diff --git a/.gitignore b/.gitignore
index d17478d..ecabb93 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,3 +28,4 @@
 /apache-log4j-2.17.1-src.tar.gz.asc
 /apache-log4j-2.17.2-src.tar.gz
 /apache-log4j-2.17.2-src.tar.gz.asc
+/log4j-2.17.2.tar.gz
diff --git a/generate-tarball.sh b/generate-tarball.sh
new file mode 100755
index 0000000..ea8279b
--- /dev/null
+++ b/generate-tarball.sh
@@ -0,0 +1,28 @@
+#!/bin/bash
+set -e
+
+name=log4j
+version="$(sed -n 's/Version:\s*//p' *.spec)"
+
+# RETRIEVE
+wget "https://archive.apache.org/dist/logging/log4j/${version}/apache-log4j-${version}-src.tar.gz" -O "${name}-${version}.orig.tar.gz"
+wget "https://archive.apache.org/dist/logging/log4j/${version}/apache-log4j-${version}-src.tar.gz.asc" -O "${name}-${version}.orig.tar.gz.asc"
+wget "https://www.apache.org/dist/logging/KEYS" -O "${name}-${version}.keyring"
+
+# VERIFY
+$(rpm -E '%{gpgverify}') --keyring="${name}-${version}.keyring" --signature="${name}-${version}.orig.tar.gz.asc" --data="${name}-${version}.orig.tar.gz"
+
+rm -rf tarball-tmp
+mkdir tarball-tmp
+pushd tarball-tmp
+tar -xf "../${name}-${version}.orig.tar.gz"
+
+# CLEAN TARBALL
+find -name '*.jar' -delete
+find -name '*.class' -delete
+find -name '*.zip' -delete
+find -name '*.dll' -delete
+
+tar -czf "../${name}-${version}.tar.gz" *
+popd
+rm -r tarball-tmp "${name}-${version}.orig.tar.gz"
diff --git a/log4j.spec b/log4j.spec
index 07f2565..35f032c 100644
--- a/log4j.spec
+++ b/log4j.spec
@@ -2,21 +2,19 @@
 
 Name:           log4j
 Version:        2.17.2
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        Java logging package
 BuildArch:      noarch
 ExclusiveArch:  %{java_arches} noarch
 License:        ASL 2.0
 
 URL:            https://logging.apache.org/%{name}
-Source0:        https://www.apache.org/dist/logging/%{name}/%{version}/apache-%{name}-%{version}-src.tar.gz
-Source1:        https://www.apache.org/dist/logging/%{name}/%{version}/apache-%{name}-%{version}-src.tar.gz.asc
-Source2:        https://www.apache.org/dist/logging/KEYS
+
+# ./generate-tarball.sh
+Source0:        %{name}-%{version}.tar.gz
 
 Patch2:         logging-log4j-Remove-unsupported-EventDataConverter.patch
 
-BuildRequires:  gnupg2
-
 BuildRequires:  maven-local
 BuildRequires:  mvn(com.fasterxml.jackson.core:jackson-annotations)
 BuildRequires:  mvn(com.fasterxml.jackson.core:jackson-core)
@@ -138,7 +136,6 @@ Summary:        API documentation for %{name}
 %{summary}.
 
 %prep
-%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q -n apache-%{name}-%{version}-src
 %autopatch -p1
 
@@ -289,6 +286,9 @@ rm -r log4j-1.2-api/src/main/java/org/apache/log4j/or/jms
 
 
 %changelog
+* Thu Oct 13 2022 Marian Koncek <mkoncek@redhat.com> - 2.17.2-4
+- Remove glyphicons zip archive from source package
+
 * Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.2-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 
diff --git a/sources b/sources
index b0a3e84..9ba6b74 100644
--- a/sources
+++ b/sources
@@ -1,3 +1 @@
-SHA512 (apache-log4j-2.17.2-src.tar.gz) = ae09c3af8662fcf5fdc4e7c7dd298e91ec85e90272b8247ce4ee60c7d4ecd48a4cd294fc9e51c0b307fbb58c677e61e31527eab4085debcc9b40919af0920176
-SHA512 (apache-log4j-2.17.2-src.tar.gz.asc) = ad1d0ae72ea26bab286160f6e663cc4e25209f99169f1bb06366e112844282b3154d93d7d57df193527c2821d6e4ce7ad1d4f224d46326a3a1264e289c973a2e
-SHA512 (KEYS) = c149ef131b44cc261b9efc30510ab40837cd1a26d3c1167cd21be6e3ed1d158de4537b399a09824695fcc6e5280ba73f28f39cdf739815f534c535fd1c42d886
+SHA512 (log4j-2.17.2.tar.gz) = b441989438a57ce83f99a5f28ff739155b41b98813687659ba26781610faa9209785d3264b53aa244a28259f190b62ab7df6670015233522233c1c032b43fcce