Remove auto-install of package

[fralau]

Discussed in #261

^{Originally posted by kriberg April 19, 2025}
I was just wondering what the rationale was for installing packages from within the plugin loader? Wouldn't it be better to have the standard python tooling the user is probably already using, rather than using subprocess to call pip3 install?

As in #261

(@kriberg) I think it's somewhat of a security issue and we should probably remove this. The pluglet loader should try to load modules. If they aren't present, then log an error.

(@fralau)
You might be right and it is a corner case anyway; the benefits of automation might not be worth the trouble.

[fralau]

Thanks for the proposal!

I understand the objection about downloading a package automatically.

However, my original consideration was that if someone updates the config file with the name of a pluglet, is because they want to install that pluglet. In other words, it should translate into an order to install.

Would you agree with that statement, or do you have another view?

[celskeggs]

It's important to me (and likely to other users) to be able to audit the list of dependencies used in an application, especially if that application runs in a sensitive environment. When standard mechanisms of defining dependencies are used (such as requirements.txt and similar), it's easy to use standard tools to collect a list of all dependencies that are used and check them against vulnerability databases.

I see two problems with the current approach:

1. Automatically installing dependencies from a configuration file bypasses the standard processes for installing software, making it harder for security audits to recognize that vulnerable software is used.
2. Automatic installation of dependencies is surprising; it is possible that a user does not realize that adding a plugin to a config file will result in that plugin getting automatically installed. The plugin may not be available in pypi under the same name that is used to import the plugin, if the plugin is available in pypi at all. So running pip install on the plugin name may result in an installation of an unexpected different Python module. This can be exploited through a "typosquatting" attack.

In other words, I am worried that this feature is a cybersecurity vulnerability. A simple oversight by a user could let an attacker exploit this feature to inject malicious code into a sensitive environment without being caught by standard security auditing processes.

[fralau]

Thanks for your comment!