arduino: Has a package manager
The package manager is available in "Tools" -> "Board: [...]" -> "Boards Manager".
I've no idea of it's policies, so we need to look if the repository is fully free software. If it's fully free it might be OK FSDG wise.
I've also added an entry in the Libreplanet Wiki about it: https://libreplanet.org/wiki/Group:Software/research/ExternalRepositories
Looking under the repositories here: https://github.com/arduino
It seems that all the cores are free software.
An argument can be made though that we cannot vet third party repositories that the user can add after downloading this.
Maybe a possible solution is pre-configuring a set of vetted repositories?