diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..3c87b13
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+/gpg-117E8C168EFE3A7F.key
+/weldr-client-35.1.tar.gz
diff --git a/sources b/sources
new file mode 100644
index 0000000..b219810
--- /dev/null
+++ b/sources
@@ -0,0 +1,2 @@
+SHA512 (gpg-117E8C168EFE3A7F.key) = 36712a4e05cbb2ca139e777d8b2abe4ee0536f970208c2c2c1a50a2294979b828a9d6abcbad1dce3cc015a0c4364ab87ab04cb459811ad3aca5cf6611093b9bd
+SHA512 (weldr-client-35.1.tar.gz) = 8508b446c44eae917710083c8185054e3a89f799723b71e2d0069ce35c653ea2adabcab3b8d7d9a903f127798368933ba765c603ebed4fe3f6c6187c032a793c
diff --git a/weldr-client-35.1.tar.gz.asc b/weldr-client-35.1.tar.gz.asc
new file mode 100644
index 0000000..df7d102
--- /dev/null
+++ b/weldr-client-35.1.tar.gz.asc
@@ -0,0 +1,11 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAABCgAdFiEEtMa0UeT6i0IyyhkeEX6MFo7+On8FAmB0v1oACgkQEX6MFo7+
+On/fBQgAheXV7RRzQEKiYTc53dNKY2+jTzy++W2BpBnpMVIkcu8LjSLQ9sD2AF5o
+90aeeTnMs4o2YKjInj2Rl/TfnA0JfHl+es/QcpKwM6Tl7Znn9570hRy10JuRojSe
+4Lq8wxcr8m5oxAzE1UAvz4ws0xdgHwvhPJJUfMNXANj5BX7M/5A3493zDAkwvQ9H
+3VdPenPgZk2nwjml0IgtTR+sRn1aJC0yXYtcP2bAlOV3sAklVkIGhL3E9bh78Bbj
+oRCN50Bw3jrFmhisfT1HhKtW0B64mg12uIXAqi0S471O4eiy4cF6SFh9L5bSqaTZ
+Zw1nTyzykUR0DCtQ6n/Vcqo7jl8Fsw==
+=YWa+
+-----END PGP SIGNATURE-----
diff --git a/weldr-client.spec b/weldr-client.spec
new file mode 100644
index 0000000..4a2af18
--- /dev/null
+++ b/weldr-client.spec
@@ -0,0 +1,140 @@
+# Pass --with tests to rpmbuild to build composer-cli-tests
+%bcond_with tests
+
+%global goipath         github.com/osbuild/weldr-client
+
+Name:      weldr-client
+Version:   35.1
+Release:   1%{?dist}
+# Upstream license specification: Apache-2.0
+License:   ASL 2.0
+Summary:   Command line utility to control osbuild-composer
+Url:       %{gourl}
+Source0:   https://github.com/osbuild/weldr-client/releases/download/v%{version}/%{name}-%{version}.tar.gz
+Source1:   https://github.com/osbuild/weldr-client/releases/download/v%{version}/%{name}-%{version}.tar.gz.asc
+Source2:   https://keys.openpgp.org/vks/v1/by-fingerprint/117E8C168EFE3A7F#/gpg-117E8C168EFE3A7F.key
+
+Obsoletes: composer-cli < 34.0
+Provides: composer-cli = %{version}-%{release}
+
+%gometa
+
+BuildRequires:  %{?go_compiler:compiler(go-compiler)}%{!?go_compiler:golang}
+%if 0%{?fedora}
+BuildRequires:  golang(github.com/BurntSushi/toml)
+BuildRequires:  golang(github.com/spf13/cobra)
+# Required for tests and %check
+BuildRequires:  golang(github.com/stretchr/testify/assert)
+BuildRequires:  golang(github.com/stretchr/testify/require)
+%endif
+
+BuildRequires: git-core
+BuildRequires: make
+BuildRequires: gnupg2
+
+
+%description
+Command line utility to control osbuild-composer
+
+%prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
+%if 0%{?rhel}
+%forgeautosetup -p1
+%else
+%goprep
+%endif
+
+%build
+%if 0%{?rhel}
+GO_BUILD_PATH=$PWD/_build
+install -m 0755 -vd $(dirname $GO_BUILD_PATH/src/%{goipath})
+ln -fs $PWD $GO_BUILD_PATH/src/%{goipath}
+cd $GO_BUILD_PATH/src/%{goipath}
+install -m 0755 -vd _bin
+export PATH=$PWD/_bin${PATH:+:$PATH}
+export GOPATH=$GO_BUILD_PATH:%{gopath}
+export GOFLAGS=-mod=vendor
+%else
+export GOPATH="%{gobuilddir}:${GOPATH:+${GOPATH}:}%{?gopath}"
+export GO111MODULE=off
+%endif
+
+export LDFLAGS="-X github.com/osbuild/weldr-client/cmd/composer-cli/root.Version=%{version} "
+make GOBUILDFLAGS="%{gobuildflags}" build
+
+## TODO
+##make man
+
+%if %{with tests} || 0%{?rhel}
+# Build test binaries with `go test -c`, so that they can take advantage of
+# golang's testing package. The golang rpm macros don't support building them
+# directly. Thus, do it manually, taking care to also include a build id.
+#
+# On Fedora, also turn off go modules and set the path to the one into which
+# the golang-* packages install source code.
+%if 0%{?fedora}
+export GOPATH="%{gobuilddir}:${GOPATH:+${GOPATH}:}%{?gopath}"
+export GO111MODULE=off
+%endif
+
+export LDFLAGS="-X github.com/osbuild/weldr-client/cmd/composer-cli/root.Version=%{version} "
+export BUILDTAGS="integration"
+make GOBUILDFLAGS="%{gobuildflags}" integration
+%endif
+
+%install
+make DESTDIR=%{buildroot} install
+
+%if %{with tests} || 0%{?rhel}
+make DESTDIR=%{buildroot} install-tests
+%endif
+
+%check
+%if 0%{?fedora}
+export GOPATH="%{gobuilddir}:${GOPATH:+${GOPATH}:}%{?gopath}"
+export GO111MODULE=off
+%endif
+
+export LDFLAGS="-X github.com/osbuild/weldr-client/cmd/composer-cli/root.Version=%{version} "
+make GOBUILDFLAGS="%{gotestflags}" test
+
+%files
+%license LICENSE
+%doc examples HACKING.md README.md
+%{_bindir}/composer-cli
+%dir %{_sysconfdir}/bash_completion.d
+%{_sysconfdir}/bash_completion.d/composer-cli
+%{_mandir}/man1/composer-cli*
+
+%if %{with tests} || 0%{?rhel}
+%package tests
+Summary:    Integration tests for composer-cli
+
+%description tests
+Integration tests to be run on a pristine-dedicated system to test the
+composer-cli package.
+
+%files tests
+%license LICENSE
+%{_libexecdir}/tests/composer-cli/
+%endif
+
+
+%changelog
+* Mon Apr 12 2021 Brian C. Lane <bcl@redhat.com> - 35.1-1
+- New release: 35.1 (bcl)
+- spec: Change release back to 1 (bcl)
+- spec: Move testify BuildRequires into fedora block (bcl)
+- vendor: Add vendored dependencies for RHEL (bcl)
+- tools: Add prepare-source.sh vendoring helper script (bcl)
+- Makefile: skip vendor directory for check target (bcl)
+- spec: Bump release to 2 (bcl)
+- spec: Fix BuildRequires for tests (bcl)
+- Makefile: Remove executable from bash completion (bcl)
+- Makefile: Only use GOBUILDFLAGS (bcl)
+- spec: Bump release to 2 (bcl)
+- spec: Add doc files (bcl)
+- spec: Add gpg signature verification (bcl)
+- spec: Use git-core instead of git (bcl)
+- spec: Set License to Apache 2.0 (bcl)
+- spec: Update Source urls with new project location (bcl)
\ No newline at end of file