Packaging:SourceURL

= Referencing Source =

One of the design goals of rpm is to cleanly separate upstream source from vendor modifications. For the Fedora packager, this means that sources used to build a package should be the vanilla sources available from upstream. To help reviewers and QA scripts verify this, the packager needs to indicate where a reviewer can find the source that was used to make the rpm.

The most common case is where upstream distributes source as a tar.gz, tar.bz2 or zip archive that we can download from an upstream website. In these cases you must use a full URL to the package in the SourceX: line. For example:

Source0: http://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.gz

Source0: http://ftp.gnome.org/pub/GNOME/sources/gnome-common/2.12/gnome-common-2.12.0.tar.bz2

There are several cases where upstream is not providing the source to you in an upstream tarball. In these cases you must document how to generate the tarball used in the rpm either through a spec file comment or a script included as a separate SourceX:.

Here are some specific examples:

Using Revision Control
In some cases you may want to pull sources from upstream's revision control system because there have been many changes since the last release and you think that a tarball that you generate from there will more accurately show how the package relates to upstream's development. Here's how you can use a comment to show where the source came from:

Source0: foo-20070221.tar.xz
 * 1) The source for this package was pulled from upstream's vcs.  Use the
 * 2) following commands to generate the tarball:
 * 3)  svn export -r 250 http://www.example.com/svn/foo/trunk foo-20070221
 * 4)  tar -cJvf foo-20070221.tar.xz foo-20070221

When pulling from revision control, please remember to use a Name-version-release compatible with the Version and Release Guidelines. In particular, check the section on Naming Snapshots.

When Upstream uses Prohibited Code
Some upstream packages include patents or trademarks that we are not allowed to ship even as source code. In these cases you have to modify the source tarball to remove this code before you even upload it to the build system. Here's an example of using a script to document how you went from the upstream tarball to the one included in the package:

From the spec: Source0: libfoo-1.0-nopatents.tar.gz Source1: generate-tarball.sh
 * 1) libfoo contains patented code that we cannot ship.  Therefore we use
 * 2) this script to remove the patented code before shipping it.
 * 3) Download the upstream tarball and invoke this script while in the
 * 4) tarball's directory:
 * 5) ./generate-tarball.sh 1.0

generate-tarball.sh:
 * 1) !/bin/sh

VERSION=$1

tar -xzvf libfoo-$VERSION.tar.gz rm libfoo-$VERSION/src/patentedcodec.c sed -i -e 's/patentedcodec.c//' libfoo-$VERSION/src/Makefile

tar -czvf libfoo-$VERSION-nopatents.tar.gz libfoo-$VERSION

Sourceforge.net
For packages hosted on sourceforge, use Source0: http://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.gz changing ".tar.gz" to whatever matches the upstream distribution. Note that we are using downloads.sourceforge.net instead of an arbitrarily chosen mirror. You may use the package name/package version instead of the %{name} and %{version} macros, of course.

Please note that the correct url is, and NOT.

Using %{version}
Using %{version} in the SourceX: makes it easier for you to bump the version of a package, because most of the time you do not need to edit SourceX: when editing the specfile for the new package.

Troublesome URLs
When upstream has URLs for the download that do not end with the tarball name, rpm will be unable to parse the tarball out of the source URL. In these cases, you have to put just the tarball's filename into the Source: field. To make clear where you got the tarball, you should leave notes in comments above the Source: line to explain the situation to reviewers and future packagers. Example:

# Mysql has a mirror redirector for its downloads # You can get this tarball by following a link from: # http://dev.mysql.com/downloads/mysql/5.1.html Source0: mysql-5.1.31.tar.gz