diff --git a/.gitignore b/.gitignore
index d27f16b..17ee1c1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,3 +18,4 @@
 /6.11.tar.gz
 /6.12.tar.gz
 /6.14.3.tar.gz
+/testng-6.14.3.tar.gz
diff --git a/0001-Avoid-accidental-javascript-in-javadoc.patch b/0001-Avoid-accidental-javascript-in-javadoc.patch
index 8016b86..9df54e3 100644
--- a/0001-Avoid-accidental-javascript-in-javadoc.patch
+++ b/0001-Avoid-accidental-javascript-in-javadoc.patch
@@ -1,17 +1,17 @@
-From 214bd64764a48c5c3ad68829e0e35377f45ce221 Mon Sep 17 00:00:00 2001
+From bce3019741aeb785658b23095ae408a6c2d8ca35 Mon Sep 17 00:00:00 2001
 From: Michael Simacek <msimacek@redhat.com>
 Date: Wed, 31 May 2017 13:44:36 +0200
-Subject: [PATCH] Avoid accidental javascript in javadoc
+Subject: [PATCH 1/2] Avoid accidental javascript in javadoc
 
 ---
  src/main/java/org/testng/xml/TestNGContentHandler.java | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/main/java/org/testng/xml/TestNGContentHandler.java b/src/main/java/org/testng/xml/TestNGContentHandler.java
-index e36c413..da9a069 100755
+index 450678f..11543e3 100644
 --- a/src/main/java/org/testng/xml/TestNGContentHandler.java
 +++ b/src/main/java/org/testng/xml/TestNGContentHandler.java
-@@ -240,7 +240,7 @@ public class TestNGContentHandler extends DefaultHandler {
+@@ -245,7 +245,7 @@ public class TestNGContentHandler extends DefaultHandler {
    }
  
    /**
@@ -21,5 +21,5 @@ index e36c413..da9a069 100755
    private void xmlScript(boolean start, Attributes attributes) {
      if (start) {
 -- 
-2.9.4
+2.17.1
 
diff --git a/0002-Replace-bundled-jquery-with-CDN-link.patch b/0002-Replace-bundled-jquery-with-CDN-link.patch
new file mode 100644
index 0000000..e3c956e
--- /dev/null
+++ b/0002-Replace-bundled-jquery-with-CDN-link.patch
@@ -0,0 +1,39 @@
+From 9155677e2d5acdd2379c38041189da52c7f04946 Mon Sep 17 00:00:00 2001
+From: Michael Simacek <msimacek@redhat.com>
+Date: Wed, 18 Jul 2018 15:57:49 +0200
+Subject: [PATCH 2/2] Replace bundled jquery with CDN link
+
+---
+ src/main/java/org/testng/reporters/jq/Main.java | 2 +-
+ src/main/resources/org/testng/header            | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/main/java/org/testng/reporters/jq/Main.java b/src/main/java/org/testng/reporters/jq/Main.java
+index cb83ff9..b691674 100644
+--- a/src/main/java/org/testng/reporters/jq/Main.java
++++ b/src/main/java/org/testng/reporters/jq/Main.java
+@@ -19,7 +19,7 @@ import java.util.List;
+ public class Main implements IReporter {
+   private static final String TESTNG_RESOURCE_PREFIX = "/org/testng/";
+   private static final String[] RESOURCES = new String[] {
+-    "jquery-1.7.1.min.js", "testng-reports.css", "testng-reports.js",
++    "testng-reports.css", "testng-reports.js",
+     "passed.png", "failed.png", "skipped.png", "navigator-bullet.png",
+     "bullet_point.png", "collapseall.gif"
+   };
+diff --git a/src/main/resources/org/testng/header b/src/main/resources/org/testng/header
+index 47f897b..a302d47 100644
+--- a/src/main/resources/org/testng/header
++++ b/src/main/resources/org/testng/header
+@@ -6,7 +6,7 @@
+   <title>TestNG reports</title>
+ 
+     <link type="text/css" href="testng-reports.css" rel="stylesheet" />
+-    <script type="text/javascript" src="jquery-1.7.1.min.js"></script>
++    <script type="text/javascript" src="https://code.jquery.com/jquery-1.7.1.min.js"></script>
+     <script type="text/javascript" src="testng-reports.js"></script>
+     <script type="text/javascript" src="https://www.google.com/jsapi"></script>
+     <script type='text/javascript'>
+-- 
+2.17.1
+
diff --git a/generate-tarball.sh b/generate-tarball.sh
new file mode 100755
index 0000000..4947a6d
--- /dev/null
+++ b/generate-tarball.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+set -e
+
+name=testng
+version="$(sed -n 's/Version:\s*//p' *.spec)"
+
+# RETRIEVE
+wget "https://github.com/cbeust/testng/archive/${version}.tar.gz" -O "${name}-${version}.orig.tar.gz"
+
+rm -rf tarball-tmp
+mkdir tarball-tmp
+cd tarball-tmp
+tar xf "../${name}-${version}.orig.tar.gz"
+
+# CLEAN TARBALL
+rm -r */gradle* */kobalt*
+rm */src/main/resources/org/testng/jquery-*.js
+
+tar cf "../${name}-${version}.tar.gz" *
+cd ..
+rm -r tarball-tmp "${name}-${version}.orig.tar.gz"
diff --git a/sources b/sources
index 073c0da..0055bc4 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (6.14.3.tar.gz) = 500a369f4c91272a78d3658675b9b0eb53aa071038181bf136801a63c86cb7bccdaf6597f9cf2de45a3f018f6cde1359744b2ac1df303511a3518f41e0f62acd
+SHA512 (testng-6.14.3.tar.gz) = cec176c1c886b4f8f54021910af4637004854e88f928496acd67b9bc1ea2c78bc86451f37b98269aa56d8ec88b2c0fb75fa5c3cf7ea72e19192f910dd8242cfa
diff --git a/testng.spec b/testng.spec
index 3c649ae..7c089e3 100644
--- a/testng.spec
+++ b/testng.spec
@@ -3,16 +3,21 @@
 
 Name:           testng
 Version:        6.14.3
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        Java-based testing framework
 License:        ASL 2.0
 URL:            http://testng.org/
-Source0:        https://github.com/cbeust/testng/archive/%{version}.tar.gz
+# ./generate-tarball.sh
+Source0:        %{name}-%{version}.tar.gz
 
 # Allows building with maven instead of gradle
 Source1:        pom.xml
 
+# Remove bundled binaries to make sure we don't ship anything forbidden
+Source2:        generate-tarball.sh
+
 Patch0:         0001-Avoid-accidental-javascript-in-javadoc.patch
+Patch1:         0002-Replace-bundled-jquery-with-CDN-link.patch
 
 BuildArch:      noarch
 
@@ -48,9 +53,10 @@ Summary:        API documentation for %{name}
 This package contains the API documentation for %{name}.
 
 %prep
-%setup -q -n %{name}-%{version}
+%setup -q
 
 %patch0 -p1
+%patch1 -p1
 
 cp %{SOURCE1} .
 
@@ -107,6 +113,10 @@ cp -p ./src/main/java/*.dtd.html ./src/main/resources/.
 %license LICENSE.txt
 
 %changelog
+* Wed Jul 18 2018 Michael Simacek <msimacek@redhat.com> - 6.14.3-5
+- Clean tarball from binaries
+- Replace bundled jquery with CDN link
+
 * Tue Jul 17 2018 Mikolaj Izdebski <mizdebsk@redhat.com> - 6.14.3-4
 - Allow conditionally building without snakeyaml