Re: [QGIS-Developer] How to deal with QGIS plugins which install additional packages

2024-10-22 Thread Nyall Dawson via QGIS-Developer
On Wed, 23 Oct 2024, 4:07 pm Matthias Kuhn, wrote: > On Wed, Oct 23, 2024 at 2:49 AM Nyall Dawson via QGIS-Developer < > qgis-developer@lists.osgeo.org> wrote: > >> >> >> On Wed, 23 Oct 2024, 9:20 am Greg Troxel via QGIS-Developer, < >> qgis-developer@lists.osgeo.org> wrote: >> >>> Thomas B via Q

Re: [QGIS-Developer] How to deal with QGIS plugins which install additional packages

2024-10-22 Thread Matthias Kuhn via QGIS-Developer
On Wed, Oct 23, 2024 at 2:49 AM Nyall Dawson via QGIS-Developer < qgis-developer@lists.osgeo.org> wrote: > > > On Wed, 23 Oct 2024, 9:20 am Greg Troxel via QGIS-Developer, < > qgis-developer@lists.osgeo.org> wrote: > >> Thomas B via QGIS-Developer writes: >> >> > Dear QGIS-Developers, >> > >> > A

Re: [QGIS-Developer] How to deal with QGIS plugins which install additional packages

2024-10-22 Thread Nyall Dawson via QGIS-Developer
On Wed, 23 Oct 2024, 9:20 am Greg Troxel via QGIS-Developer, < qgis-developer@lists.osgeo.org> wrote: > Thomas B via QGIS-Developer writes: > > > Dear QGIS-Developers, > > > > Are there any guidelines from the QGIS project regarding whether a QGIS > > plugin is allowed to autonomously install req

Re: [QGIS-Developer] How to deal with QGIS plugins which install additional packages

2024-10-22 Thread Greg Troxel via QGIS-Developer
Thomas B via QGIS-Developer writes: > Dear QGIS-Developers, > > Are there any guidelines from the QGIS project regarding whether a QGIS > plugin is allowed to autonomously install required packages using PIP or > similar tools without manual installation by the user? > > While this might seem con

Re: [QGIS-Developer] How to deal with QGIS plugins which install additional packages

2024-10-22 Thread C Hamilton via QGIS-Developer
Hi Thomas, My personal feeling is that this is a very real security risk. I know that it makes it easy to get the extra Python packages installed, but it is not worth it. My plugins that require extra Python packages notifies the user that they need to be installed and gives instructions on how t

[QGIS-Developer] How to deal with QGIS plugins which install additional packages

2024-10-22 Thread Thomas B via QGIS-Developer
Dear QGIS-Developers, Are there any guidelines from the QGIS project regarding whether a QGIS plugin is allowed to autonomously install required packages using PIP or similar tools without manual installation by the user? While this might seem convenient, I see it as a potential security risk, es