Is it a possibility for your friend to modify the source, or the environment? You can use, for example,
let force-noto = false // if you need to modify the source code instead
let font = if force-noto or lower(sys.inputs.at("USE_NOTO", default: "0")) in ("1", "true") {
("Noto Serif CJK SC",)
} else {
("Source Han Serif",)
}
set text(font: font, lang: "zh", region: "CN")
then, by default, Typst will try to use Source Han Serif, but if you compile with
typst c file.typ --input USE_NOTO=1
(or if you change force-noto to true in the source code), then it will use Noto Serif CJK SC.
This would be an ideal use case for warning suppression, but unfortunately that feature had to be de-prioritized as it will need further design discussion.
It looks like that typst will never let the document access any system info directly? I think currently the only way is to pass them through --input.
The maintainer laurmaedje once answered my question on security:
…we take the safety of just compiling a Typst file very seriously. Features that would compromise safety (like writing files, shell escape, even reading files outside of the working/project directory, etc.) won’t be accepted into the Typst compiler.
Sorry, I was not clear enough. You pass something like
–input HOSTNAME=$(hostname)
and then inside the document you select the font depending on what the variable has. So you can use the same document with the same call on both computers.