Repack the tarball without binaries

generate-tarball.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+set -e
+
+name=velocity
+version="$(sed -n 's/Version:\s*//p' *.spec)"
+
+# RETRIEVE
+wget "http://www.apache.org/dist/${name}/engine/${version}/${name}-${version}.tar.gz" -O "${name}-${version}.orig.tar.gz"
+
+rm -rf tarball-tmp
+mkdir tarball-tmp
+cd tarball-tmp
+tar xf "../${name}-${version}.orig.tar.gz"
+
+# CLEAN TARBALL
+rm -r */*.jar
+rm -r */lib
+
+tar cf "../${name}-${version}.tar.gz" *
+cd ..
+rm -r tarball-tmp "${name}-${version}.orig.tar.gz"

sources

@@ -1 +1 @@
-6af13ea297dee7ddbabeaa8e3963c184  velocity-1.7.tar.gz
+SHA512 (velocity-1.7.tar.gz) = d305642aab3c837ad250deaa46b516561fb68f92d04fc205fd4f40eb774ba6286ed3b239ee6352bc4411bd11cb4d1d5b39ce9ab8467f0e1ffceed9f9fc5a228d

velocity.spec

@@ -2,15 +2,18 @@
 
 Name:           velocity
 Version:        1.7
-Release:        23%{?dist}
+Release:        24%{?dist}
 Epoch:          0
 Summary:        Java-based template engine
 License:        ASL 2.0
 URL:            http://velocity.apache.org/
 BuildArch:      noarch
 
-Source0:        http://www.apache.org/dist/%{name}/engine/%{version}/%{name}-%{version}.tar.gz
+# ./generate-tarball.sh
+Source0:        %{name}-%{version}.tar.gz
 Source1:        http://repo1.maven.org/maven2/org/apache/%{name}/%{name}/%{version}/%{name}-%{version}.pom
+# Remove bundled binaries which cannot be easily verified for licensing
+Source2:        generate-tarball.sh
 
 Patch0:         0001-Remove-avalon-logkit.patch
 Patch1:         0004-Use-log4j-1.2.17.patch
@@ -192,6 +195,9 @@ cp -pr examples test %{buildroot}%{_datadir}/%{name}
 %{_datadir}/%{name}
 
 %changelog
+* Tue Jul 31 2018 Michael Simacek <msimacek@redhat.com> - 0:1.7-24
+- Repack the tarball without binaries
+
 * Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0:1.7-23
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild