openSUSE deep sixes Deepin desktop over security stink

SUSE has kicked the Deepin Desktop Environment (DDE) out of its community-driven Linux distro, openSUSE, and the reasons it gives for doing so are revealing. SUSE's security team published a blog post – Removal of Deepin Desktop from openSUSE due to Packaging Policy Violation – that makes for eye-opening reading. The news comes just a week after openSUSE Leap 16 entered beta, a release which contains some interesting wrinkles of its own. Deepin is the desktop of Chinese vendor Uniontech's OS, Linux Deepin, which we last looked at in August 2024. In terms of appearance, the Deepin desktop is gorgeous. It's colorful, fluid, and friendly. It has a strong Windows 11 influence on its layout, but it's not a direct clone like the strange Wubuntu distro. It is also found on a few other distros, such as Ubuntu DDE, which we last looked at when the 22.04 version appeared. According to the SUSE Security Team, though, DDE's beauty is only skin deep. Beneath the polished surface, it's not pretty at all. The team enumerates a whole list of problems, including claimed abuses of D-Bus and Polkit, but also some very poor design decisions. Some of these represent major security holes in the dde-api-proxy module, which are covered in depth here. The team has also publicly reported issues with Deepin's D-Bus services and the Deepin clone tool. SUSE's engineers have raised these issues with the upstream developers, and in the few cases where the company did get responses or code changes, its opin...