Restricted \write18 allowlist portability across TeX distributions
Portable restricted shell-escape allowlist A document that runs an external converter through \code{\write18} works on a local workstation but fails in production CI. The goal is to keep the same source compiling under both environments without weakening production security. pdfTeX, XeTeX, and LuaTeX read \code{shell_escape} from texmf.cnf: \code{f} disables