Clean tarball from content with questionable licensing

Resolves: rhbz#1973743

.gitignore

@@ -10,3 +10,4 @@
 /xmlunit-2.6.3-src.tar.gz
 /xmlunit-2.7.0-src.tar.gz
 /xmlunit-2.8.2-src.tar.gz
+/xmlunit-2.8.2.tar.gz

generate-tarball.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+set -e
+
+name=xmlunit
+version="$(sed -n 's/Version:\s*//p' *.spec)"
+
+# RETRIEVE
+wget "https://github.com/xmlunit/xmlunit/releases/download/v${version}/${name}-${version}-src.tar.gz" -O "${name}-${version}.orig.tar.gz"
+
+rm -rf tarball-tmp
+mkdir tarball-tmp
+pushd tarball-tmp
+tar xf "../${name}-${version}.orig.tar.gz"
+
+# CLEAN TARBALL
+rm */GPATH */GRTAGS */GTAGS
+
+tar -czf "../${name}-${version}.tar.gz" *
+popd
+rm -r tarball-tmp "${name}-${version}.orig.tar.gz"

sources

@@ -1 +1 @@
-SHA512 (xmlunit-2.8.2-src.tar.gz) = 6d6caff75e21829c6e37777e7b37a6d9cdd6b03efb04866884b1b7630c0de584c78321b1f1145bdb47da7afeabb69ec81fa9ff980c41382c360572ef858df507
+SHA512 (xmlunit-2.8.2.tar.gz) = 345ef6b8072d2a27e880475d813c704636cf029cd8c43ea639828775fc8c5713ceed908f01b80f6decf6e36fbac7ddca41c09a1222aee23540305c9c25a75154

xmlunit.spec

@@ -2,12 +2,17 @@
 
 Name:           xmlunit
 Version:        2.8.2
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        Provides classes to do asserts on xml
 # The whole package is ASL 2.0 except for xmlunit-legacy which is BSD
 License:        ASL 2.0 and BSD
-Source0:        https://github.com/xmlunit/xmlunit/releases/download/v%{version}/%{name}-%{version}-src.tar.gz
 URL:            https://www.xmlunit.org/
+BuildArch:      noarch
+
+# ./generate-tarball.sh
+Source0:        %{name}-%{version}.tar.gz
+# Remove bundled binaries which cannot be easily verified for licensing
+Source1:        generate-tarball.sh
 
 Patch1:         0001-Disable-tests-requiring-network-access.patch
 Patch2:         0002-Port-to-hamcrest-2.1.patch
@@ -26,8 +31,6 @@ BuildRequires:  mvn(org.hamcrest:hamcrest-library)
 BuildRequires:  mvn(org.mockito:mockito-core)
 %endif
 
-BuildArch:      noarch
-
 %description
 XMLUnit provides you with the tools to verify the XML you emit is the one you
 want to create. It provides helpers to validate against an XML Schema, assert
@@ -113,6 +116,10 @@ rm -rf xmlunit-core/src/{main,test}/java/org/xmlunit/builder/{jaxb/,JaxbBuilder.
 %files placeholders -f .mfiles-xmlunit-placeholders
 
 %changelog
+* Fri Jun 18 2021 Mikolaj Izdebski <mizdebsk@redhat.com> - 2.8.2-5
+- Clean tarball from content with questionable licensing
+- Resolves: rhbz#1973743
+
 * Wed Jun 09 2021 Mikolaj Izdebski <mizdebsk@redhat.com> - 2.8.2-4
 - Rebuild to workaround DistroBaker issue