From ChulHong.Park at meinhardtgroup.com Thu Oct 2 21:53:14 2025 From: ChulHong.Park at meinhardtgroup.com (Chul Hong Park) Date: Fri, 3 Oct 2025 04:53:14 +0000 Subject: [Qgis-psc] General Public License Inquiry for Business Use Message-ID: Hello, I tried reaching out via qgis user email and I was rejected so I am following up with this otheremail address. We are a Singapore-based urban planning consultancy. I understand that QGIS is free and distributed under the GNU General Public License, as stated on your website. However, our IT department has asked for written confirmation from the QGIS organization that the software is free to use, including in a business setting. Could you kindly confirm that the public license terms also apply to commercial and business users? Thank you for your time and help. QGIS License ? QGIS Web Site Chul. -------------- next part -------------- An HTML attachment was scrubbed... URL: From andreas at qgis.org Thu Oct 2 23:48:09 2025 From: andreas at qgis.org (Andreas Neumann) Date: Fri, 3 Oct 2025 08:48:09 +0200 Subject: [Qgis-psc] General Public License Inquiry for Business Use In-Reply-To: References: Message-ID: Hi Chul, Yes, the usage of QGIS is free, also for commercial use. However, if QGIS is really useful to you and supports your business substantially, we would appreciate it if you would support QGIS as a sustaining member (see https://www.qgis.org/funding/membership/ for details). Sustaining memberships, donations and training certificates are the income of QGIS and ensures running the QGIS infrastructure, finance bug fixing and enables refactorings and improvements of QGIS. See also our annual and financial reports at https://www.qgis.org/community/foundation/ However, the usage of QGIS doesn't require donations or sustaining memberships, regardless of private or commercial use. Hope this helps to clarify. Best regards, Andreas Neumann QGIS.ORG PSC member (treasurer) On Fri, 3 Oct 2025 at 06:53, Chul Hong Park via QGIS-PSC < qgis-psc at lists.osgeo.org> wrote: > Hello, > > I tried reaching out via qgis user email and I was rejected so I am > following up with this otheremail address. > > We are a Singapore-based urban planning consultancy. I understand that > QGIS is free and distributed under the GNU General Public License, as > stated on your website. However, our IT department has asked for written > confirmation from the QGIS organization that the software is free to use, > including in a business setting. > > Could you kindly confirm that the public license terms also apply to > commercial and business users? > > Thank you for your time and help. > > QGIS License ? QGIS Web Site > > Chul. > > > _______________________________________________ > QGIS-PSC mailing list > QGIS-PSC at lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/qgis-psc > -- -- Andreas Neumann QGIS.ORG board member (treasurer) -------------- next part -------------- An HTML attachment was scrubbed... URL: From dvdkon at konarici.cz Thu Oct 9 01:46:32 2025 From: dvdkon at konarici.cz (=?UTF-8?B?RGF2aWQgS2/FiGHFmcOtaw==?=) Date: Thu, 9 Oct 2025 10:46:32 +0200 Subject: [Qgis-psc] Progress on SIP incremental build grant Message-ID: Hi all, I'd like to share with you a report of the work I did on QEP 338 (SIP incremental builds): My original plan was to build each header file as a separate binding, then use SIP from a Python script, overriding a few methods to allow building just one binding out of a project. After a lot of effort, this plan sadly doesn't seem workable. PyQt's bindings aren't modularised enough, so building a single binding still needs to parse almost all of PyQt. Furthermore, SIP has a multi-stage parse-resolve-generate design, but the "parser" does more than just parse the code into an AST, not all references are resolved in the resolve phase, and imports are currently basically done by textual inclusion. I've tried making the necessary changes to SIP [1] and QGIS [2], but for the above reasons, I don't think the performance benefits for single-file builds are worth the added complexity and performance penalty for clean builds (which look to be over an hour currently). The good news is that with the knowledge from working on SIP, I've been able to improve the performance of regular clean builds, and those improvements might soon be merged into SIP itself [3]. I've also made some changes on the QGIS side to not rebuild unchanged code generated by SIP [4]. With code compilation now taking longer than SIP code generation, this effectively gives us incremental builds, just at a larger granularity. David Ko?a??k [1]: https://github.com/dvdkon/sip/tree/qgis-gb [2]: https://github.com/dvdkon/QGIS/tree/sip-incremental-build [3]: https://github.com/Python-SIP/sip/pull/87 [4]: https://github.com/qgis/QGIS/pull/63160 From rldhont at gmail.com Fri Oct 10 00:38:11 2025 From: rldhont at gmail.com (=?UTF-8?Q?Ren=C3=A9-Luc_Dhont?=) Date: Fri, 10 Oct 2025 09:38:11 +0200 Subject: [Qgis-psc] Invoice for QGIS Certification Message-ID: <8b6a4e89-a635-4461-adbd-625b7bf105e5@gmail.com> Hi QGIS PSC, I made a payment to purchase credits for the 3Liz organization as part of QGIS Certification, but I cannot find an invoice for this purchase. For French accounting purposes, we require an invoice. Do you think it would be possible to obtain one? Without it, I would not be able to finance any new credits, which is not what I want at all. I would like to be able to support QGIS in this way. Best regards, Ren?-Luc DHONT 3Liz -------------- next part -------------- An HTML attachment was scrubbed... URL: From andreas at qgis.org Mon Oct 13 00:34:17 2025 From: andreas at qgis.org (Andreas Neumann) Date: Mon, 13 Oct 2025 09:34:17 +0200 Subject: [Qgis-psc] Invoice for QGIS Certification In-Reply-To: <8b6a4e89-a635-4461-adbd-625b7bf105e5@gmail.com> References: <8b6a4e89-a635-4461-adbd-625b7bf105e5@gmail.com> Message-ID: Hi Ren?-Luc, I will be sending you a separate invoice. Please use the address finance at qgis.org for such requests. Normally, when you pay for a certificate with credit card, you get an email reply with the payment confirmation (=invoice) immediately after paying. It is the confirmation that you also forwarded to the list. If that is not good/official enough, I can still send you a manual invoice in addition. I do this sometimes on request. This is a manual process and not done automatically, hence you did not receive one automatically. Greetings, Andreas On Fri, 10 Oct 2025 at 09:38, Ren?-Luc Dhont via QGIS-PSC < qgis-psc at lists.osgeo.org> wrote: > Hi QGIS PSC, > > I made a payment to purchase credits for the 3Liz organization as part of > QGIS Certification, but I cannot find an invoice for this purchase. > For French accounting purposes, we require an invoice. Do you think it > would be possible to obtain one? > > Without it, I would not be able to finance any new credits, which is not > what I want at all. I would like to be able to support QGIS in this way. > > Best regards, > Ren?-Luc DHONT > 3Liz > _______________________________________________ > QGIS-PSC mailing list > QGIS-PSC at lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/qgis-psc > -- -- Andreas Neumann QGIS.ORG board member (treasurer) -------------- next part -------------- An HTML attachment was scrubbed... URL: From delazj at gmail.com Mon Oct 13 07:50:24 2025 From: delazj at gmail.com (DelazJ) Date: Mon, 13 Oct 2025 16:50:24 +0200 Subject: [Qgis-psc] Outdated PSC meetings archive Message-ID: Hello PSC, Can someone update the meetings archive, please? Last info is from April. Thanks. Regards, Harrissou S. -------------- next part -------------- An HTML attachment was scrubbed... URL: From marco at qgis.org Mon Oct 13 08:25:21 2025 From: marco at qgis.org (Marco Bernasocchi) Date: Mon, 13 Oct 2025 17:25:21 +0200 Subject: [Qgis-psc] Outdated PSC meetings archive In-Reply-To: References: Message-ID: Hi Harrisou, Thanks for raising this. I'll pass this to the right person. Cheers Marco Marco Bernasocchi QGIS.org Chair OSGEO.org VP Europe OPENGIS.ch CEO http://berna.io On Mon, 13 Oct 2025, 16:50 DelazJ via QGIS-PSC, wrote: > Hello PSC, > Can someone update the meetings archive, please? Last info is from April. > Thanks. > > Regards, > Harrissou S. > _______________________________________________ > QGIS-PSC mailing list > QGIS-PSC at lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/qgis-psc > -------------- next part -------------- An HTML attachment was scrubbed... URL: From apasotti at gmail.com Tue Oct 14 05:59:36 2025 From: apasotti at gmail.com (Alessandro Pasotti) Date: Tue, 14 Oct 2025 14:59:36 +0200 Subject: [Qgis-psc] Github actions analysis Message-ID: Hi, During the last PSC meeting we talked briefly about how to solve the problem that we have with the Github CI limitations, one of the possible solutions that we discussed was to start migrating part of the CI to self-hosted runners. I've just made an attempt to understand the hardware requirements that we would need and I have collected some statistics from our Github account, summarized here for the period of the last 30 days: https://docs.google.com/spreadsheets/d/16-tiSLndm-ISxRFgZcE-Ewytr8cwLj00gdYs1iBsz58/edit?usp=sharing Considering that the standard public runner on Github runs on a 4 CPU + 16 GB RAM machine intel arch, the rough conclusion is that we would need 4.5 of these machines to handle the actual workload, please note that this a very rough estimation and does not take into account that we probably have peaking hours and we'd need more power if we don't want the jobs to sit in a queue for too long. Anyway, it's a start. Another thing to consider is that we could possibly cut some CI workflows (e.g. mingw64, is that useful?) or move some to a daily cronjob (ogc?). Any thoughts? -- Alessandro Pasotti QCooperative: www.qcooperative.net ItOpen: www.itopen.it -------------- next part -------------- An HTML attachment was scrubbed... URL: From apasotti at gmail.com Tue Oct 14 06:06:05 2025 From: apasotti at gmail.com (Alessandro Pasotti) Date: Tue, 14 Oct 2025 15:06:05 +0200 Subject: [Qgis-psc] Github actions analysis In-Reply-To: References: Message-ID: Sorry, in my previous email I wrote "we would need 4.5 of these machines" while I meant 3.5 machines. On Tue, Oct 14, 2025 at 2:59?PM Alessandro Pasotti wrote: > Hi, > > During the last PSC meeting we talked briefly about how to solve the > problem that we have with the Github CI limitations, one of the possible > solutions that we discussed was to start migrating part of the CI to > self-hosted runners. > > I've just made an attempt to understand the hardware requirements that we > would need and I have collected some statistics from our Github account, > summarized here for the period of the last 30 days: > > > https://docs.google.com/spreadsheets/d/16-tiSLndm-ISxRFgZcE-Ewytr8cwLj00gdYs1iBsz58/edit?usp=sharing > > Considering that the standard public runner on Github runs on a 4 CPU + 16 > GB RAM machine intel arch, the rough conclusion is that we would need 4.5 > of these machines to handle the actual workload, please note that this a > very rough estimation and does not take into account that we probably have > peaking hours and we'd need more power if we don't want the jobs to sit in > a queue for too long. > > Anyway, it's a start. > > Another thing to consider is that we could possibly cut some CI workflows > (e.g. mingw64, is that useful?) or move some to a daily cronjob (ogc?). > > Any thoughts? > > > -- > Alessandro Pasotti > QCooperative: www.qcooperative.net > ItOpen: www.itopen.it > -- Alessandro Pasotti QCooperative: www.qcooperative.net ItOpen: www.itopen.it -------------- next part -------------- An HTML attachment was scrubbed... URL: From jmckenna at gatewaygeomatics.com Tue Oct 14 06:15:26 2025 From: jmckenna at gatewaygeomatics.com (Jeff McKenna) Date: Tue, 14 Oct 2025 10:15:26 -0300 Subject: [Qgis-psc] Github actions analysis In-Reply-To: References: Message-ID: <8a9cc9a0-ce08-4576-86b8-c5d197ff02af@gatewaygeomatics.com> Short message to let you know that the MapServer repository is facing the same issue with hitting GitHub limits, and I am seeing several >1GB cache entries for our Conda builds (the cache logs mention "micromamba-environment"), lingering several weeks later (that can add up!). I am monitoring this now, and following your QGIS-PSC discussions. Thank-you again for the QGIS-PSC being so open and (as always) being the first in the ecosystem to tackle this. (by the way, the GitHub cache limits start tomorrow/15 October) -jeff On 2025-10-14 10:06 a.m., Alessandro Pasotti via QGIS-PSC wrote: > > Sorry, in my previous email I wrote "we would need 4.5 of these > machines" while I meant 3.5 machines. > > On Tue, Oct 14, 2025 at 2:59?PM Alessandro Pasotti > wrote: > > Hi, > > During the last PSC meeting we talked briefly about how to solve the > problem that we have with the Github CI limitations, one of the > possible solutions that we discussed was to start migrating part of > the CI to self-hosted runners. > > I've just made an attempt to understand the hardware requirements > that we would need and I have collected some statistics from our > Github account, summarized here for the period of the last 30 days: > > https://docs.google.com/spreadsheets/d/16-tiSLndm-ISxRFgZcE- > Ewytr8cwLj00gdYs1iBsz58/edit?usp=sharing spreadsheets/d/16-tiSLndm-ISxRFgZcE-Ewytr8cwLj00gdYs1iBsz58/edit? > usp=sharing> > > Considering that the standard public runner on Github runs on a 4 > CPU + 16 GB RAM machine intel arch, the rough conclusion is that we > would need 4.5 of these machines to handle the actual workload, > please note that this a very rough estimation and does not take into > account that we probably have peaking hours and we'd need more power > if we don't want the jobs to sit in a queue for too long. > > Anyway, it's a start. > > Another thing to consider is that we could possibly cut some CI > workflows (e.g. mingw64, is that useful?) or move some to a daily > cronjob (ogc?). > > Any thoughts? > > > -- > Alessandro Pasotti > QCooperative: www.qcooperative.net > ItOpen: www.itopen.it > > > > -- > Alessandro Pasotti > QCooperative: www.qcooperative.net > ItOpen: www.itopen.it > > _______________________________________________ > QGIS-PSC mailing list > QGIS-PSC at lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/qgis-psc -- Jeff McKenna GatewayGeo: Developers of MS4W, & offering MapServer Consulting/Dev co-founder of FOSS4G http://gatewaygeo.com/ From julien.cabieces at oslandia.com Tue Oct 14 06:27:22 2025 From: julien.cabieces at oslandia.com (Julien Cabieces) Date: Tue, 14 Oct 2025 15:27:22 +0200 Subject: [Qgis-psc] [QGIS-Developer] Github actions analysis In-Reply-To: (Alessandro Pasotti via's message of "Tue, 14 Oct 2025 14:59:36 +0200") References: Message-ID: <87bjm9txz9.fsf@julienlaptop.home> Hi, Thank you for this work > Considering that the standard public runner on Github runs on a 4 CPU + 16 GB RAM machine intel arch, the rough conclusion is that we would > need 4.5 Isn't it 3.5 instead ? That's the number you get in the table Assuming that we would have a better control on these machine, maybe we could have more disk space and so maybe more build cache that would speed up the build time. It could also reduce the time to pull some resource elsewhere (docker, oracle/hana binary...). It's highly hypothetical, I'm just wondering. Regards, Julien > Hi, > > During the last PSC meeting we talked briefly about how to solve the problem that we have with the Github CI limitations, one of the possible > solutions that we discussed was to start migrating part of the CI to self-hosted runners. > > I've just made an attempt to understand the hardware requirements that we would need and I have collected some statistics from our Github > account, summarized here for the period of the last 30 days: > > https://docs.google.com/spreadsheets/d/16-tiSLndm-ISxRFgZcE-Ewytr8cwLj00gdYs1iBsz58/edit?usp=sharing > > Considering that the standard public runner on Github runs on a 4 CPU + 16 GB RAM machine intel arch, the rough conclusion is that we would > need 4.5 of these machines to handle the actual workload, please note that this a very rough estimation and does not take into account that we > probably have peaking hours and we'd need more power if we don't want the jobs to sit in a queue for too long. > > Anyway, it's a start. > > Another thing to consider is that we could possibly cut some CI workflows (e.g. mingw64, is that useful?) or move some to a daily cronjob > (ogc?). > > Any thoughts? -- Julien Cabieces Senior Developer at Oslandia julien.cabieces at oslandia.com From ravencrowking at hotmail.com Tue Oct 21 08:51:38 2025 From: ravencrowking at hotmail.com (Daniel J. Bishop) Date: Tue, 21 Oct 2025 15:51:38 +0000 Subject: [Qgis-psc] Publishing Query Message-ID: I write tabletop role-playing material. What are the limitations on publishing maps made with QGIS? Thank you! -------------- next part -------------- An HTML attachment was scrubbed... URL: From anitagraser at gmx.at Tue Oct 21 09:22:18 2025 From: anitagraser at gmx.at (Anita Graser) Date: Tue, 21 Oct 2025 18:22:18 +0200 (GMT+02:00) Subject: [Qgis-psc] Publishing Query In-Reply-To: References: Message-ID: <9209a97a-9b46-4c49-b714-9609427b10bd@gmx.at> Dear Daniel, There are no limitations. See https://qgis.org/resources/support/faq/#i-created-a-map-with-qgis-do-i-have-to-mention-qgis Regards Anita Oct 21, 2025 17:51:46 Daniel J. Bishop via QGIS-PSC : > I write tabletop role-playing material. What are the limitations on publishing maps made with QGIS? > > Thank you! -------------- next part -------------- An HTML attachment was scrubbed... URL: From claire.birnie at maptastic.co.uk Fri Oct 24 03:38:07 2025 From: claire.birnie at maptastic.co.uk (claire.birnie at maptastic.co.uk) Date: Fri, 24 Oct 2025 11:38:07 +0100 Subject: [Qgis-psc] Sustaining member application Message-ID: <0c9301dc44d2$4b5d7830$e2186890$@maptastic.co.uk> Good morning, I've tried to email finance at qgis.org to ask about becoming a sustaining member and the email has bounced back as unable to receive email. Is there an alternative I can use please? www.maptastic.co.uk Upcoming out of office days: 17th - 21st November -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image001.png Type: image/png Size: 14329 bytes Desc: not available URL: From regis at qgis.org Sun Oct 26 06:12:02 2025 From: regis at qgis.org (=?UTF-8?Q?R=C3=A9gis_Haubourg?=) Date: Sun, 26 Oct 2025 14:12:02 +0100 Subject: [Qgis-psc] QGIS Security Assessment In-Reply-To: <814e13be-a371-458d-98be-42001d87a785@qgis.org> References: <814e13be-a371-458d-98be-42001d87a785@qgis.org> Message-ID: Hi Heather, please have a look at this file : https://discourse.osgeo.org/uploads/short-url/27LL3BD2NtzriuK60hBBfZAdrv6.xlsx This is our first version of HECVAT. Scores are really poor because HECVAT is fully designed to describe Cloud applications, which QGIS is not. I hope this will help your teachers and students benefit from QGIS installations so that they can learn GIS with the most data respectful tool you can imagine. We collect nothing. You stay fully in control of your data. Best regards R?gis, on behalf of the QGIS's PSC and security team. On 10/16/25 10:12, R?gis Haubourg wrote: > Hi Heather, > Please have a look at > > https://qgis.org/resources/support/faq/#how-can-i-get-a-vpat--hecvat--other-us-compliance-form-or-information > > > QGIS is a free and open source project. > QGIS.org is not a product provider as such and we can't fill up > thousands of such queries for each country in the world. All the > information about how our project is driven is fully opened on > internet and any service provider could fill it for you. > > If by chance you happen to fill one for QGIS, please end it back to us > so that we put it on our website and all the others will benefit from > your work.? This is a good way to contribute back to the project that > comes totally for free for you. > > Best regards > R?gis - PSC elected Member > > On 10/10/25 16:59, 'Heather Persaud' via security wrote: >> To whom it may concern, >> >> Rock Valley College has recently enhanced its cybersecurity measures >> and is now conducting a comprehensive assessment of all software and >> web applications utilized on our campus. Our records indicate that we >> do not have an assessment on file for your organization. Please >> provide a HECVAT assessment or an equivalent document. If you do not >> have one readily available, we have attached a template for your >> convenience. >> >> Best regards, >> >> Heather Persaud >> Administrative Assistant >> H.Persaud at RockValleyCollege.edu >> T: 815-921-4807 >> >> [cid:image001.jpg at 01DC39CC.7B866870] >> >> > From nyall.dawson at gmail.com Thu Oct 30 21:40:32 2025 From: nyall.dawson at gmail.com (Nyall Dawson) Date: Fri, 31 Oct 2025 14:40:32 +1000 Subject: [Qgis-psc] 2025 Grant: Coverity Scan cleanup progress report Message-ID: Hi PSC, In regards to the 2025 funding grant for QEP 337: Coverity Scan cleanup -- the short story is that this is still an ongoing work in progress. While the work started quickly, unfortunately it was delayed for a significant portion of the year after the Coverity scan compilation tool broke on newer development environments. It's only recently that I've been able to resume work on this project, and have been pushing hard over the last fortnight to get it wrapped up quickly (see links below). I estimate that there's another 2 weeks remaining here before I can complete the project. While the tool was broken on desktop environments, I attempted the second part of the project (investigating whether it is possible to automatically run the Coverity Scan tool on a weekly basis as a GitHub action). (see https://github.com/nyalldawson/QGIS/tree/coverity_workflow). My finding was that this is NOT possible to achieve via GitHub actions, as the compilation using the coverity cov-build tool ends up exceeding the maximum available space on the workflow runners. I will report back with an updated status regarding completion of this work mid-November. Kind regards, Nyall https://github.com/qgis/QGIS/pull/63681 https://github.com/qgis/QGIS/pull/63686 https://github.com/qgis/QGIS/pull/63687 https://github.com/qgis/QGIS/pull/63697 https://github.com/qgis/QGIS/pull/63702 https://github.com/qgis/QGIS/pull/63704 https://github.com/qgis/QGIS/pull/63705 https://github.com/qgis/QGIS/pull/63706 https://github.com/qgis/QGIS/pull/63707 https://github.com/qgis/QGIS/pull/63708 https://github.com/qgis/QGIS/pull/63715 https://github.com/qgis/QGIS/pull/63734 https://github.com/hobuinc/laz-perf/pull/166 https://github.com/hobuinc/laz-perf/pull/167 https://github.com/syoyo/tinygltf/pull/525 From marco at qgis.org Fri Oct 31 00:40:48 2025 From: marco at qgis.org (Marco Bernasocchi) Date: Fri, 31 Oct 2025 20:40:48 +1300 Subject: [Qgis-psc] 2025 Grant: Coverity Scan cleanup progress report In-Reply-To: References: Message-ID: Thank you for the update Nyall Cheers Marco Bernasocchi QGIS.org Chair OSGEO.org VP Europe OPENGIS.ch CEO http://berna.io On Fri, 31 Oct 2025, 17:40 Nyall Dawson via QGIS-PSC, < qgis-psc at lists.osgeo.org> wrote: > Hi PSC, > > In regards to the 2025 funding grant for QEP 337: Coverity Scan > cleanup -- the short story is that this is still an ongoing work in > progress. > > While the work started quickly, unfortunately it was delayed for a > significant portion of the year after the Coverity scan compilation > tool broke on newer development environments. It's only recently that > I've been able to resume work on this project, and have been pushing > hard over the last fortnight to get it wrapped up quickly (see links > below). I estimate that there's another 2 weeks remaining here before > I can complete the project. > > While the tool was broken on desktop environments, I attempted the > second part of the project (investigating whether it is possible to > automatically run the Coverity Scan tool on a weekly basis as a GitHub > action). (see https://github.com/nyalldawson/QGIS/tree/coverity_workflow). > My finding was that this is NOT possible to achieve via GitHub > actions, as the compilation using the coverity cov-build tool ends up > exceeding the maximum available space on the workflow runners. > > I will report back with an updated status regarding completion of this > work mid-November. > > Kind regards, > Nyall > > https://github.com/qgis/QGIS/pull/63681 > https://github.com/qgis/QGIS/pull/63686 > https://github.com/qgis/QGIS/pull/63687 > https://github.com/qgis/QGIS/pull/63697 > https://github.com/qgis/QGIS/pull/63702 > https://github.com/qgis/QGIS/pull/63704 > https://github.com/qgis/QGIS/pull/63705 > https://github.com/qgis/QGIS/pull/63706 > https://github.com/qgis/QGIS/pull/63707 > https://github.com/qgis/QGIS/pull/63708 > https://github.com/qgis/QGIS/pull/63715 > https://github.com/qgis/QGIS/pull/63734 > https://github.com/hobuinc/laz-perf/pull/166 > https://github.com/hobuinc/laz-perf/pull/167 > https://github.com/syoyo/tinygltf/pull/525 > _______________________________________________ > QGIS-PSC mailing list > QGIS-PSC at lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/qgis-psc > -------------- next part -------------- An HTML attachment was scrubbed... URL: From nirvn.asia at gmail.com Fri Oct 31 04:06:40 2025 From: nirvn.asia at gmail.com (Mathieu Pellerin) Date: Fri, 31 Oct 2025 18:06:40 +0700 Subject: [Qgis-psc] 2025 Grant: Trusted projects and folders (QEP 336) progress report Message-ID: Greetings PSC, I?m happy to report that the work for the above mentioned QEP has been completed and merged during the month of October 2025. As a result of the work done, QGIS has enhanced security measures around its handling of embedded scripts while at the same time increasing user convenience by providing project-based security prompts. In order to achieve that, QGIS has gained a new trust status - undetermined, untrusted, and trusted ? associated with individual projects files as well as folders paths. The trust determination by the user can be temporary - lasting for a single QGIS session - or saved in the user profile?s settings and remembered across sessions. The untrusted and trusted status of projects and folders saved in the user profile can be modified at any time by the user through a dedicated UI within the options dialog, as well as preconfigured in the global INI file. Project trust is used to determine whether the following embedded scripts are permitted to run: - macros; - custom expression functions; - map layer actions (python as well as Windows, Linux, and macos scripts); and - attribute form custom init code. For macros and custom expression functions which require activation on project load, users opening projects containing these two types of embedded scripts will be presented with a modal dialog seeking a decision on whether to allow for the scripts to run or deny. The dialog contains a list of embedded scripts found within the project being opened and allows for each embedded script to be previewed directly within that dialog. For map layer actions and attribute form custom init code, QGIS will defer the dialog until an action is triggered or an attribute form is opened. This allows for the newly-introduced security measure to not have an impact on users' workflow unless and until it is relevant and necessary. It?s also worth mentioning that contrary to macros and expression functions, the layer actions and attribute form init code were until this work not placed behind a user permission mechanism, which allowed for arbitrary code to be executed, in many cases without the knowledge by users of the potential risks. To drive this new UX, a new objects visitor set of classes has been added to traverse a given project and its layers to gather all embedded scripts. This ensures that the functionality can easily be extended when new embedded scripts are added in the future. I would like to thank the QGIS grant programme for having sponsored what amounts to a substantial leap forward in the way we handle safety and user awareness around embedded scripts. Best regards, Mathieu Pellerin OPENGIS.ch -------------- next part -------------- An HTML attachment was scrubbed... URL: