OpenNebula

I'm talking about release tarball (downloadable from https://github.com/OpenNebula/one/releases).

It is a disaster if 3rd party components needs to be downloaded using bower because downloading is not possible in Debian build environment (not to mention that bower is not available in Debian as far as I'm aware).

I believe it will be best to include all necessary components into tarball but make sure they are FLOSS-compliant.

I think you seriously misunderstand the problem if you think it is OK to install non-free component(s) in order to use Opennebula.
The point is to use only free components and avoid non-free dependencies (bundled or download-able)...

It is not correct to say that it is non-free, as the source is released under the new BSD license. The Flex environment itself has been open sourced in 2011 and is now managed by the Apache foundation at http://flex.apache.org/ and is Apache v2 Licensed.

Carlo, there are few problems and incorrect assumptions here:

• `WebSocketMain.swf` included to Opennebula One 4.12.3 is a pre-built binary -- its source code is nowhere to be found in the release tarball.

Source-less binaries (sometimes called "binary blobs") are non-free because they are not human-readable and not modifiable.

From Debian prospective, binary is non-free if it have no source code and/or it can't be re-built from source using software from "main" repository.

• Attempt(s) to package Flex 4 for Debian ceased due to technical and legal problems -- see details in
  • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=592007
  • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602499

As I recall there were problems like incomplete source code or essential dependencies on non-free components preventing Flex from building from sources.

I see that Apache Flex is apparently alive (so there might be little hope that some problems were addressed) but Flash is an obsolete technology anyway so I doubt that packaging it would worth the effort...

I commented on the general definition of "non-free", of course Debian has a more restrictive one (not that I complain to that).
From what I recall in my past lurker at Debian packages, the problem is not legal but merely the unavailability of a packager. The flex debugger was not necessary anymore from a long time on both Windows and Linux for doing builds; and the problems related to the need of Cygwin have been solved since 2013. The last offer for a packager for debian is from september 2014, so I guess it's more an interest/time available problem than a licensing one.
So, I agree that Debian misses a Flex package to build WebSocketMain.swf, and this makes it "non-free" for Debian, but not in a general licensing sense.
I'm pedantic, sorry :-)