Package from a GitHub archive, with data/ filtered out

.gitignore

@@ -20,3 +20,4 @@
 /orjson-3.10.16.tar.gz
 /orjson-3.10.18.tar.gz
 /orjson-3.11.0.tar.gz
+/orjson-3.11.0-filtered.tar.xz

get_source

@@ -0,0 +1,49 @@
+#!/bin/sh
+set -o errexit
+set -o nounset
+
+if [ "$#" != '1' ]
+then
+	cat 1>&2 <<EOF
+Usage: $0 VERSION
+
+Downloads the requested version and creates a filtered source tarball.
+EOF
+	exit 1
+fi
+
+VERSION="${1}"
+OUTDIR="${PWD}"
+TMPDIR="$(mktemp -d)"
+trap "rm -rf '${TMPDIR}'" INT TERM EXIT
+
+cd "${TMPDIR}"
+REPO="https://github.com/ijl/orjson"
+URL="${REPO}/archive/${VERSION}/orjson-${VERSION}.tar.gz"
+echo "--> Downloading: ${URL}" 1>&2
+curl -L -O "${URL}"
+
+ARCHIVE="$(find . -mindepth 1 -maxdepth 1 -type f -name '*.tar.gz' -print -quit)"
+echo "--> Extracting: $(basename "${ARCHIVE}")" 1>&2
+tar -xzf "${ARCHIVE}"
+echo '--> Removing data/ due to licensing issues' 1>&2
+TARDIR="$(basename "${ARCHIVE}" '.tar.gz')"
+MTIME="$(stat -c '%Y' "${TARDIR}")"
+rm -rvf "${TARDIR}/data/"
+# Make sure the original mtime is preserved even though we modified the base
+# directory by removing something at the top level.
+touch -d @"${MTIME}" "${TARDIR}"
+FILTERED="$(basename "${ARCHIVE}" .tar.gz)-filtered.tar.xz"
+echo "--> Re-archiving: ${FILTERED}" 1>&2
+# https://www.gnu.org/software/tar/manual/html_section/Reproducibility.html
+TZ=UTC LC_ALL=C tar \
+    --create --verbose \
+    --sort=name \
+    --format=posix \
+    --numeric-owner --owner=0 --group=0 \
+    --mode=go+u,go-w \
+    --pax-option='delete=atime,delete=ctime' \
+    "${TARDIR}/" |
+  xz -9e > "${FILTERED}"
+mv -v "${FILTERED}" "${OUTDIR}"
+echo 'Done.' 1>&2

python-orjson.spec

@@ -35,74 +35,15 @@ Summary:        Fast, correct Python JSON library
 # - src/serialize/writer/str/mod.rs
 # - src/serialize/writer/str/sse2.rs
 License:        (Apache-2.0 OR MIT) AND Apache-2.0%{?with_yyjson: AND MIT}
+%if %{without yyjson}
 # Additionally, the following are removed in %%prep and do not contribute to
 # the licenses of the binary RPMs:
 #
-# Apache-2.0 WITH LLVM-exception:
-# - include/cargo/target-lexicon-*/
-#
-# BSL-1.0:
-# - include/cargo/xxhash-rust-*/
-#
 # MIT:
-%if %{without yyjson}
 # - include/yyjson/yyjson.c
 # - include/yyjson/yyjson.h
 %endif
-# - include/cargo/crunchy-*/
-# - include/cargo/itoap-*/
-#
-# MIT OR Apache-2.0:
-# - include/cargo/associative-cache-*/
-# - include/cargo/bytecount-*/
-# - include/cargo/cc-*/
-# - include/cargo/cfg-if-*/
-# - include/cargo/gimli-*/
-# - include/cargo/half-*/
-# - include/cargo/itoa-*/
-# - include/cargo/libc-*/
-# - include/cargo/once_cell-*/
-# - include/cargo/portable-atomic-*/
-# - include/cargo/portable-atomic-util-*/
-# - include/cargo/proc-macro2-*/
-# - include/cargo/pyo3-build-config-*/
-# - include/cargo/pyo3-ffi-*/
-# - include/cargo/quote-*/
-# - include/cargo/serde-*/
-# - include/cargo/serde_derive-*/
-# - include/cargo/serde_json-*/
-# - include/cargo/shlex-*/
-# - include/cargo/simdutf8-*/
-# - include/cargo/smallvec-*/
-# - include/cargo/syn-*/
-# - include/cargo/unwinding-*/
-# - include/cargo/uuid-*/
-# - include/cargo/version_check-*/
-#
-# Apache-2.0 OR BSL-1.0:
-# - include/cargo/ryu-*/
-#
-# (Apache-2.0 OR MIT) AND BSD-3-Clause:
-# - include/cargo/encoding_rs-*/
-#
-# (MIT OR Apache-2.0) AND Unicode-3.0:
-# - include/cargo/unicode-ident-*/
-#
-# Unlicense OR MIT:
-# - include/cargo/jiff-*/
-# - include/cargo/jiff-static-*/
-# - include/cargo/memchr-*/
-SourceLicense:  %{shrink:
-                (Apache-2.0 OR MIT) AND
-                Apache-2.0 AND
-                Apache-2.0 WITH LLVM-exception AND
-                BSD-3-Clause AND
-                BSL-1.0 AND
-                MIT AND
-                Unicode-3.0 AND
-                (Apache-2.0 OR BSL-1.0)
-                (Unlicense OR MIT)
-                }
+SourceLicense:  (Apache-2.0 OR MIT) AND Apache-2.0 AND MIT
 URL:            https://github.com/ijl/orjson
 # We must be careful about the source archive.
 #
@@ -110,7 +51,7 @@ URL:            https://github.com/ijl/orjson
 # which we would remove in %%prep, but which we must still check to make sure
 # everything has a license acceptable for distribution in Fedora before
 # uploading to the lookaside cache.
-Source:         %{pypi_source orjson}
+# Source:         %%{pypi_source orjson}
 # The GitHub archives from
 # %%{url}/archive/%%{version}/orjson-%%{version}.tar.gz do not have the
 # vendored crates, but they contain benchmark data in data/, some of which is
@@ -118,11 +59,10 @@ Source:         %{pypi_source orjson}
 # https://github.com/minimaxir/big-list-of-naughty-strings and should carry the
 # corresponding MIT license text), and some of which looks like it might have
 # at best unclear license status. Since the benchmark data is potentially
-# problematic, we would need to filter the GitHub archives with a script; this
-# hasn’t been written yet, but could be similar to the one in python-cramjam.
-# Source0:        orjson-%%{version}-filtered.tar.gz
+# problematic, we would need to filter the GitHub archives with a script.
+Source0:        orjson-%{version}-filtered.tar.xz
 # ./get_source ${COMMIT} (or ${TAG})
-# Source1:        get_source
+Source1:        get_source
 
 BuildRequires:  tomcli
 BuildRequires:  python3-devel
@@ -188,8 +128,6 @@ Provides:       bundled(yyjson) = 0.9.0
 # “Avoid bundling libgcc on musl.”
 tomcli-set Cargo.toml del 'features.unwind'
 tomcli-set Cargo.toml del 'dependencies.unwinding'
-# Remove bundled rust crates
-rm -r include/cargo
 %if %{without yyjson}
 # Remove bundled yyjson.
 rm -rv include/yyjson/

sources

@@ -1 +1 @@
-SHA512 (orjson-3.11.0.tar.gz) = be823592bc5fb28b1d5e90c412c9ec32b5953db27e5dcc088e43e2369dad28586603d0a3e450f72b5761a819bcd68a1305dac60219e5719b24e0a410c6e22af2
+SHA512 (orjson-3.11.0-filtered.tar.xz) = cd0bfbe61d3c77fbed8d293babe4eb9cee0f4cc2801a33e5003041a426fd48d2817644b92697cbf0f57c2548b236e4a32f4efd9eccad6ba272107d1a801c402f