biblatex-ext-oa fails for retrieving information about open-access-status

[LukasCBossert]

Describe the bug Error message when I try to get the status of a publication.

To Reproduce

\documentclass{scrartcl}

\begin{filecontents*}[overwrite]{testbib.bib}
@Article{wilkinson_fair_2016,
  Author          = {Wilkinson, Mark D. and others},
  Title           = {The {FAIR} Guiding Principles for scientific data
                    management and stewardship},
  JournalTitle    = {Scientific Data},
  Date            = {2016-12},
  DOI             = {10.1038/sdata.2016.18},
  Keywords        = {{FAIR}},
  langid          = {english},
  Number          = {1},
  Pages           = {160018},
  ShortJournal    = {Sci Data},
  URLDate         = {2021-05-31},
  Volume          = {3}
}
\end{filecontents*}

% using quotes esp. for biblatex.
\usepackage{csquotes}
\usepackage[%
backend=biber,
  style=ext-authoryear-ecomp,
  autocite=inline,
  defernumbers=true, % reset numbered bibliography for each chapter
  giveninits=true, % abbreviate the first names
  maxcitenames=1,
  mincitenames=1,
  maxbibnames=99, % show all authors of an bib entry
  dashed=false,
  ]{biblatex}
  % ==== open access publications
  % This allows us to automatically detect if a publication is
  % available open access (does not work always.)
  % In case you need to manually set the open access status
  % use `  options    = {openaccess=auto},`.
  \usepackage[
  doiapi=true,
  enable=true,
  symbolpackage=tikz,
  symbol=oanet]{biblatex-ext-oa}
% vv added
\ExecuteBibliographyOptions{openaccess=doiapi}
\SetDOIAPIMail{m@you.com}% <- this MUST be set for doiapi
% ^^ added

\addbibresource{testbib.bib}

  \begin{document}
  \nocite{*}
  \printbibliography
  \end{document}

Expected behaviour I get the marker if the publication is available open access.

Output

(/usr/local/texlive/2023/texmf-dist/tex/latex/biblatex-ext/biblatex-ext-oa-doia
pi.sty.../2023/texmf-dist/tex/latex/biblatex-ext/blxextdoiapi.lua:41: module 's
ocket.http' not found:
    no field package.preload['socket.http']
    [kpse lua searcher] file not found: 'socket.http'
stack traceback:
    [C]: in function 'require'
    .../2023/texmf-dist/tex/latex/biblatex-ext/blxextdoiapi.lua:41: in main chunk
    [C]: in function 'require'
    [\directlua]:1: in main chunk.
l.40 ...tlua{blxextdoiapi = require("blxextdoiapi")}

Additional context Same issue is also reported here: https://tex.stackexchange.com/questions/697757/biblatex-ext-oa-fails-for-retrieving-information-about-open-access-status

[moewew]

For security reasons LuaTeX no longer enables the sockets library by default (see https://tug.org/~mseven/luatex.html#luasocket for details). If you want to use code that uses sockets (like the open access detection), you now need to run LuaTeX explicitly with the option --socket. The MWE should work as expected when compiled with

lualatex --socket mwe
biber mwe
lualatex --socket mwe
lualatex --socket mwe

See also the following change to the docs on DEV https://github.com/moewew/biblatex-ext/commit/bfbd1af7824b42d6e637652342a1868a24c855e1.

[LukasCBossert]

Thank you! I have missed that change. For anyone interested in getting this up and running using latexmk, I found out this works:

latexmk -lualatex -lualatex="lualatex --socket" biblatex.tex

[JoostScheffer]

Unfortunately this makes it impossible to use this package on Overleaf since (to my knowledge) options cannot be passed to the compiler. Could a possible workaround be created?

---

Update: In my Overleaf project I created a latexmkrc that contains the following line

$lualatex = 'lualatex --socket'

unfortunately this didn't work.

[tomh-overleaf]

I'm Tom from Overleaf Support and I was made aware of this discussion by a user.

You can indeed pass options to the compiler using a latexmkrc file. (I believe that the right way would be $lualatex = 'lualatex --socket %O %S', but I haven't tested.)

However, the problem is that we isolate the compiler so you cannot access the web from within it -- the socket operations are doomed to fail. This is not something we would be considering changing as it has potentially serious security implications.

I hope this helps clarify.

[JoostScheffer]

I'm Tom from Overleaf Support and I was made aware of this discussion by a user.

You can indeed pass options to the compiler using a latexmkrc file. (I believe that the right way would be `$lualatex = 'lualatex --socket $O %S', but I haven't tested.)

However, the problem is that we isolate the compiler so you cannot access the web from within it -- the socket operations are doomed to fail. This is not something we would be considering changing as it has potentially serious security implications.

I hope this helps clarify.

Thanks for the update Tom.

By the way, I believe that the right way would be $lualatex = 'lualatex --socket %O %S'

[moewew]

I don't think there is a workaround in general and as Tom confirms there (probably) is not going to be an Overleaf-specific workaround either.

It was seen as security risk to enable sockets by default in LuaLaTeX. That means that in order to get internet access, which we obviously need to obtain the relevant open access data, we need to run LuaLaTeX with the --socket option. Any workaround (like enabling shell escape and asking curl to download stuff for us) would have to be classified as at least as unsafe as using --sockets. I'd therefore expect any workaround to be at least as difficult/impossible as using --socket directly.

---

BTW: If the open access API starts requiring HTTPS connections (like the DOI.org API did a while back), the whole thing might collapse again, since last time I checked, LuaTeX did not contain the required libraries to issue HTTPS requests (we can only do HTTP).

[tomh-overleaf]

I'm Tom from Overleaf Support and I was made aware of this discussion by a user. You can indeed pass options to the compiler using a latexmkrc file. (I believe that the right way would be `$lualatex = 'lualatex --socket $O %S', but I haven't tested.) However, the problem is that we isolate the compiler so you cannot access the web from within it -- the socket operations are doomed to fail. This is not something we would be considering changing as it has potentially serious security implications. I hope this helps clarify.

Thanks for the update Tom.

By the way, I believe that the right way would be $lualatex = 'lualatex --socket %O %S'

You're welcome, and thanks for correcting, I also edited to minimize the amount of wrong code flying around (sorry, it was Sunday night after a working weekend...)