Pedro Camargo via QGIS-Developer <[email protected]> writes:
> I maintain a couple of plugins that require a substantial number of > extra Python packages (many of which have compiled/binary > components). Hence, those plugins install all such requirements in a > folder directly inside the plugin itself, keeping it quite clean when > the user wants to remove said plugins. > > I have been doing it this way for many years now, but this weekend I > received security alerts that both plugins were taken down due to code > that downloads extra dependencies (offending code at > https://github.com/AequilibraE/qaequilibrae/blob/develop/qaequilibrae/download_extra_packages_class.py > ). > > Does anyone have any recommendations on how to proceed? What is > currently the recommended way for plugins to install further > dependencies? I'm not really sure about plugins, but as a general comment about packaging, it's a bug for the build of any program to download anything. The preferred approach is to have packages for things that are needed and express a dependency within the packaging system. For example, qgis depends on qt5 or qt6. Plugins have a main conceptual path where they are just python code, and only depend on qgis and things that are required by any qgis installation. That's fine when it works. I don't see how to address this without turning the qgis plugin system into yet another full-blown packaging system. The only safe and sound approach I see is to ask the user to install -- with OS packages -- the external python/C modules that your plugin needs. But obviously that's not a good experience. You can mitigate some of the risk by downloading only specific versions identified by version number and hash, and checking the hash before unpacking. I wonder how many operating systems and CPUs your plugins work on. Besides GNU/Linux, macOS, and Windows, qgis runs on various BSDs and surely a few other systems, and likely a pretty large variety of cpu types. This is an area where download/build can be problematic if what is downloaded is not adequately portable. I realize this is generalities and handwavy and it will be interesting to see what others say. _______________________________________________ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
