diff --git a/.gitignore b/.gitignore
index d17478d..ecabb93 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,3 +28,4 @@
 /apache-log4j-2.17.1-src.tar.gz.asc
 /apache-log4j-2.17.2-src.tar.gz
 /apache-log4j-2.17.2-src.tar.gz.asc
+/log4j-2.17.2.tar.gz
diff --git a/generate-tarball.sh b/generate-tarball.sh
new file mode 100755
index 0000000..6959389
--- /dev/null
+++ b/generate-tarball.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+set -e
+
+name=log4j
+version="$(sed -n 's/Version:\s*//p' *.spec)"
+
+# RETRIEVE
+wget "https://archive.apache.org/dist/logging/log4j/${version}/apache-log4j-${version}-src.tar.gz" -O "${name}-${version}.orig.tar.gz"
+wget "https://archive.apache.org/dist/logging/log4j/${version}/apache-log4j-${version}-src.tar.gz.asc" -O "${name}-${version}.orig.tar.gz.asc"
+wget "https://www.apache.org/dist/logging/KEYS" -O "${name}-${version}.keyring"
+
+# VERIFY
+$(rpm -E '%{gpgverify}') --keyring="${name}-${version}.keyring" --signature="${name}-${version}.orig.tar.gz.asc" --data="${name}-${version}.orig.tar.gz"
+
+rm -rf tarball-tmp
+mkdir tarball-tmp
+pushd tarball-tmp
+tar -xf "../${name}-${version}.orig.tar.gz"
+
+# CLEAN TARBALL
+find -name '*.jar' -delete
+find -name '*.class' -delete
+find -name '*.zip' -delete
+find -name '*.dll' -delete
+rm -rf "apache-log4j-${version}-src/src/site"
+
+tar -czf "../${name}-${version}.tar.gz" *
+popd
+rm -r tarball-tmp "${name}-${version}.orig.tar.gz"
diff --git a/log4j.spec b/log4j.spec
index 6635f1e..5262d2c 100644
--- a/log4j.spec
+++ b/log4j.spec
@@ -2,20 +2,18 @@
 
 Name:           log4j
 Version:        2.17.2
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Java logging package
 BuildArch:      noarch
 License:        ASL 2.0
 
 URL:            https://logging.apache.org/%{name}
-Source0:        https://www.apache.org/dist/logging/%{name}/%{version}/apache-%{name}-%{version}-src.tar.gz
-Source1:        https://www.apache.org/dist/logging/%{name}/%{version}/apache-%{name}-%{version}-src.tar.gz.asc
-Source2:        https://www.apache.org/dist/logging/KEYS
+
+# ./generate-tarball.sh
+Source0:        %{name}-%{version}.tar.gz
 
 Patch2:         logging-log4j-Remove-unsupported-EventDataConverter.patch
 
-BuildRequires:  gnupg2
-
 BuildRequires:  maven-local
 BuildRequires:  mvn(com.fasterxml.jackson.core:jackson-annotations)
 BuildRequires:  mvn(com.fasterxml.jackson.core:jackson-core)
@@ -141,7 +139,6 @@ Obsoletes:      %{name}-manual < %{version}
 %{summary}.
 
 %prep
-%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q -n apache-%{name}-%{version}-src
 %autopatch -p1
 
@@ -270,7 +267,6 @@ rm -r log4j-1.2-api/src/main/java/org/apache/log4j/or/jms
 %endif
 
 %files -f .mfiles
-%dir %{_javadir}/%{name}
 %doc LICENSE.txt NOTICE.txt
 
 %files slf4j -f .mfiles-slf4j
@@ -289,6 +285,10 @@ rm -r log4j-1.2-api/src/main/java/org/apache/log4j/or/jms
 
 
 %changelog
+* Thu Oct 13 2022 Marian Koncek <mkoncek@redhat.com> - 2.17.2-2
+- Remove glyphicons zip archive and glyphicons png files from source package
+- Resolves: rhbz#2137790
+
 * Sun Feb 27 2022 Paul Wouters <paul.wouters@aiven.io> - 2.17.2-1
 - Resolves: rhbz#2058949 log4j-2.17.2 is available (1.2 bridge bugfixes)
 
diff --git a/sources b/sources
index b0a3e84..a2a4e6a 100644
--- a/sources
+++ b/sources
@@ -1,3 +1 @@
-SHA512 (apache-log4j-2.17.2-src.tar.gz) = ae09c3af8662fcf5fdc4e7c7dd298e91ec85e90272b8247ce4ee60c7d4ecd48a4cd294fc9e51c0b307fbb58c677e61e31527eab4085debcc9b40919af0920176
-SHA512 (apache-log4j-2.17.2-src.tar.gz.asc) = ad1d0ae72ea26bab286160f6e663cc4e25209f99169f1bb06366e112844282b3154d93d7d57df193527c2821d6e4ce7ad1d4f224d46326a3a1264e289c973a2e
-SHA512 (KEYS) = c149ef131b44cc261b9efc30510ab40837cd1a26d3c1167cd21be6e3ed1d158de4537b399a09824695fcc6e5280ba73f28f39cdf739815f534c535fd1c42d886
+SHA512 (log4j-2.17.2.tar.gz) = fd76960224f3441cdbe43a4326bbcf2007d4680e1a29438c00a056376c140d827ed4923df2c97fee4fb567687b93e79f7745403d32dd071c91cd347112f2f303