compile-time dependencies on external sources?

[Steve Langasek <vorlon@netexpress.net>]

Hello,

I'm the upstream maintainer on a PAM module, pam_smbpass, which I'm interested
in packaging for Debian.  The catch is that the module requires that a
complete (well, nearly complete) copy of the Samba source code be available at
build time.  For questions of maintenance and bandwidth, I've chosen not to
include the Samba source in the tarball; I find that automatically downloading
the Samba code during the build process works just as well for upstream
purposes.

The question is, is it acceptable to do this in a Debian package?  There are
certainly 'installer' packages around which will download and package non-free
software for use with Debian... but this is non-free.  Is it acceptable to
have a Debian package which build-depends on curl, and downloads the Samba
source as part of the build process?  Or do I need to do this a different way,
e.g. using Samba source that's already available in the Debian archives, or
including the Samba tree in my package (as part of the diff !?)

Any advice, pointers, etc. are welcome.

Regards,
Steve Langasek
postmodern programmer