QGIS Planet

Sorry, this entry is only available in French.

The “Security project for QGIS” is now public ! Pledge now !

The goal of this project is to mutualize funding to improve QGIS security to the highest levels.

Oslandia and other involved partners, especially OPENGIS.ch are OpenSource “pure players” and main contributors to QGIS. This project is an initiative by Oslandia and is endorsed by the QGIS.org association. We work closely with the community of developers, users and stakeholders of QGIS. This project involves QGIS core committers willing to advance QGIS security.

Global context

New regulations like NIS2 and CRA in Europe, as well as other international or local regulations will be activated within the next couple of years. They require software and software producers to improve their cybersecurity practices. OpenSource softwares, while usually having a special treatment, are concerned too. Estimated costs of CRA impact on an opensource project amounts to +30%.

As for QGIS, we consider that the project stays behind what would be sufficient to comply with these regulations. We also do not fulfill requirements coming from our end-users, in terms of overall software quality regarding security, processes in place to ensure trust in the supply chain, and overall security culture in the project.

We have been discussing this topic with clients having large deployments of QGIS and QGIS server, and they stressed the issue, stating that cybersecurity is one of their primary concerns, and that they are willing to see the QGIS project move forward in this area as soon as possible. QGIS faces the risk of IT departments blocking QGIS installations if they consider the project not having enough consideration for security.

Also, requests to security@qgis.org have grown significantly.

Project goals

Oslandia, with other partners and backed by clients and end-users, launch the “Security project for QGIS” : we identified key topics where security improvements can be achieved, classified them, and created work packages to work on, with budget estimations.

• The main goal is simple : raise the cybersecurity level for the QGIS project
• Fulfill cybersecurity requirements from regulations and end-users
• Make QGIS an example of security-aware OpenSource project, helping other OSGeo projects to improve

While QGIS and QGIS server are the main components on which this project focus, improving QGIS security as a whole also needs to consider underlying libraries ( e.g. GDAL/OGR, PROJ, GEOS…).

This project is a specific effort to raise the level of security of QGIS. Maintaining security in the long term will need further efforts, and we encourage you to sponsor QGIS.org, becoming a sustaining member of QGIS.

Memory safety, signing binaries, supply chain management, contributing processes, plugin security, cybersecurity audits and much more topics are included in this project. You can see all items as well as work packages on the dedicated website :

https://security.qgis.oslandia.com

Project organization – Pledge !

Any organization interested in improving QGIS security can contribute to funding the project. We are looking for an estimated total amount of 670K€, divided into 3 work packages Pledge now !

Once funded, Oslandia and partners will start working on Work Package 1 in 2025. We intend to work closely with the QGIS community, QGIS.org, interested partners and users. Part of the work are improvements over the current system, other require changes to processes or developer’s habits. Working closely with the user and developer’s community to raise our security awareness is fully part of the project.

We will deliver improvements in 2025 and until 2027. You can see the full list of topics, work packages and estimated budget on the project’s dedicated page : security.qgis.oslandia.com . You are invited to participate, but also to help spread the word and recruit other contributors !

We want to especially thank Orange France for being a long-time supporter of OpenSource in general and QGIS particularly, and the first backer of the Security Project for QGIS !

Should you have any question, or need further material to convince other stakeholders, get in touch !

This year, OPENGIS.ch celebrated its 10th anniversary in Bern, with an afternoon full of workshops attended by clients, long-term friends, and colleagues. Here, we will give a glimpse of QField: its vision, where it’s headed, and the exciting features future users can look forward to.

QField was created on June 8th, 2011, with its first commit titled “ added first script”. Since then, it has grown into a powerful tool with a clear vision for the future: to empower people to map and understand the world, tackle daily challenges, and address global issues. Over the next ten years, QField aims to make this vision a reality for everyone, everywhere.

Layers of cake, designed by QField ecosystem’s leading team members, were explained with 2034 in mind: intuitive and accessible to anyone wanting to map our world, while pioneering an innovative and collaborative app for the geospatial community. And last but not least: building strong and engaged communities to drive further adoption of the QField ecosystem.

This vision is taking shape through the forging of strategic partnerships with geospatial stakeholders: hardware manufacturers, ambassadors, trainers and technological partners. For the team, it is clear that good collaboration is key to building a healthy and sustainable ecosystem. Community as well as financial sustainability can become a strong reality with user groups, sponsors and crowdfundings.

And then it became reality: In the summer of 2024, heavy rains caused severe flooding in Switzerland and, suddenly, QField became a vital tool for supporting emergency response through data surveys and photo documentation.

With this emotional story, the technical lead, Mathieu took over and shared other QField success stories and several mapping use cases with partners in Finland and Tonga. But seamless fieldwork wouldn’t be possible without QFieldCloud, so Ivan provided an insight into the last years’ QFieldCloud enhancements, before diving into the busy server-side roadmap for 2025, which includes many new features related to the authentication, security, internationalization and performance. Finally, Zsanett shared QField product news and updates, including new storage capacities like WebDAV and new packaging capabilities. Last but not least, the new Fangorn version introduces new features developed by the evolving QField Community.

Building communities by sharing thoughts and ideas for the ecosystem is now possible through the ideas.qfield.cloud platform, open to everybody to suggest new ideas for QField.

The final topping of the (layer) cake: the new QField plugin framework was presented to the workshop attendees by Mathieu, who explained how the field workflow can be enhanced and optimized through the development of plugins – unique extensions that further personalize QField. For example, with the Routing Plugin, users can compute optimal ways between locations directly in QField using an external API. To make team efforts in the field even more efficient, the Live Location Plugin allows each team member to see the location of other members on the QField map, preventing debilification in the field.

Last but not least, the workshop ended with a Q&A session, where several topics were addressed such as virtual reality, AI, machine learning, etc. This was followed by a happy and cheerful welcome drink with OPENGIS.chpartners. 🍻

Let’s not bury the lead here: the long-awaited capability to track position while QField is in the background or the device is locked has arrived in this brand-new version of QField. This feels like a magical moment, so we settled for a fantastical forest for our release name.

Main highlights

As highlighted above, QField 3.5 has unlocked background position tracking on the Android platform. This allows users to keep track of their positions even as they put QField in the background to conduct other tasks on their devices. It also means that tracking has become far more battery efficient, as users can lock/suspend their phones and tablets for long periods while QField continues to collect and track positions. On top of it all, this will work out of the book with internal GNSS as well as external high-precision GNSS devices.

This is a long-requested functionality for QField, and we couldn’t be prouder to deliver it to our hundreds of thousands of Android users. Big thanks to Groupements forestiers Québec , Biotope , and Terrex Seismic, who jointly sponsored the development.

Moving on to the next major feature added to this new version. Users can now easily import folders from WebDAV services and subsequently upload and download content to that remote folder within QField itself. This functionality eases friction on Android and iOS platforms where storage access is heavily regulated. This implementation highlights our commitment to providing QField users with the freedom they need to build their workflows; thanks to Prona Romandie , AgaricIG , and Oslandia for commissioning this work.

It’s important to note that the WebDAV functionality does not provide data synchronization. The download and upload operations will overwrite datasets stored locally or remotely. For users in need of synchronization and smooth project distribution, QFieldCloud is the way to go . With this new version of QField, downloading large datasets from QFieldCloud has become much more reliable, especially on devices with low memory.

Last but not least, QField has gained support for project-configured grid decoration. When activated, a grid is overlayed on top of the map canvas, which will dynamically render while panning and zooming around. The grid is configured and activated while setting up projects within QGIS itself.

Pro tip: this functionality can replace heavy grid datasets when covering a large dataset, something to consider when trying to optimize projects’ storage size. Big thanks to Oester Messtechnik GmbH for supporting the implementation of this fourth decoration following the arrival of title, copyright, and image decorations in earlier releases.

Other improvements in this release include “forward” angle snapping to digitize perfectly angled polygons, pinch gesture-driven feature rotation, and a new print template which unlocks printing of map canvas to PDF even when their projects have no layouts defined.

Plugin-specific improvements

One of the main additions to QField’s plugin framework is the capability to integrate custom results into the search bar. Thanks to Kanton Basel-Landschaft for supporting the development, users can enjoy OpenStreetMap Nominatim search result integration by installing this plugin (instructions available on the repository). This integration also opens up many new possibilities, such as enabling plugins to send prompts to AI, just like this plugin does.

Other noteworthy improvements include shipping Quick3D QML modules, which allow authors to develop 3D overlays, a new API to customize QField’s colour appearance and a new mechanism for plugins to add a configuration button within the plugin manager.

Users and plugin authors can expect an exciting year ahead as the QField plugin framework continues to grow with new functionalities and improvements. Watch this space!