Removal of Deepin Desktop from OpenSUSE Due to Packaging Policy Violation (opens in new tab)

I was impressed at this. By sharing side-load instructions and by the the overall restrained language of the post, they're emphasizing that this is not a personal attack on Deepin or an attempt to hurt Deepin and also emphasizing that OpenSUSE leadership understands the value of their community and have no power fantasy aspirations about trying to exert undue control over the users of the distribution. Really, OpenSUSE had more than enough ammunition to make a scathing takedown on the behavior of the Deepin maintainer and all of Deepin upstream, and many other OSS leaders would have done so ("Fuck Nvidia" anyone?), but they did not. They chose restraint and statements encouraging reconciliation. Cheers to the author for keeping it together in this obviously quite disappointing situation.

That surprised me too. It's strange to see one of the most well-known Linux names to suggest adding an unreviewed repo that contains known security flaws in official documentation.

A Linux distribution is free to define its own security policy, which serves as a common understanding between developers and users.

And not all packages require auditing. The primary concern here lies with D-Bus services. Many D-Bus services need to run as root while allowing non-root users to access them. This enables users to perform tasks such as mounting or unmounting block devices without relying on SUID or sudo.

Such services are often referred to as "security boundaries", because they help isolate different privilege levels. Thus, security of those service is vital, especially in enterprise-oriented distributions.

Since you mention infrastructure,

https://www.fortinet.com/resources/cyberglossary/shift-left-...

Follow up reading CIS and related reasonings.

https://www.cisecurity.org/cis-benchmarks

There are also some Linux Plumers, NDC and Devvoxx talks on security.