/C++ code.
@@ -24,7 +24,7 @@ lazy_static = "^1.4"
 libc = "^0.2"
 md-5 = "^0.9"
 tectonic_errors = { path = "../errors", version =">=0.2.0,<1"}
-tectonic_io_base = { path = "../io_base", version =">=0.2.0,<1"}
+tectonic_io_base = { path = "../io_base", version =">=0.3.0,<1"}
 tectonic_status_base = { path = "../status_base", version =">=0.1.0,<1"}
 
 [build-dependencies]
@@ -33,5 +33,5 @@ cc = "^1.0.66"
 
 [package.metadata.internal_dep_versions]
 tectonic_errors = "5c9ba661edf5ef669f24f9904f99cca369d999e7"
-tectonic_io_base = "thiscommit:2021-01-16:go5rieNg"
+tectonic_io_base = "f7eeff461778f7082db7ed5097d93aa63119eb12"
 tectonic_status_base = "317ae79ceaa2593fb56090e37bf1f5cc24213dd9"

crates/bridge_core/README.md

@@ -28,6 +28,6 @@ use tectonic_bridge_core;
 
 ## Cargo features
 
-This crate does not currently provides any [Cargo features][features].
+This crate does not currently provide any [Cargo features][features].
 
 [features]: https://doc.rust-lang.org/cargo/reference/features.html