<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta content="text/html;charset=UTF-8" http-equiv="Content-Type"></head><body ><div style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10pt;"><div>Hey Joona,<br></div><div><br></div><div>I have looked into qpip, but it is not sufficient. Not only do most dependencies have binaries, but the process also creates a somewhat cumbersome installation workflow for non-technical users.<br></div><div><br></div><div><span data-teams="true">In the end, the problem seems to be that the plugins I am talking about are not really GIS plugins, but rather bigger pieces of software with a very significant QGIS component, mostly for visualization purposes, so I must grant that as a large part of the problem.</span><br></div><div><br></div><div><span data-teams="true">We will likely explore deploying custom plugin repositories and developing full installers. It's inconvenient for users, but there isn't another alternative I can see right now.</span><br></div><div><br></div><div><span data-teams="true">Cheers,</span><br></div><div><span data-teams="true">Pedro</span><br></div><div><br></div><div class="zmail_extra_hr" style="border-top: 1px solid rgb(204, 204, 204); height: 0px; margin-top: 10px; margin-bottom: 10px; line-height: 0px;"><br></div><div class="zmail_extra" data-zbluepencil-ignore="true"><div><br></div><div id="Zm-_Id_-Sgn1">From: Joona Laine <joona.p.laine@gmail.com><br>To: "Pedro Camargo"<c@margo.co><br>Cc: "Qgis Developer"<qgis-developer@lists.osgeo.org><br>Date: Mon, 25 May 2026 15:47:55 +1000<br>Subject: Re: [QGIS-Developer] Security issues with plugins<br></div><div><br></div><blockquote id="blockquote_zmail" style="margin: 0px;"><div><div dir="ltr">Hello Pedro,<div><br></div><div>qgis-plugin-dev-tools (<a target="_blank" href="https://github.com/nlsfi/qgis-plugin-dev-tools#setup">https://github.com/nlsfi/qgis-plugin-dev-tools#setup</a>) solves the dependency issue by including the dependencies with the plugin package.<br></div><div><br></div><div>It can easily handle most of (non-binary) requirements by automatically rewriting the imports of theses vendored dependencies in the build process. <br></div><div>This way it is possible to have multiple plugins using different version of the same requirement without any conflicts.<br></div><div>It is also possible to include binary dependencies but there is no operation system specific logic built yet at the moment.<br></div><div><br></div><div>There is also a tool called qpip (<a target="_blank" href="https://github.com/opengisch/qpip">https://github.com/opengisch/qpip</a>) for dependency management, which might be worth checking out.<br></div><div><br></div><div>Cheers,<br></div><div>Joona<br></div><div><br></div><div><br></div></div><br><div class="x_2013557835gmail_quote x_2013557835gmail_quote_container"><div class="x_2013557835gmail_attr" dir="ltr">ma 25.5.2026 klo 6.35 Pedro Camargo via QGIS-Developer (<a target="_blank" href="mailto:qgis-developer@lists.osgeo.org">qgis-developer@lists.osgeo.org</a>) kirjoitti:<br></div><div id="zmail_block"><br></div></div></div><blockquote style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex" class="x_2013557835gmail_quote"><u></u><div><div style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10pt"><div>Hey Nyall,<br></div><div><br></div><div>I hear you, but let me highlight two points of my original post.<br></div><ul dir="ltr"><li> The plugin asks the user whether they want to install the dependencies. <br></li><li> The dependencies are installed in the plugin folder and can therefore be removed without causing any lasting damage to the user's QGIS installation.<br></li></ul><div>Installing additional dependencies in QGIS remains a painful task for less technical users, adding another (somewhat unnecessary) hurdle to adoption. <br></div><div><br></div><div>On that note, a fair question could be: Is there a recommended low-effort (for users) path to install extra dependencies for plugins? <br></div><div><br></div><div>If not, is that something being considered for the near future?<br></div><div><br></div><div><br></div><div>Cheers,<br></div><div>Pedro<br></div><div><br></div><div><br></div><div style="border-top: 1px solid rgb(204, 204, 204); min-height: 0px; margin-top: 10px; margin-bottom: 10px; line-height: 0px"><br></div><div><div><br></div><div id="x_2013557835m_6750506275350710662Zm-_Id_-Sgn1">From: Nyall Dawson <<a target="_blank" href="mailto:nyall.dawson@gmail.com">nyall.dawson@gmail.com</a>><br>To: "Pedro Camargo"<<a target="_blank" href="mailto:c@margo.co">c@margo.co</a>><br>Cc: "Qgis Developer"<<a target="_blank" href="mailto:qgis-developer@lists.osgeo.org">qgis-developer@lists.osgeo.org</a>><br>Date: Mon, 25 May 2026 11:12:20 +1000<br>Subject: Re: [QGIS-Developer] Security issues with plugins<br></div><div><br></div><blockquote style="margin: 0px" id="x_2013557835m_6750506275350710662blockquote_zmail"><div><div dir="ltr"><div><br></div><div><br></div><div>On Mon, 25 May 2026 at 08:27, Pedro Camargo via QGIS-Developer <<a target="_blank" href="mailto:qgis-developer@lists.osgeo.org">qgis-developer@lists.osgeo.org</a>> wrote:<br></div><div>><br></div><div>> Hello fellow QGISrs,<br></div><div>><br></div><div>><br></div><div>><br></div><div>> I maintain a couple of plugins that require a substantial number of extra Python packages (many of which have compiled/binary components). Hence, those plugins install all such requirements in a folder directly inside the plugin itself, keeping it quite clean when the user wants to remove said plugins.<br></div><div>><br></div><div>><br></div><div>> I have been doing it this way for many years now, but this weekend I received security alerts that both plugins were taken down due to code that downloads extra dependencies (offending code at qaequilibrae/qaequilibrae/download_extra_packages_class.py at develop · AequilibraE/qaequilibrae).<br></div><div>><br></div><div>> Does anyone have any recommendations on how to proceed? What is currently the recommended way for plugins to install further dependencies?<br></div><div><br></div><div>My personal 2c: a plugin should NEVER automatically install dependencies like this. Rather, you should detect missing dependencies, warn the user, and point them to a documentation page directing them how to install the missing libraries on different operating systems.<br></div><div><br></div><div>I think it's EXTREMELY dangerous for a plugin to assume that it can mess with the user's operating system in this way, as it risks completely breaking their QGIS install or even their wider python environment. I would like to see us explicitly blocking all plugins from the repository that do this in future. 👎<br></div><div><br></div><div>Nyall<br></div><div><br>><br>> Cheers,<br>> Pedro<br>><br>><br>><br>> _______________________________________________<br>> QGIS-Developer mailing list<br>> <a target="_blank" href="mailto:QGIS-Developer@lists.osgeo.org">QGIS-Developer@lists.osgeo.org</a><br>> List info: <a target="_blank" href="https://lists.osgeo.org/mailman/listinfo/qgis-developer">https://lists.osgeo.org/mailman/listinfo/qgis-developer</a><br>> Unsubscribe: <a target="_blank" href="https://lists.osgeo.org/mailman/listinfo/qgis-developer">https://lists.osgeo.org/mailman/listinfo/qgis-developer</a></div></div></div></blockquote></div><div><br></div></div><br></div>_______________________________________________<br> QGIS-Developer mailing list<br> <a target="_blank" href="mailto:QGIS-Developer@lists.osgeo.org">QGIS-Developer@lists.osgeo.org</a><br> List info: <a target="_blank" href="https://lists.osgeo.org/mailman/listinfo/qgis-developer">https://lists.osgeo.org/mailman/listinfo/qgis-developer</a><br> Unsubscribe: <a target="_blank" href="https://lists.osgeo.org/mailman/listinfo/qgis-developer">https://lists.osgeo.org/mailman/listinfo/qgis-developer</a><br></blockquote></blockquote></div><div><br></div></div><br></body></html>