Posts by QGIS Oslandia

A hydraulic engineer by training, Nicolas Godet has been working at ISL Ingénierie for just over seven years and holds the position of hydraulic project manager (flood risk, hydraulic structure safety), deputy director of the Saint-Jean-de-Luz facility, and QGIS (and GIS in general) advisor.

He discusses the implementation of QDT and the associated methodology for deploying QGIS across ISL’s IT infrastructure.

What are the objectives of the collaboration?

Before I took charge of deploying QGIS at ISL, it was a bit of a mess: no one had the same version, the same plugins, or the same practices.
Following the switch to QGIS3, there was a desire to standardize the QGIS fleet at ISL to have the same version, the same plugin base, and preconfigured profiles.

An initial, semi-homemade solution was implemented in 2022, but it proved difficult to maintain.

At the end of 2024, with a budget allocated, we decided to seek assistance from Oslandia to professionalize our QGIS deployment so that every employee would be using the same version:

• facilitate project sharing within ISL and with our clients,
• have a common and up-to-date plugin base,
• benefit from advanced pre-configuration of user profiles.

The ultimate goal was to be able to update QGIS without disrupting all the configurations.

What challenges does this project address?

The challenge was to be able to keep up with developments in QGIS while retaining profile configurations. Having attended a few presentations (QGIS Days), I had heard about QDT. After preliminary discussions with Oslandia (and in particular with Julien Moura), we agreed to go ahead with customized training. This customized training allowed us to adapt the content to our needs.

How did the collaboration with Oslandia go?

The Oslandia teams are attentive, adapt to our needs, which are not always simple, and were able to offer us tailor-made training.

We decided to have four half-days spread out over several weeks, allowing us to cover the theory and a few examples during the half-day, then work on our own and come back to the next session with questions and ask for more in-depth coverage of certain points rather than others.
There’s not much else to add except that it went very well!

Since this training, ISL has been able to invest in QDT.

Sorry, this entry is only available in French.

Sorry, this entry is only available in French.

Sorry, this entry is only available in French.

Sorry, this entry is only available in French.

Sorry, this entry is only available in French.

Do you deal with sensitive geospatial data ? Are you concerned by cybersecurity threats ?

Oslandia and partners ( e.g. OPENGIS.ch) launched the « Security Project for QGIS » : a mutualized funding effort to increase QGIS cybersecurity.

️During this webinar, Vincent Picavet first presented the context of the project : new regulations are coming ( CRA, NIS2 ), cyberattacks increase, software see a growing complexity, and QGIS legacy makes it difficult to increase security … and its benefits !

You can access the replay for free, after filling in a quick survey. 

Do not hesitate to pledge for the project on https://oslandia.com/en/security-project-for-qgis/, and contact us for any question qgis+security@oslandia.com !

Sorry, this entry is only available in French.

Sorry, this entry is only available in French.

The “Security project for QGIS” is now public ! Pledge now !

The goal of this project is to mutualize funding to improve QGIS security to the highest levels.

Oslandia and other involved partners, especially OPENGIS.ch are OpenSource “pure players” and main contributors to QGIS. This project is an initiative by Oslandia and is endorsed by the QGIS.org association. We work closely with the community of developers, users and stakeholders of QGIS. This project involves QGIS core committers willing to advance QGIS security.

Global context

New regulations like NIS2 and CRA in Europe, as well as other international or local regulations will be activated within the next couple of years. They require software and software producers to improve their cybersecurity practices. OpenSource softwares, while usually having a special treatment, are concerned too. Estimated costs of CRA impact on an opensource project amounts to +30%.

As for QGIS, we consider that the project stays behind what would be sufficient to comply with these regulations. We also do not fulfill requirements coming from our end-users, in terms of overall software quality regarding security, processes in place to ensure trust in the supply chain, and overall security culture in the project.

We have been discussing this topic with clients having large deployments of QGIS and QGIS server, and they stressed the issue, stating that cybersecurity is one of their primary concerns, and that they are willing to see the QGIS project move forward in this area as soon as possible. QGIS faces the risk of IT departments blocking QGIS installations if they consider the project not having enough consideration for security.

Also, requests to security@qgis.org have grown significantly.

Project goals

Oslandia, with other partners and backed by clients and end-users, launch the “Security project for QGIS” : we identified key topics where security improvements can be achieved, classified them, and created work packages to work on, with budget estimations.

• The main goal is simple : raise the cybersecurity level for the QGIS project
• Fulfill cybersecurity requirements from regulations and end-users
• Make QGIS an example of security-aware OpenSource project, helping other OSGeo projects to improve

While QGIS and QGIS server are the main components on which this project focus, improving QGIS security as a whole also needs to consider underlying libraries ( e.g. GDAL/OGR, PROJ, GEOS…).

This project is a specific effort to raise the level of security of QGIS. Maintaining security in the long term will need further efforts, and we encourage you to sponsor QGIS.org, becoming a sustaining member of QGIS.

Memory safety, signing binaries, supply chain management, contributing processes, plugin security, cybersecurity audits and much more topics are included in this project. You can see all items as well as work packages on the dedicated website :

https://security.qgis.oslandia.com

Project organization – Pledge !

Any organization interested in improving QGIS security can contribute to funding the project. We are looking for an estimated total amount of 670K€, divided into 3 work packages Pledge now !

Once funded, Oslandia and partners will start working on Work Package 1 in 2025. We intend to work closely with the QGIS community, QGIS.org, interested partners and users. Part of the work are improvements over the current system, other require changes to processes or developer’s habits. Working closely with the user and developer’s community to raise our security awareness is fully part of the project.

We will deliver improvements in 2025 and until 2027. You can see the full list of topics, work packages and estimated budget on the project’s dedicated page : security.qgis.oslandia.com . You are invited to participate, but also to help spread the word and recruit other contributors !

We want to especially thank Orange France for being a long-time supporter of OpenSource in general and QGIS particularly, and the first backer of the Security Project for QGIS !

Should you have any question, or need further material to convince other stakeholders, get in touch !