diff --git a/no-floats-in-sources.patch b/no-floats-in-sources.patch
new file mode 100644
index 0000000..61ce923
--- /dev/null
+++ b/no-floats-in-sources.patch
@@ -0,0 +1,53 @@
+From 7b0db90c76c6b0de6a4d481e63450e8f0d1a1d9d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Budai?= <obudai@redhat.com>
+Date: Thu, 25 Jun 2020 09:56:30 +0200
+Subject: [PATCH] sources/files: do not pass floats to --max-time
+
+curl uses strtod from the C standard library to convert the --max-time's value
+from string to double. However, this is what strtod expects:
+
+nonempty sequence of decimal digits optionally containing decimal-point
+character (as determined by the current C locale)
+
+Yeah, unfortunately, the decimal-point character is determined by the current
+C locale. For example, Czech and German locale uses a comma as the
+decimal-point character.
+
+For reasons I don't fully understand, Python thinks it's running on en_US
+locale, even though LC_NUMERIC is set to cs_CZ, so it uses a full stop as the
+decimal-point character when converting float to string. However, as written
+before, curl fails to parse this because it expects comma.
+
+The fix I chose is simple: Use math.ceil, so only an integer can be passed to
+curl. Why ceil? Because --max-time == 0 sounds fishy. math.ceil should return
+an integer (and it does in Python 3.8) but the documentation is not 100% clear
+on this topic, so let's be paranoid and also convert it to int after the
+ceiling.
+---
+ sources/org.osbuild.files | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sources/org.osbuild.files b/sources/org.osbuild.files
+index 42ff6ca..13ce9b8 100755
+--- a/sources/org.osbuild.files
++++ b/sources/org.osbuild.files
+@@ -17,6 +17,7 @@ import concurrent.futures
+ import glob
+ import itertools
+ import json
++import math
+ import os
+ import subprocess
+ import sys
+@@ -102,7 +103,7 @@ def fetch(url, checksum, directory):
+             curl_command = [
+                 "curl",
+                 "--silent",
+-                "--max-time", f"{300 - elapsed_time}",
++                "--max-time", f"{int(math.ceil(300 - elapsed_time))}",
+                 "--connect-timeout", "60",
+                 "--fail",
+                 "--location",
+-- 
+2.26.2
+
diff --git a/osbuild.spec b/osbuild.spec
index 6389c39..ef35898 100644
--- a/osbuild.spec
+++ b/osbuild.spec
@@ -9,12 +9,13 @@ Version:        18
 %global         pkgdir %{_prefix}/lib/%{pypi_name}
 
 Name:           %{pypi_name}
-Release:        1%{?dist}
+Release:        2%{?dist}
 License:        ASL 2.0
 
 URL:            %{forgeurl}
 
 Source0:        %{forgesource}
+Patch0:         no-floats-in-sources.patch
 BuildArch:      noarch
 Summary:        A build system for OS images
 
@@ -79,6 +80,7 @@ containers it uses to build OS artifacts.
 
 %prep
 %forgesetup
+%patch0 -p1
 
 %build
 %py3_build
@@ -171,6 +173,10 @@ fi
 %selinux_relabel_post -s %{selinuxtype}
 
 %changelog
+* Fri Jun 26 2020 Christian Kellner <ckellner@redhat.com> - 18-2
+- Add patch to not pass floats to curl in the files source
+  https://github.com/osbuild/osbuild/pull/459
+
 * Tue Jun 23 2020 Christian Kellner <ckellner@redhat.com> - 18-1
 - Upstream release 18
 - All RHEL runners now use platform-python.