Restricted \write18 allowlist portability across TeX distributions

Direct answer

Under shell_escape=p, the restricted \write18 allowlist is defined by shell_escape_commands in texmf.cnf. The engine permits only command basenames in that comma-separated list; f disables shell escape entirely and t permits every command.

The allowlist is not portable across TeX Live and MiKTeX releases. Each distribution maintains its own default list, and point releases can revise it. A command that runs locally may be absent on production even when both systems use pdfTeX, XeTeX, or LuaTeX.

Keep production at f or p without adding the converter. Move the external conversion into a pre-build script or Makefile, generate the artifact before compiling, and have the document read the finished file. Locally, you may add the command to a user-level shell_escape_commands entry and use p, but do not use t in CI.

Likely explanation versus confirmed facts

Likely explanation: production CI runs with shell_escape=f, or with p and a shell_escape_commands list that omits your converter. TeX logs a generic disabled-or-restricted shell-escape message because the engine blocks the process before TeX parses the command.

Confirmed facts: shell_escape and shell_escape_commands are read from texmf.cnf at engine startup. TeX Live and MiKTeX ship different default allowlists. Package updates cannot change an engine-level block.

Steps for this case

1. Locate the active configuration file: kpsewhich texmf.cnf
2. Inspect the current values: grep -E 'shell_escape' "$(kpsewhich texmf.cnf)"
3. Reproduce with a minimal document:

\documentclass{article}
\begin{document}
\write18{echo restricted-test > \jobname.out}
\end{document}

Check the log for Shell escape is disabled or Restricted shell escape messages.

1. In production CI, do not edit the system texmf.cnf. Run your converter in a build step before pdflatex, xelatex, or lualatex, then \input or \includegraphics the generated output.
2. Locally, if you must keep \write18, add only the command basename to a user-level texmf.cnf under shell_escape=p. Never set t on a shared build server.

Missing diagnostic detail

One detail changes this recommendation: the exact command name passed to \write18 (for example, convert, inkscape, or epstopdf). Without it, I cannot confirm whether the command appears in either distribution's default allowlist or whether a wrapper script is the safer path.

Verification

• Run kpsewhich -var-value=shell_escape where supported, otherwise parse texmf.cnf directly.
• Compile the minimal document locally and on CI with the same engine and compare the log lines.
• Confirm the generated artifact exists before the document attempts to read it.