Why D‑Bus and Polkit Raised Security Concerns

One of the central issues involved Deepin components that interact with privileged system services such as D‑Bus and Polkit.

These technologies manage communication between applications and system services and enforce permissions for administrative operations. If software integrating with them has design flaws or insufficient safeguards, it can potentially allow unintended access to sensitive system functionality.

Security reviews in the broader Linux ecosystem had already raised concerns about how some Deepin components handled these interfaces. For example, investigations highlighted problems in modules interacting with D‑Bus and other system services, which could have wider system impact than ordinary application bugs.

Because these components operate close to system privilege boundaries, unresolved issues were considered higher risk for an official distribution package set.

The Influence of openSUSE’s Earlier Removal

Fedora’s decision did not happen in isolation. A year earlier, openSUSE removed the Deepin desktop environment from its repositories after its security team uncovered serious packaging and security concerns.

The openSUSE investigation found that:

• A package workaround was introduced that bypassed standard RPM security review processes.
• The workaround allowed installation of components that normally require security-team approval.
• Some of those components included D‑Bus system service files and Polkit policies, which control privileged operations on the system.

Security reviewers described the bypass as a significant policy violation and part of a broader pattern of security issues discovered during code reviews of Deepin components.

After the removal, openSUSE said it would reconsider Deepin if upstream addressed the problems and presented improved components for review. Subsequent follow‑up reviews reported limited progress, so the removal remained in place.

Fedora developers later examined whether similar concerns applied to their own packages, which helped trigger the review process that ultimately led to the retirement vote.

Maintenance and Upstream Communication Issues

Beyond technical security concerns, Fedora developers also encountered practical maintenance problems.

Reports from the review process noted that it was difficult to obtain responses from some maintainers or upstream developers regarding bug reports and security questions. For distributions that rely heavily on collaboration with upstream projects, timely responses are essential for fixing vulnerabilities and maintaining stable packages.

Without active maintenance and coordination, keeping the packages in Fedora’s repositories became increasingly risky.

What This Means for Deepin Users

The retirement of Deepin packages from Fedora and openSUSE does not mean the desktop environment is unusable. Instead, it means those distributions no longer ship it as an officially supported desktop environment.

Users who still want to run Deepin generally have several options:

• Use a Linux distribution that still ships Deepin officially
• Install Deepin from third‑party or community repositories
• Build and package Deepin components manually

However, these approaches shift more responsibility to the user. When a distribution’s security and packaging teams stop maintaining software, users must rely on alternative sources for updates and vulnerability fixes.

A Broader Lesson for Linux Distributions

The Deepin situation highlights how Linux distributions balance usability with security and maintenance realities. Even visually polished desktop environments must meet strict standards for packaging, security review, and ongoing support.

In this case, unresolved security concerns, privileged system integration issues, and limited upstream responsiveness ultimately led two major distributions—openSUSE and Fedora—to conclude that Deepin did not currently meet the bar for official repository inclusion.

Why D‑Bus and Polkit Raised Security Concerns

One of the central issues involved Deepin components that interact with privileged system services such as D‑Bus and Polkit.

These technologies manage communication between applications and system services and enforce permissions for administrative operations. If software integrating with them has design flaws or insufficient safeguards, it can potentially allow unintended access to sensitive system functionality.

Security reviews in the broader Linux ecosystem had already raised concerns about how some Deepin components handled these interfaces. For example, investigations highlighted problems in modules interacting with D‑Bus and other system services, which could have wider system impact than ordinary application bugs.

Because these components operate close to system privilege boundaries, unresolved issues were considered higher risk for an official distribution package set.

The Influence of openSUSE’s Earlier Removal

Fedora’s decision did not happen in isolation. A year earlier, openSUSE removed the Deepin desktop environment from its repositories after its security team uncovered serious packaging and security concerns.

The openSUSE investigation found that:

• A package workaround was introduced that bypassed standard RPM security review processes.
• The workaround allowed installation of components that normally require security-team approval.
• Some of those components included D‑Bus system service files and Polkit policies, which control privileged operations on the system.

Security reviewers described the bypass as a significant policy violation and part of a broader pattern of security issues discovered during code reviews of Deepin components.

After the removal, openSUSE said it would reconsider Deepin if upstream addressed the problems and presented improved components for review. Subsequent follow‑up reviews reported limited progress, so the removal remained in place.

Fedora developers later examined whether similar concerns applied to their own packages, which helped trigger the review process that ultimately led to the retirement vote.

Maintenance and Upstream Communication Issues

Beyond technical security concerns, Fedora developers also encountered practical maintenance problems.

Reports from the review process noted that it was difficult to obtain responses from some maintainers or upstream developers regarding bug reports and security questions. For distributions that rely heavily on collaboration with upstream projects, timely responses are essential for fixing vulnerabilities and maintaining stable packages.

Without active maintenance and coordination, keeping the packages in Fedora’s repositories became increasingly risky.

What This Means for Deepin Users

The retirement of Deepin packages from Fedora and openSUSE does not mean the desktop environment is unusable. Instead, it means those distributions no longer ship it as an officially supported desktop environment.

Users who still want to run Deepin generally have several options:

• Use a Linux distribution that still ships Deepin officially
• Install Deepin from third‑party or community repositories
• Build and package Deepin components manually

However, these approaches shift more responsibility to the user. When a distribution’s security and packaging teams stop maintaining software, users must rely on alternative sources for updates and vulnerability fixes.

A Broader Lesson for Linux Distributions

The Deepin situation highlights how Linux distributions balance usability with security and maintenance realities. Even visually polished desktop environments must meet strict standards for packaging, security review, and ongoing support.

In this case, unresolved security concerns, privileged system integration issues, and limited upstream responsiveness ultimately led two major distributions—openSUSE and Fedora—to conclude that Deepin did not currently meet the bar for official repository inclusion.