ArchiveBox is fully FOSS but is almost unpackagable on stable because it depends on a mix of both pip, packages, npm, and chromium (which is only distributed via snap).

The core value provided by ArchiveBox is the integration of these disparate tools into a single UX, so it's stuck in contrib/ppa for the foreseeable future.

This is just one example of a FOSS package that doesn't fit neatly into Debian's distribution model, but there are many others.

It is hard to audit DFSG compliance for software whose build process pulls in dependencies at run time.

then.. they should just make a new "vendored" repo for that kind of software ?