5

Can anyone provide some insight into the meaning of the "trusted" flag (true/false) that is listed on the QGIS plugin website when viewed here -

http://plugins.qgis.org/plugins/plugins.xml?qgis=2.14

Our IT department have stumbled across this page rather than the usual webpage view (http://planet.qgis.org/plugins/) and now they are concerned that those flagged as "Trusted = false" are potentially dodgy.

We found this page that provides some explanation - http://hub.qgis.org/projects/quantum-gis/wiki/PluginRepository

But can someone please clarify if a FALSE trusted rating simply means the plugin needs to be reviewed and approved by moderators before it will be made visible to the public or if it actually means there is a level of uncertainty even once it is approved and appears on the public plugin lists?

5

Plugins are 3rd party contributions to QGIS. As such, it is not possible for the core team to guarantee for their quality. A review process for plugins in place but this cannot catch every possible problem with or threat from plugins.

While this may be clear for many, for a lot of users this distinction is not clear. To prevent the core QGIS project from being made responsible for damage introduced by plugins it has been decided to add this flag.

Trusted here means, that the developers are well-known in the QGIS community and it can therefore be expected that the code should be of good quality and not malicious.

Plugins which are not tagged as trusted are by no means dodgy per se!¹ You are encouraged to do some research on the plugin to see if it looks trustworthy. If you know the author personally, you can ignore this flag and trust the plugin ultimately.

The trusted status is not assigned in the review process. There, plugins are only approved. Trusted status is given based on trust of the author.

https://lists.osgeo.org/pipermail/qgis-psc/2016-May/004380.html

Update:

The QGIS Project Steering Committee (PSC) has released an explanatory blog post about trusted plugins (meta information: not least triggered by this questions).

[1] Knowing that you did not say that in your question

| improve this answer | |
  • 1
    Perhaps the flag should be expanded from Trusted to Trusted Author to make things clearer. It still might be that the account of a trusted contributor gets hacked, and malware is spread under his name. So no perfect safety here (as anywhere). – AndreJ Jul 23 '16 at 7:23
  • Good point. I'm sure that will have good chances if you bring it up in the mailing list. – Matthias Kuhn Jul 23 '16 at 10:35
  • Sorry... mean to add - is there any reason why the trusted flag is only on this one (hard to find) page, and not on any of the usual avenues (either the plugin manager within qgis or the main qgis plugin page)? Also, in order to get approved and added to the repository, they have undergone some level of review? – Jamie Jul 23 '16 at 12:12
  • In QGIS 2.16 plugin manager, I see a big green banner on top of a trusted plugin, and the plugin is in green letters in the list. This does not seem to have been backported to QGIS 2.14.4. Doing the same on plugins.qgis.org/plugins would be a good idea. – AndreJ Jul 24 '16 at 6:00
  • @MatthiasKuhn I added a feature request to hub.qgis.org/issues/14916. Not sure if the ticket will be reopened. – AndreJ Jul 24 '16 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.