1 What it is for

ENCs are the electronic navigational charts of the sea and its ports, Inland ENCs those of the inland waterways; the postProcessor works both, in S-57 and in S-101, and audits S-102 depth surfaces. The navigation systems on board and the displays of traffic centres draw them.

Every chart describes the water as a skin: areas of known depth, areas never surveyed, and land. That skin must fit together without gaps, overlaps or edges that cross. A fault can make a ship's system refuse the chart, or draw it wrongly.

The postProcessor is a plug-in for QGIS, the free desktop GIS. Before the office issues a set of charts, it finds those faults, proposes the smallest repair that breaks nothing else, and — once a cartographer approves it — writes the repairs into a copy of the set.

2 What it does

• Reviews a whole set at once, on all processors, and grades every fault: A and B are repaired safely by rule, C offers a cure to choose, D is decided by hand.
• Shows every fault on the map, beside the chart; audits the set by S-58 or S-158 and the catalogue.
• Lets the cartographer repair by hand, with the same checks.
• Changes what a chart says: a name, a depth, a light; adds, moves or deletes an object — in every chart it lies in.
• Keeps every change as an edit to approve, writes them all in one go, and reads every file back to prove it.
• Compares the charts with the office's own GIS service — a register of buoys, for instance — and suggests the updates.
• Makes a delivery report: what was found, what was changed, and how long each step took.
• Makes a set of its own for a traffic centre whose display cannot show unsurveyed areas; converts an S-57 set to S-101 by written rules, with a report per dataset.

4 Licence

Free and open-source software under the GNU General Public License, version 3 or later (GPL-3.0-or-later). The office may use it without a fee, read and change its code, and pass it on. Whoever passes on a changed version passes on its source, under the same licence. There is no warranty. Its text comes with it: LICENSE.

Copyright (C) 2026 W.D. de Pooter

• It goes to an office as one ZIP file, not through the public QGIS plugin repository.
• It runs inside QGIS (GPL-2.0-or-later) and uses what QGIS brings: shapely (BSD-3-Clause), numpy (BSD-3-Clause, with parts under other permissive licences), GDAL (MIT).
• It carries the S-57 object catalogue as tables from OpenCPN's data files (GPL-2.0-or-later), and the SCAMIN tables of the Inland ENC Encoding Guide and of the IHO's Use of the Object Catalogue.
• It carries, unmodified and not under this licence, the Inland ENC Feature Catalogues 2.3, 2.4 and 2.5.1 — open data of the Inland ENC Harmonization Group, ienc.openecdis.org — and the IHO's S-101 Feature Catalogues and S-158 checks, by the IHO's leave.
• The background map, OpenStreetMap (© OpenStreetMap contributors), is loaded by QGIS while working, never delivered, and can be switched off.

5 What it needs

6 Measured · 0.6.5, 2026-09-27

On a laptop workstation with 8 cores and 16 threads (Intel Core i9-9980HK), 64 GB of memory, Windows 11, with the set U6 Aanloop Amsterdam: 128 charts, 196 MB.

1 Connections

Does the plugin make outside connections?

Only through QGIS's own network access, never on its own: no sockets of its own, no telemetry, no update check, no error report sent anywhere. Its worker processes make no connection at all.

QGIS reaches outside for it in four cases, each through QGIS's own network access and data providers — so with QGIS's own network, proxy, certificate and authentication settings:

1. The background map. When a set is opened, the plugin puts OpenStreetMap under the chart, and QGIS fetches its tiles from tile.openstreetmap.org over HTTPS. Without a connection it simply draws nothing. The office can switch it off: with background map (OpenStreetMap) unticked in officeSettings, no set brings it in, and nothing reaches that address for the plugin. One a QGIS project already holds stays that project's.
2. The office's GIS service that a model compares the charts with (WFS or OGC API – Features): read when a model is opened in its editor, and when it is run.
3. What a person opens in the model editor: a layer of the QGIS project, or a connection registered in QGIS — a database among them (PostgreSQL, SQL Server or Oracle), through QGIS's providers and their client libraries.

Does it send data out?

No. It reads services; it never uploads, posts or reports anything.

2 Files and credentials

What does it write, and where?

• In the QGIS profile: the office's settings file, pdm_postprocess\reference.gpkg.
• In the home directory the office sets, on a fixed disk of the workstation, outside OneDrive: production, the new set with the repairs, <set>_altN — when asked, a set of copies, a set for a traffic centre and the S-101 set a conversion makes, <set>_S101; reviews, the delivery report of every write; a workspace, emptied at every start.
• The delivered set itself is only read, never written.

Does it keep passwords?

It keeps none. A service that needs a login should use QGIS's authentication manager: only the name of that entry (authcfg) is kept, and the secret stays in QGIS's own encrypted store.

The private key that signs an S-101 set is treated the same: its path is asked at every conversion, goes to the worker that signs and is kept nowhere — not in the settings, not in the job file, not in a report. The certificate's path is kept in the settings file.

When a model is registered or exported, every secret written into a service address is taken out first: a user name, a password, an API key, a token, a signature, and an HTTP header that carries one, such as Authorization or Cookie. An address the plugin cannot read completely is not kept at all, and the plugin says to use the authentication manager.

What does it record about people and machines?

The journal and the delivery report record file paths (a path under the user's profile shows the account name), the plugin's and QGIS's versions, and the number of processors. No user name or machine name is looked up.

3 Code and delivery

Does it run other programs?

Only its own worker processes: QGIS's own Python, running the plugin's worker script on this machine, for the heavy work. No shell, no downloads, no installers. Help pages and reports open in the system's browser.

Does it need administrator rights?

No. It installs into the user's QGIS profile, like any QGIS plug-in.

How is the code checked?

A version ships only when its gate finds nothing: bandit (a security scanner) over what ships, detect-secrets over every tracked file, flake8 style, a type check of every function, and the ZIP searched for stray or personal files. The whole test harness must pass as well. XML is read defensively: a document that declares a DOCTYPE or an entity is refused. There is no compiled code in it: it is Python, readable as shipped.

Can we check a delivery?

Every delivery's SHA-256 is recorded, and given with the ZIP. Compare it before installing (PowerShell: Get-FileHash).

Can we read the source?

Yes: under the GPL the office that receives the plugin may have its source. The S-57 to S-101 converter it carries, s57to101, is GPL-3.0-or-later too (the same author), unchanged: each file's checksum is in engine/pp_s57to101/CARRIED.md.

Does it sign the S-100 data it writes?

Not yet: the IHO has postponed S-100's signatures, and signing is the next version. A dataset it changes goes out unsigned, its old signature taken out of the catalogue, never left to fail.