2016-07-13 21:45 GMT+08:00 Marc Feeley feeley@iro.umontreal.ca:
Yes that’s one argument (the avoidance of system exploits through some data that is passed to the shell).
There’s also a portability argument. Shell escaping varies between platforms (Unix/Windows), and also from one shell to another.
Moreover, manual shell escaping has always been a nightmare (how many backslashes to add?) that it is best to avoid it completely by letting the implementation do it automatically. I wouldn’t like a system where the user has to worry about the possibility of arguments containing “$” and “\” and double/single quotes.
Ah those are fantastic arguments for it to be like it is now too.
So for your use-case I would suggest:
(define (pkg-config-lib name)
(call-with-input-process (list path: "pkg-config" arguments: (list "--libs" name)) read-line))(pkg-config-lib "zlib")
"-lz"
(compile-file "test.scm" ld-options: (pkg-config-lib "libjpeg"))
Yup perfect.
Thanks!
Best regards