texlive: provide repstopdf

repstopdf is supposed to be a symlink to epstopdf. Then epstopdf looks
at "$0" to detect when restricted mode needs to be enabled.  Unfortunately
our wrapper will drop all intermediate symlinks, which messes up "$0".
Restricted mode appears to be a security feature, so a test is
introduced to verify that the wrapper works as expected.

pkgs/tools/typesetting/tex/texlive/combine.nix

@@ -218,8 +218,29 @@ in buildEnv {
         ln -sv "$(realpath $s)" "$out/bin/$tName" # wrapped below
       done
     )
+  '' +
+    # A hacky way to provide repstopdf
+    #  * Copy is done to have a correct "$0" so that epstopdf enables the restricted mode
+    #  * ./bin/repstopdf needs to be a symlink to be processed by wrapBin
+  ''
+    if [[ -e ./bin/epstopdf ]]; then
+      cp $(realpath ./bin/epstopdf) ./share/texmf/scripts/repstopdf
+      ln -s "$out"/share/texmf/scripts/repstopdf ./bin/repstopdf
+    fi
+  '' +
+    # finish up the wrappers
+  ''
     rm "$out"/bin/*-sys
     wrapBin
+  '' +
+    # Perform a small test to verify that the restricted mode get enabled when
+    # needed (detected by checking if it disallows --gscmd)
+  ''
+    if [[ -e ./bin/epstopdf ]]; then
+      echo "Testing restricted mode for {,r}epstopdf"
+      ! (epstopdf --gscmd echo /dev/null 2>&1 || true) | grep forbidden
+      (repstopdf --gscmd echo /dev/null 2>&1 || true) | grep forbidden
+    fi
   '' +
   # TODO: a context trigger https://www.preining.info/blog/2015/06/debian-tex-live-2015-the-new-layout/
     # http://wiki.contextgarden.net/ConTeXt_Standalone#Unix-like_platforms_.28Linux.2FMacOS_X.2FFreeBSD.2FSolaris.29