Re: [QGIS-Developer] Security issues with plugins
Hi Pedro, I don't think there is any checks yet about calling system command (using subprocess) both used in your plugin and qpip. I see nothing in the implemented security scan: https://github.com/qgis/QGIS-Plugins-Website/blob/18bf205e1c0733bc1f09f15430eff52c1a78a1a3/qgis-app/plugins/security_scanner.py#L67 I ran the security scan on your plugin and get those errors: Detects suspicious file types, hidden files, or unexpected executables - qaequilibrae-develop/.pre-commit-config.yaml': 'Hidden file detected' - qaequilibrae-develop/docs/make.bat: 'Executable or binary file detected (.bat)' So that should be easy to fix those so your plugin can pass the security scan. Kind regards, Julien > Hi Julien, > > This is indeed a possibility. However, there is one thing I do not understand. > > As far as I understand, the way qpip installs dependencies is very > similar to what we do in AequilibraE (command system call). So why is > that qpip is still available through the plugin store? Is there an > important difference I am missing there? > > Cheers, > Pedro > > > From: Julien Cabieces > To: "Pedro Camargo via QGIS-Developer" > Cc: "Pedro Camargo" > Date: Wed, 27 May 2026 20:27:52 +1000 > Subject: Re: [QGIS-Developer] Security issues with plugins > > > > > Hi all, > > > > I think qpip is the best way to solve this particular matter. IMHO, The > only > > drawback now is that you have to add qpip as a plugin dependencies to > > then declare your dependencies. So the first time, QGIS would display > > a popup-up to propose the user to install qpip, and then qpip would > > propose the user to install the dependencies. > > > > This is maybe what people consider combersome for users, but when it's > > already installed, I think it's the proper way to go: We warn user that > > something need to be installed, he agrees or not (just one click!), then > > we install it or not. > > > > Maybe, we should consider integrate it in the core so we skip the first > > step. There is already a plugin dependencies management in QGIS core, so > > that's maybe relevant to extend it to what qpip can do. > > > > Regards, > > Julien > > > > > > > > > Hey Joona, > > > > > > I have looked into qpip, but it is not sufficient. Not only do most > dependencies have binaries, but the process also creates a somewhat > > > cumbersome installation workflow for non-technical users. > > > > > > In the end, the problem seems to be that the plugins I am talking about > are not really GIS plugins, but rather bigger pieces of software with a > > > very significant QGIS component, mostly for visualization purposes, so I > must grant that as a large part of the problem. > > > > > > We will likely explore deploying custom plugin repositories and > developing full installers. It's inconvenient for users, but there isn't > another > > > alternative I can see right now. > > > > > > Cheers, > > > Pedro > > > > > > From: Joona Laine > > > To: "Pedro Camargo" > > > Cc: "Qgis Developer" > > > Date: Mon, 25 May 2026 15:47:55 +1000 > > > Subject: Re: [QGIS-Developer] Security issues with plugins > > > > > > Hello Pedro, > > > > > > qgis-plugin-dev-tools > (https://github.com/nlsfi/qgis-plugin-dev-tools#setup) solves the dependency > issue by including the dependencies > > > with the plugin package. > > > > > > It can easily handle most of (non-binary) requirements by automatically > rewriting the imports of theses vendored dependencies in the > > > build process. > > > This way it is possible to have multiple plugins using different > version of the same requirement without any conflicts. > > > It is also possible to include binary dependencies but there is no > operation system specific logic built yet at the moment. > > > > > > There is also a tool called qpip (https://github.com/opengisch/qpip) > for dependency management, which might be worth checking out. > > > > > > Cheers, > > > Joona > > > > > > ma 25.5.2026 klo 6.35 Pedro Camargo via QGIS-Developer > ([email protected]) kirjoitti: > > > > > > Hey Nyall, > > > > > > I hear you, but let me highlight two points of my original post. > > > > > > *The plugin asks the user wh
Re: [QGIS-Developer] Security issues with plugins
Hi, I'm maintaing the geodatafarm plugin where I have a few dependencies. Earlier it was a hassel for many less thechnical users to install the plugin on different OS etc. I can only recommend using the QPIP plugin as a dependent qgis plugin, since it have solved these issues. Best regards Axel Den ons 27 maj 2026 14:50Pedro Camargo via QGIS-Developer < [email protected]> skrev: > Hi Julien, > > This is indeed a possibility. However, there is one thing I do not > understand. > > As far as I understand, the way qpip installs dependencies is very similar > to what we do in AequilibraE (command system call). So why is that qpip is > still available through the plugin store? Is there an important difference > I am missing there? > > Cheers, > Pedro > > > From: Julien Cabieces > To: "Pedro Camargo via QGIS-Developer" > Cc: "Pedro Camargo" > Date: Wed, 27 May 2026 20:27:52 +1000 > Subject: Re: [QGIS-Developer] Security issues with plugins > > > > > Hi all, > > > > I think qpip is the best way to solve this particular matter. IMHO, The > only > > drawback now is that you have to add qpip as a plugin dependencies to > > then declare your dependencies. So the first time, QGIS would display > > a popup-up to propose the user to install qpip, and then qpip would > > propose the user to install the dependencies. > > > > This is maybe what people consider combersome for users, but when it's > > already installed, I think it's the proper way to go: We warn user that > > something need to be installed, he agrees or not (just one click!), then > > we install it or not. > > > > Maybe, we should consider integrate it in the core so we skip the first > > step. There is already a plugin dependencies management in QGIS core, so > > that's maybe relevant to extend it to what qpip can do. > > > > Regards, > > Julien > > > > > > > > > Hey Joona, > > > > > > I have looked into qpip, but it is not sufficient. Not only do most > dependencies have binaries, but the process also creates a somewhat > > > cumbersome installation workflow for non-technical users. > > > > > > In the end, the problem seems to be that the plugins I am talking > about are not really GIS plugins, but rather bigger pieces of software with > a > > > very significant QGIS component, mostly for visualization purposes, > so I must grant that as a large part of the problem. > > > > > > We will likely explore deploying custom plugin repositories and > developing full installers. It's inconvenient for users, but there isn't > another > > > alternative I can see right now. > > > > > > Cheers, > > > Pedro > > > > > > From: Joona Laine > > > To: "Pedro Camargo" > > > Cc: "Qgis Developer" > > > Date: Mon, 25 May 2026 15:47:55 +1000 > > > Subject: Re: [QGIS-Developer] Security issues with plugins > > > > > > Hello Pedro, > > > > > > qgis-plugin-dev-tools ( > https://github.com/nlsfi/qgis-plugin-dev-tools#setup) solves the > dependency issue by including the dependencies > > > with the plugin package. > > > > > > It can easily handle most of (non-binary) requirements by > automatically rewriting the imports of theses vendored dependencies in the > > > build process. > > > This way it is possible to have multiple plugins using different > version of the same requirement without any conflicts. > > > It is also possible to include binary dependencies but there is no > operation system specific logic built yet at the moment. > > > > > > There is also a tool called qpip (https://github.com/opengisch/qpip) > for dependency management, which might be worth checking out. > > > > > > Cheers, > > > Joona > > > > > > ma 25.5.2026 klo 6.35 Pedro Camargo via QGIS-Developer ( > [email protected]) kirjoitti: > > > > > > Hey Nyall, > > > > > > I hear you, but let me highlight two points of my original post. > > > > > > *The plugin asks the user whether they want to install the > dependencies. > > > *The dependencies are installed in the plugin folder and can > therefore be removed without causing any lasting damage to the > > > user's QGIS installation. > > > > > > Installing additional dependencies in QGIS remains a
Re: [QGIS-Developer] Security issues with plugins
Hi Julien, This is indeed a possibility. However, there is one thing I do not understand. As far as I understand, the way qpip installs dependencies is very similar to what we do in AequilibraE (command system call). So why is that qpip is still available through the plugin store? Is there an important difference I am missing there? Cheers, Pedro From: Julien Cabieces To: "Pedro Camargo via QGIS-Developer" Cc: "Pedro Camargo" Date: Wed, 27 May 2026 20:27:52 +1000 Subject: Re: [QGIS-Developer] Security issues with plugins > > Hi all, > > I think qpip is the best way to solve this particular matter. IMHO, The only > drawback now is that you have to add qpip as a plugin dependencies to > then declare your dependencies. So the first time, QGIS would display > a popup-up to propose the user to install qpip, and then qpip would > propose the user to install the dependencies. > > This is maybe what people consider combersome for users, but when it's > already installed, I think it's the proper way to go: We warn user that > something need to be installed, he agrees or not (just one click!), then > we install it or not. > > Maybe, we should consider integrate it in the core so we skip the first > step. There is already a plugin dependencies management in QGIS core, so > that's maybe relevant to extend it to what qpip can do. > > Regards, > Julien > > > > > Hey Joona, > > > > I have looked into qpip, but it is not sufficient. Not only do most > > dependencies have binaries, but the process also creates a somewhat > > cumbersome installation workflow for non-technical users. > > > > In the end, the problem seems to be that the plugins I am talking about > > are not really GIS plugins, but rather bigger pieces of software with a > > very significant QGIS component, mostly for visualization purposes, so I > > must grant that as a large part of the problem. > > > > We will likely explore deploying custom plugin repositories and developing > > full installers. It's inconvenient for users, but there isn't another > > alternative I can see right now. > > > > Cheers, > > Pedro > > > > From: Joona Laine > > To: "Pedro Camargo" > > Cc: "Qgis Developer" > > Date: Mon, 25 May 2026 15:47:55 +1000 > > Subject: Re: [QGIS-Developer] Security issues with plugins > > > > Hello Pedro, > > > > qgis-plugin-dev-tools > > (https://github.com/nlsfi/qgis-plugin-dev-tools#setup) solves the > > dependency issue by including the dependencies > > with the plugin package. > > > > It can easily handle most of (non-binary) requirements by automatically > > rewriting the imports of theses vendored dependencies in the > > build process. > > This way it is possible to have multiple plugins using different version > > of the same requirement without any conflicts. > > It is also possible to include binary dependencies but there is no > > operation system specific logic built yet at the moment. > > > > There is also a tool called qpip (https://github.com/opengisch/qpip) for > > dependency management, which might be worth checking out. > > > > Cheers, > > Joona > > > > ma 25.5.2026 klo 6.35 Pedro Camargo via QGIS-Developer > > ([email protected]) kirjoitti: > > > > Hey Nyall, > > > > I hear you, but let me highlight two points of my original post. > > > > *The plugin asks the user whether they want to install the > > dependencies. > > *The dependencies are installed in the plugin folder and can > > therefore be removed without causing any lasting damage to the > > user's QGIS installation. > > > > Installing additional dependencies in QGIS remains a painful task for > > less technical users, adding another (somewhat unnecessary) > > hurdle to adoption. > > > > On that note, a fair question could be: Is there a recommended > > low-effort (for users) path to install extra dependencies for plugins? > > > > If not, is that something being considered for the near future? > > > > Cheers, > > Pedro > > > > From: Nyall Dawson > > To: "Pedro Camargo" > > Cc: "Qgis Developer" > > Date: Mon, 25 May 2026 11:12:20 +1000 > > Subject: Re: [QGIS-Developer] Security issues with plugins > > > > On Mon, 25 May 2026 at 08:27, Pedro Camargo via QGIS-Developer
Re: [QGIS-Developer] Security issues with plugins
Hi all, I think qpip is the best way to solve this particular matter. IMHO, The only drawback now is that you have to add qpip as a plugin dependencies to then declare your dependencies. So the first time, QGIS would display a popup-up to propose the user to install qpip, and then qpip would propose the user to install the dependencies. This is maybe what people consider combersome for users, but when it's already installed, I think it's the proper way to go: We warn user that something need to be installed, he agrees or not (just one click!), then we install it or not. Maybe, we should consider integrate it in the core so we skip the first step. There is already a plugin dependencies management in QGIS core, so that's maybe relevant to extend it to what qpip can do. Regards, Julien > Hey Joona, > > I have looked into qpip, but it is not sufficient. Not only do most > dependencies have binaries, but the process also creates a somewhat > cumbersome installation workflow for non-technical users. > > In the end, the problem seems to be that the plugins I am talking about are > not really GIS plugins, but rather bigger pieces of software with a > very significant QGIS component, mostly for visualization purposes, so I must > grant that as a large part of the problem. > > We will likely explore deploying custom plugin repositories and developing > full installers. It's inconvenient for users, but there isn't another > alternative I can see right now. > > Cheers, > Pedro > > From: Joona Laine > To: "Pedro Camargo" > Cc: "Qgis Developer" > Date: Mon, 25 May 2026 15:47:55 +1000 > Subject: Re: [QGIS-Developer] Security issues with plugins > > Hello Pedro, > > qgis-plugin-dev-tools (https://github.com/nlsfi/qgis-plugin-dev-tools#setup) > solves the dependency issue by including the dependencies > with the plugin package. > > It can easily handle most of (non-binary) requirements by automatically > rewriting the imports of theses vendored dependencies in the > build process. > This way it is possible to have multiple plugins using different version of > the same requirement without any conflicts. > It is also possible to include binary dependencies but there is no operation > system specific logic built yet at the moment. > > There is also a tool called qpip (https://github.com/opengisch/qpip) for > dependency management, which might be worth checking out. > > Cheers, > Joona > > ma 25.5.2026 klo 6.35 Pedro Camargo via QGIS-Developer > ([email protected]) kirjoitti: > > Hey Nyall, > > I hear you, but let me highlight two points of my original post. > > *The plugin asks the user whether they want to install the > dependencies. > *The dependencies are installed in the plugin folder and can > therefore be removed without causing any lasting damage to the > user's QGIS installation. > > Installing additional dependencies in QGIS remains a painful task for less > technical users, adding another (somewhat unnecessary) > hurdle to adoption. > > On that note, a fair question could be: Is there a recommended low-effort > (for users) path to install extra dependencies for plugins? > > If not, is that something being considered for the near future? > > Cheers, > Pedro > > From: Nyall Dawson > To: "Pedro Camargo" > Cc: "Qgis Developer" > Date: Mon, 25 May 2026 11:12:20 +1000 > Subject: Re: [QGIS-Developer] Security issues with plugins > > On Mon, 25 May 2026 at 08:27, Pedro Camargo via QGIS-Developer > wrote: > > > > Hello fellow QGISrs, > > > > > > > > I maintain a couple of plugins that require a substantial number of extra > Python packages (many of which have > compiled/binary components). Hence, those plugins install all such > requirements in a folder directly inside the plugin itself, > keeping it quite clean when the user wants to remove said plugins. > > > > > > I have been doing it this way for many years now, but this weekend I > received security alerts that both plugins were taken down > due to code that downloads extra dependencies (offending code at > qaequilibrae/qaequilibrae/download_extra_packages_class.py at develop · > AequilibraE/qaequilibrae). > > > > Does anyone have any recommendations on how to proceed? What is currently > the recommended way for plugins to install > further dependencies? > > My personal 2c: a plugin should NEVER automatically install dependencies > like this. Rather, you should detect missing > dependencies, warn the user, and point them to a documentation page > dir
Re: [QGIS-Developer] Security issues with plugins
Hey Joona, I have looked into qpip, but it is not sufficient. Not only do most dependencies have binaries, but the process also creates a somewhat cumbersome installation workflow for non-technical users. In the end, the problem seems to be that the plugins I am talking about are not really GIS plugins, but rather bigger pieces of software with a very significant QGIS component, mostly for visualization purposes, so I must grant that as a large part of the problem. We will likely explore deploying custom plugin repositories and developing full installers. It's inconvenient for users, but there isn't another alternative I can see right now. Cheers, Pedro From: Joona Laine To: "Pedro Camargo" Cc: "Qgis Developer" Date: Mon, 25 May 2026 15:47:55 +1000 Subject: Re: [QGIS-Developer] Security issues with plugins Hello Pedro, qgis-plugin-dev-tools ( https://github.com/nlsfi/qgis-plugin-dev-tools#setup ) solves the dependency issue by including the dependencies with the plugin package. It can easily handle most of (non-binary) requirements by automatically rewriting the imports of theses vendored dependencies in the build process. This way it is possible to have multiple plugins using different version of the same requirement without any conflicts. It is also possible to include binary dependencies but there is no operation system specific logic built yet at the moment. There is also a tool called qpip ( https://github.com/opengisch/qpip ) for dependency management, which might be worth checking out. Cheers, Joona ma 25.5.2026 klo 6.35 Pedro Camargo via QGIS-Developer ( mailto:[email protected] ) kirjoitti: Hey Nyall, I hear you, but let me highlight two points of my original post. The plugin asks the user whether they want to install the dependencies. The dependencies are installed in the plugin folder and can therefore be removed without causing any lasting damage to the user's QGIS installation. Installing additional dependencies in QGIS remains a painful task for less technical users, adding another (somewhat unnecessary) hurdle to adoption. On that note, a fair question could be: Is there a recommended low-effort (for users) path to install extra dependencies for plugins? If not, is that something being considered for the near future? Cheers, Pedro From: Nyall Dawson < mailto:[email protected] > To: "Pedro Camargo"< mailto:[email protected] > Cc: "Qgis Developer"< mailto:[email protected] > Date: Mon, 25 May 2026 11:12:20 +1000 Subject: Re: [QGIS-Developer] Security issues with plugins On Mon, 25 May 2026 at 08:27, Pedro Camargo via QGIS-Developer < mailto:[email protected] > wrote: > > Hello fellow QGISrs, > > > > I maintain a couple of plugins that require a substantial number of extra > Python packages (many of which have compiled/binary components). Hence, those > plugins install all such requirements in a folder directly inside the plugin > itself, keeping it quite clean when the user wants to remove said plugins. > > > I have been doing it this way for many years now, but this weekend I received > security alerts that both plugins were taken down due to code that downloads > extra dependencies (offending code at > qaequilibrae/qaequilibrae/download_extra_packages_class.py at develop · > AequilibraE/qaequilibrae). > > Does anyone have any recommendations on how to proceed? What is currently > the recommended way for plugins to install further dependencies? My personal 2c: a plugin should NEVER automatically install dependencies like this. Rather, you should detect missing dependencies, warn the user, and point them to a documentation page directing them how to install the missing libraries on different operating systems. I think it's EXTREMELY dangerous for a plugin to assume that it can mess with the user's operating system in this way, as it risks completely breaking their QGIS install or even their wider python environment. I would like to see us explicitly blocking all plugins from the repository that do this in future. 👎 Nyall > > Cheers, > Pedro > > > > ___ > QGIS-Developer mailing list > mailto:[email protected] > List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer > Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer ___ QGIS-Developer mailing list mailto:[email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer___ QGIS-
Re: [QGIS-Developer] Security issues with plugins
Imho, (https://github.com/opengisch/qpip) is an elegant way for handling plugins dependencies. You can manage isolation by using QGIS profiles. David Le 25/05/2026 à 07:47, Joona Laine via QGIS-Developer a écrit : Hello Pedro, qgis-plugin-dev-tools (https://github.com/nlsfi/qgis-plugin-dev-tools#setup) solves the dependency issue by including the dependencies with the plugin package. It can easily handle most of (non-binary) requirements by automatically rewriting the imports of theses vendored dependencies in the build process. This way it is possible to have multiple plugins using different version of the same requirement without any conflicts. It is also possible to include binary dependencies but there is no operation system specific logic built yet at the moment. There is also a tool called qpip (https://github.com/opengisch/qpip) for dependency management, which might be worth checking out. Cheers, Joona ma 25.5.2026 klo 6.35 Pedro Camargo via QGIS-Developer ([email protected]) kirjoitti: Hey Nyall, I hear you, but let me highlight two points of my original post. * The plugin asks the user whether they want to install the dependencies. * The dependencies are installed in the plugin folder and can therefore be removed without causing any lasting damage to the user's QGIS installation. Installing additional dependencies in QGIS remains a painful task for less technical users, adding another (somewhat unnecessary) hurdle to adoption. On that note, a fair question could be: Is there a recommended low-effort (for users) path to install extra dependencies for plugins? If not, is that something being considered for the near future? Cheers, Pedro From: Nyall Dawson To: "Pedro Camargo" Cc: "Qgis Developer" Date: Mon, 25 May 2026 11:12:20 +1000 Subject: Re: [QGIS-Developer] Security issues with plugins On Mon, 25 May 2026 at 08:27, Pedro Camargo via QGIS-Developer wrote: > > Hello fellow QGISrs, > > > > I maintain a couple of plugins that require a substantial number of extra Python packages (many of which have compiled/binary components). Hence, those plugins install all such requirements in a folder directly inside the plugin itself, keeping it quite clean when the user wants to remove said plugins. > > > I have been doing it this way for many years now, but this weekend I received security alerts that both plugins were taken down due to code that downloads extra dependencies (offending code at qaequilibrae/qaequilibrae/download_extra_packages_class.py at develop · AequilibraE/qaequilibrae). > > Does anyone have any recommendations on how to proceed? What is currently the recommended way for plugins to install further dependencies? My personal 2c: a plugin should NEVER automatically install dependencies like this. Rather, you should detect missing dependencies, warn the user, and point them to a documentation page directing them how to install the missing libraries on different operating systems. I think it's EXTREMELY dangerous for a plugin to assume that it can mess with the user's operating system in this way, as it risks completely breaking their QGIS install or even their wider python environment. I would like to see us explicitly blocking all plugins from the repository that do this in future. 👎 Nyall > > Cheers, > Pedro > > > > ___ > QGIS-Developer mailing list > [email protected] > List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer > Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer ___ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer ___ QGIS-Developer mailing list [email protected] List info:https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe:https://lists.osgeo.org/mailman/listinfo/qgis-developer___ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
Re: [QGIS-Developer] Security issues with plugins
Hello Pedro, qgis-plugin-dev-tools (https://github.com/nlsfi/qgis-plugin-dev-tools#setup) solves the dependency issue by including the dependencies with the plugin package. It can easily handle most of (non-binary) requirements by automatically rewriting the imports of theses vendored dependencies in the build process. This way it is possible to have multiple plugins using different version of the same requirement without any conflicts. It is also possible to include binary dependencies but there is no operation system specific logic built yet at the moment. There is also a tool called qpip (https://github.com/opengisch/qpip) for dependency management, which might be worth checking out. Cheers, Joona ma 25.5.2026 klo 6.35 Pedro Camargo via QGIS-Developer ( [email protected]) kirjoitti: > Hey Nyall, > > I hear you, but let me highlight two points of my original post. > >-The plugin asks the user whether they want to install the >dependencies. >-The dependencies are installed in the plugin folder and can >therefore be removed without causing any lasting damage to the user's QGIS >installation. > > Installing additional dependencies in QGIS remains a painful task for less > technical users, adding another (somewhat unnecessary) hurdle to adoption. > > On that note, a fair question could be: Is there a recommended low-effort > (for users) path to install extra dependencies for plugins? > > If not, is that something being considered for the near future? > > > Cheers, > Pedro > > > > > From: Nyall Dawson > To: "Pedro Camargo" > Cc: "Qgis Developer" > Date: Mon, 25 May 2026 11:12:20 +1000 > Subject: Re: [QGIS-Developer] Security issues with plugins > > > > On Mon, 25 May 2026 at 08:27, Pedro Camargo via QGIS-Developer < > [email protected]> wrote: > > > > Hello fellow QGISrs, > > > > > > > > I maintain a couple of plugins that require a substantial number of > extra Python packages (many of which have compiled/binary components). > Hence, those plugins install all such requirements in a folder directly > inside the plugin itself, keeping it quite clean when the user wants to > remove said plugins. > > > > > > I have been doing it this way for many years now, but this weekend I > received security alerts that both plugins were taken down due to code that > downloads extra dependencies (offending code at > qaequilibrae/qaequilibrae/download_extra_packages_class.py at develop · > AequilibraE/qaequilibrae). > > > > Does anyone have any recommendations on how to proceed? What is > currently the recommended way for plugins to install further dependencies? > > My personal 2c: a plugin should NEVER automatically install dependencies > like this. Rather, you should detect missing dependencies, warn the user, > and point them to a documentation page directing them how to install the > missing libraries on different operating systems. > > I think it's EXTREMELY dangerous for a plugin to assume that it can mess > with the user's operating system in this way, as it risks completely > breaking their QGIS install or even their wider python environment. I would > like to see us explicitly blocking all plugins from the repository that do > this in future. 👎 > > Nyall > > > > > Cheers, > > Pedro > > > > > > > > ___ > > QGIS-Developer mailing list > > [email protected] > > List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer > > Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer > > > > ___ > QGIS-Developer mailing list > [email protected] > List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer > Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer > ___ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
Re: [QGIS-Developer] Security issues with plugins
Hey Nyall, I hear you, but let me highlight two points of my original post. The plugin asks the user whether they want to install the dependencies. The dependencies are installed in the plugin folder and can therefore be removed without causing any lasting damage to the user's QGIS installation. Installing additional dependencies in QGIS remains a painful task for less technical users, adding another (somewhat unnecessary) hurdle to adoption. On that note, a fair question could be: Is there a recommended low-effort (for users) path to install extra dependencies for plugins? If not, is that something being considered for the near future? Cheers, Pedro From: Nyall Dawson To: "Pedro Camargo" Cc: "Qgis Developer" Date: Mon, 25 May 2026 11:12:20 +1000 Subject: Re: [QGIS-Developer] Security issues with plugins On Mon, 25 May 2026 at 08:27, Pedro Camargo via QGIS-Developer < mailto:[email protected] > wrote: > > Hello fellow QGISrs, > > > > I maintain a couple of plugins that require a substantial number of extra > Python packages (many of which have compiled/binary components). Hence, those > plugins install all such requirements in a folder directly inside the plugin > itself, keeping it quite clean when the user wants to remove said plugins. > > > I have been doing it this way for many years now, but this weekend I received > security alerts that both plugins were taken down due to code that downloads > extra dependencies (offending code at > qaequilibrae/qaequilibrae/download_extra_packages_class.py at develop · > AequilibraE/qaequilibrae). > > Does anyone have any recommendations on how to proceed? What is currently > the recommended way for plugins to install further dependencies? My personal 2c: a plugin should NEVER automatically install dependencies like this. Rather, you should detect missing dependencies, warn the user, and point them to a documentation page directing them how to install the missing libraries on different operating systems. I think it's EXTREMELY dangerous for a plugin to assume that it can mess with the user's operating system in this way, as it risks completely breaking their QGIS install or even their wider python environment. I would like to see us explicitly blocking all plugins from the repository that do this in future. 👎 Nyall > > Cheers, > Pedro > > > > ___ > QGIS-Developer mailing list > mailto:[email protected] > List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer > Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer___ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
Re: [QGIS-Developer] Security issues with plugins
On Mon, 25 May 2026 at 08:27, Pedro Camargo via QGIS-Developer < [email protected]> wrote: > > Hello fellow QGISrs, > > > > I maintain a couple of plugins that require a substantial number of extra Python packages (many of which have compiled/binary components). Hence, those plugins install all such requirements in a folder directly inside the plugin itself, keeping it quite clean when the user wants to remove said plugins. > > > I have been doing it this way for many years now, but this weekend I received security alerts that both plugins were taken down due to code that downloads extra dependencies (offending code at qaequilibrae/qaequilibrae/download_extra_packages_class.py at develop · AequilibraE/qaequilibrae). > > Does anyone have any recommendations on how to proceed? What is currently the recommended way for plugins to install further dependencies? My personal 2c: a plugin should NEVER automatically install dependencies like this. Rather, you should detect missing dependencies, warn the user, and point them to a documentation page directing them how to install the missing libraries on different operating systems. I think it's EXTREMELY dangerous for a plugin to assume that it can mess with the user's operating system in this way, as it risks completely breaking their QGIS install or even their wider python environment. I would like to see us explicitly blocking all plugins from the repository that do this in future. 👎 Nyall > > Cheers, > Pedro > > > > ___ > QGIS-Developer mailing list > [email protected] > List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer > Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer ___ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
Re: [QGIS-Developer] Security issues with plugins
Le 25/05/2026 à 01:36, Greg Troxel via QGIS-Developer a écrit : Pedro Camargo via QGIS-Developer writes: I maintain a couple of plugins that require a substantial number of extra Python packages (many of which have compiled/binary components). Hence, those plugins install all such requirements in a folder directly inside the plugin itself, keeping it quite clean when the user wants to remove said plugins. I have been doing it this way for many years now, but this weekend I received security alerts that both plugins were taken down due to code that downloads extra dependencies (offending code at https://github.com/AequilibraE/qaequilibrae/blob/develop/qaequilibrae/download_extra_packages_class.py ). Does anyone have any recommendations on how to proceed? What is currently the recommended way for plugins to install further dependencies? I'm not really sure about plugins, Will not immediately help Pedro, but there have been past discussions related to plugin dependency management: - https://github.com/qgis/QGIS-Enhancement-Proposals/issues/202 - https://github.com/qgis/QGIS-Enhancement-Proposals/issues/179 -- Very grumpy about LLMs: FOSS is about increasing public capital, not becoming enslaved to private equity of giga corporations -- http://www.spatialys.com My software is free, but my time generally not. ___ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
Re: [QGIS-Developer] Security issues with plugins
Pedro Camargo via QGIS-Developer writes: > I maintain a couple of plugins that require a substantial number of > extra Python packages (many of which have compiled/binary > components). Hence, those plugins install all such requirements in a > folder directly inside the plugin itself, keeping it quite clean when > the user wants to remove said plugins. > > I have been doing it this way for many years now, but this weekend I > received security alerts that both plugins were taken down due to code > that downloads extra dependencies (offending code at > https://github.com/AequilibraE/qaequilibrae/blob/develop/qaequilibrae/download_extra_packages_class.py > ). > > Does anyone have any recommendations on how to proceed? What is > currently the recommended way for plugins to install further > dependencies? I'm not really sure about plugins, but as a general comment about packaging, it's a bug for the build of any program to download anything. The preferred approach is to have packages for things that are needed and express a dependency within the packaging system. For example, qgis depends on qt5 or qt6. Plugins have a main conceptual path where they are just python code, and only depend on qgis and things that are required by any qgis installation. That's fine when it works. I don't see how to address this without turning the qgis plugin system into yet another full-blown packaging system. The only safe and sound approach I see is to ask the user to install -- with OS packages -- the external python/C modules that your plugin needs. But obviously that's not a good experience. You can mitigate some of the risk by downloading only specific versions identified by version number and hash, and checking the hash before unpacking. I wonder how many operating systems and CPUs your plugins work on. Besides GNU/Linux, macOS, and Windows, qgis runs on various BSDs and surely a few other systems, and likely a pretty large variety of cpu types. This is an area where download/build can be problematic if what is downloaded is not adequately portable. I realize this is generalities and handwavy and it will be interesting to see what others say. ___ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
