I am wondering if
texlive-full is bearing any security issues? Why everybody does trust it? Are they checked by anybody?
Thanks for helping and educating me on this point :)
TeX - LaTeX Stack Exchange is a question and answer site for users of TeX, LaTeX, ConTeXt, and related typesetting systems. It only takes a minute to sign up.Sign up to join this community
TeX Live consists of a relatively small number of executable items and a large number of 'other things', principally LaTeX packages, fonts and documentation (PDF files). The standard settings for the binary part of the set up are 'cautious' about potential security risks in the (La)TeX parts of the system, but these are likely to be more theoretical than actual. To the best of my knowledge there has not been an attempt to send to CTAN, and thus to TeX Live, a LaTeX package which deliberately tries to use
\write18 to cause trouble. The number of people who would be affected is very small, and it's extremely unlikely that a self-replicating approach would be successful. The binary parts of the system are of course of more interest in this regard, but again there are not to my knowledge any actual issues (though see Is luatex as secure as pdftex? for discussion on the affect of Lua scripting on security).
All of that said, there is no-one checking each CTAN upload for security fixes, and the TeX Live team take most of their material more-or-less directly from CTAN. As such, if you are looking for some form of 'assurance' on the code then you will have to find a downstream group doing the work. That I know of, Ubuntu do not do this, although you might be better asking on an Ubunut-specific site about that. Perhaps other operating system teams (most obviously OpenBSD) might do such work if they are very security-focussed, but again that is more about those systems than about TeX.
If you are paranoid enough, then you could download the complete source code, read it and the compile it yourself.
However, due to the fact, that most users are not computer scientists, we have to trust the developers of all software we use. In fact we have to trust the manufacturers of everything we do not build/program/make ourselves.
However, open source software provides you and the rest of the world with the source codes. So, the general idea is, that if there was any flaw in the software, it will be noticed and reported by somebody. With closed source software, there is no such thing.
note that everything in tex live comes from ctan, one way or another.
there have, in my time as a ctan manager, been two notifications of virus "detection" on ctan. the first, back in the '90s, complained about a file whose name matched some known virus at the time; its contents were of course, entirely harmless.
the second was more recent, but again proved a false alarm.
i have heard that at least some people run virus scanners over a copy of the ctan stuff; those people don't report any issues to us.
in my opinion, there is no more than a minuscule chance of problems with tex code from ctan, provided that you're careful with any use of
\write 18 to get data from outside tex. i've never heard of any problem reports, even from that (admittedly dodgy) facility.
I believe the vast majority of TeX Live is devoted to fonts and macro packages. These are passive files that do not do anything and cannot be "run" and are therefore safe. There are a small number of executable binary files (e.g.,
pdflatex) and scripts (
latexdiff) that are intended to do things and therefore can pose security risks. From this question of mine, I believe the binaries are built from source by the TeX Live team. This means that there is the additional chance that a malicious CTAN contribution that requires compiling will be caught by the CTAN team. All bets are off for scripts on the other hand. You should be wary when running esoteric scripts and binaries.
For packages, it is possible that a LaTeX file could load a package such that when compiled by
pdflatex that it acts as malware. Running a new version of
\openout is sandboxed, without
shell-escape enabled should reduce these risks. Again, for esoteric packages, you should take a look at what it does.