diff --git a/.cvsignore b/.cvsignore
deleted file mode 100644
index e69de29..0000000
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..88d4009
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+xar-1.5.2.tar.gz
diff --git a/Makefile b/Makefile
deleted file mode 100644
index 795b5c9..0000000
--- a/Makefile
+++ /dev/null
@@ -1,21 +0,0 @@
-# Makefile for source rpm: xar
-# $Id$
-NAME := xar
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)
diff --git a/sources b/sources
index e69de29..dddc32a 100644
--- a/sources
+++ b/sources
@@ -0,0 +1 @@
+8eabb055d3387b8edc30ecfb08d2e80d xar-1.5.2.tar.gz
diff --git a/xar-1.5-install.patch b/xar-1.5-install.patch
new file mode 100644
index 0000000..6fbc1ce
--- /dev/null
+++ b/xar-1.5-install.patch
@@ -0,0 +1,24 @@
+diff -Naupr xar-1.5.orig/lib/Makefile.inc.in xar-1.5/lib/Makefile.inc.in
+--- xar-1.5.orig/lib/Makefile.inc.in 2007-05-11 04:51:24.000000000 +0200
++++ xar-1.5/lib/Makefile.inc.in 2007-05-30 14:35:42.000000000 +0200
+@@ -68,7 +68,7 @@ lib_install : $(LIBXAR_S)
+ @INSTALL@ -d $(DESTDIR)$(INCLUDEDIR)/xar
+ @INSTALL@ -m 0644 $(LIBXAR_INCS) $(DESTDIR)$(INCLUDEDIR)/xar
+ @INSTALL@ -d $(DESTDIR)$(LIBDIR)
+- @INSTALL@ -m 0444 $(LIBXAR_S) $(DESTDIR)$(LIBDIR)
++ @INSTALL@ -m 0755 $(LIBXAR_S) $(DESTDIR)$(LIBDIR)
+ ifneq ($(words "" $(LIBXAR_LNAME)), 1)
+ rm -f $(DESTDIR)$(LIBDIR)/$(LIBXAR_LNAME)
+ ln -s $(LIBXAR_SNAME) $(DESTDIR)$(LIBDIR)/$(LIBXAR_LNAME)
+diff -Naupr xar-1.5.orig/src/Makefile.inc.in xar-1.5/src/Makefile.inc.in
+--- xar-1.5.orig/src/Makefile.inc.in 2007-05-11 04:50:41.000000000 +0200
++++ xar-1.5/src/Makefile.inc.in 2007-05-30 14:35:57.000000000 +0200
+@@ -11,7 +11,7 @@ src_install : @objroot@src/ixar
+ @INSTALL@ -d $(DESTDIR)$(BINDIR)
+ @INSTALL@ -m 0755 $< $(DESTDIR)$(BINDIR)/xar
+ @INSTALL@ -d $(DESTDIR)$(MANDIR)/man1
+- @INSTALL@ -m 0444 @srcroot@src/xar.1 $(DESTDIR)$(MANDIR)/man1
++ @INSTALL@ -m 0644 @srcroot@src/xar.1 $(DESTDIR)$(MANDIR)/man1
+
+ src_uninstall :
+ rm -f $(DESTDIR)/$(BINDIR)/xar
diff --git a/xar-1.5-norpath.patch b/xar-1.5-norpath.patch
new file mode 100644
index 0000000..855440d
--- /dev/null
+++ b/xar-1.5-norpath.patch
@@ -0,0 +1,24 @@
+diff -Naupr xar-1.5.orig/configure xar-1.5/configure
+--- xar-1.5.orig/configure 2007-05-13 18:09:50.000000000 +0200
++++ xar-1.5/configure 2007-05-30 14:40:04.000000000 +0200
+@@ -2800,7 +2800,7 @@ case "${host}" in
+ CFLAGS="$CFLAGS"
+ abi="elf"
+ CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE"
+- RPATH="-Wl,-rpath,"
++ RPATH=""
+ ;;
+ *-*-netbsd*)
+ echo "$as_me:$LINENO: checking ABI" >&5
+diff -Naupr xar-1.5.orig/configure.ac xar-1.5/configure.ac
+--- xar-1.5.orig/configure.ac 2007-05-11 04:51:25.000000000 +0200
++++ xar-1.5/configure.ac 2007-05-30 14:40:13.000000000 +0200
+@@ -109,7 +109,7 @@ case "${host}" in
+ abi="elf"
+ dnl Linux needs this for things like asprintf() and poll() flags.
+ CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE"
+- RPATH="-Wl,-rpath,"
++ RPATH=""
+ ;;
+ *-*-netbsd*)
+ AC_MSG_CHECKING([ABI])
diff --git a/xar-1.5.2-CVE-2010-0055.patch b/xar-1.5.2-CVE-2010-0055.patch
new file mode 100644
index 0000000..8be4389
--- /dev/null
+++ b/xar-1.5.2-CVE-2010-0055.patch
@@ -0,0 +1,49 @@
+Index: xar/lib/archive.c
+===================================================================
+--- xar/lib/archive.c (revision 224)
++++ xar/lib/archive.c (revision 225)
+@@ -330,6 +330,44 @@
+
+ EVP_DigestFinal(&XAR(ret)->toc_ctx, toccksum, &tlen);
+
++ const char *value;
++ uint64_t offset = 0;
++ uint64_t length = tlen;
++ if( xar_prop_get( XAR_FILE(ret) , "checksum/offset", &value) == 0 ) {
++ errno = 0;
++ offset = strtoull( value, (char **)NULL, 10);
++ if( errno != 0 ) {
++ xar_close(ret);
++ return NULL;
++ }
++ } else if( xar_signature_first(ret) != NULL ) {
++ // All archives that have a signature also specify the location
++ // of the checksum. If the location isn't specified, error out.
++ xar_close(ret);
++ return NULL;
++ }
++
++ XAR(ret)->heap_offset = xar_get_heap_offset(ret) + offset;
++ if( lseek(XAR(ret)->fd, XAR(ret)->heap_offset, SEEK_SET) == -1 ) {
++ xar_close(ret);
++ return NULL;
++ }
++ if( xar_prop_get( XAR_FILE(ret) , "checksum/size", &value) == 0 ) {
++ errno = 0;
++ length = strtoull( value, (char **)NULL, 10);
++ if( errno != 0 ) {
++ xar_close(ret);
++ return NULL;
++ }
++ } else if( xar_signature_first(ret) != NULL ) {
++ xar_close(ret);
++ return NULL;
++ }
++ if( length != tlen ) {
++ xar_close(ret);
++ return NULL;
++ }
++
+ xar_read_fd(XAR(ret)->fd, cval, tlen);
+ XAR(ret)->heap_offset += tlen;
+ if( memcmp(cval, toccksum, tlen) != 0 ) {
diff --git a/xar.spec b/xar.spec
new file mode 100644
index 0000000..b732621
--- /dev/null
+++ b/xar.spec
@@ -0,0 +1,121 @@
+Summary: The eXtensible ARchiver
+Name: xar
+Version: 1.5.2
+Release: 6%{?dist}
+License: BSD
+Group: Applications/Archiving
+URL: http://code.google.com/p/xar/
+Source: http://xar.googlecode.com/files/xar-%{version}.tar.gz
+Patch0: xar-1.5-norpath.patch
+Patch1: xar-1.5.2-CVE-2010-0055.patch
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
+BuildRequires: libxml2-devel
+BuildRequires: openssl-devel
+BuildRequires: zlib-devel
+BuildRequires: bzip2-devel
+BuildRequires: /usr/bin/awk
+
+%description
+The XAR project aims to provide an easily extensible archive format. Important
+design decisions include an easily extensible XML table of contents for random
+access to archived files, storing the toc at the beginning of the archive to
+allow for efficient handling of streamed archives, the ability to handle files
+of arbitrarily large sizes, the ability to choose independent encodings for
+individual files in the archive, the ability to store checksums for individual
+files in both compressed and uncompressed form, and the ability to query the
+table of content's rich meta-data.
+
+
+%package devel
+Summary: Development files for the eXtensible ARchiver
+Group: Development/Libraries
+Requires: %{name} = %{version}-%{release}
+
+%description devel
+Development files for the eXtensible ARchiver.
+
+
+%prep
+%setup -q
+%patch0 -p1 -b .norpath
+%patch1 -p1 -b .CVE-2010-0055
+
+
+%build
+%configure --disable-static
+%{__make} %{?_smp_mflags}
+
+
+%install
+%{__rm} -rf %{buildroot}
+%{__make} install DESTDIR=%{buildroot}
+%{__rm} -f %{buildroot}%{_libdir}/libxar.la
+
+
+%clean
+%{__rm} -rf %{buildroot}
+
+
+%post -p /sbin/ldconfig
+
+%postun -p /sbin/ldconfig
+
+
+%files
+%defattr(-,root,root,-)
+%doc LICENSE TODO
+%{_bindir}/xar
+%{_libdir}/libxar.so.*
+%{_mandir}/man1/xar.1*
+
+%files devel
+%defattr(-,root,root,-)
+%{_includedir}/xar/
+%{_libdir}/libxar.so
+
+
+%changelog
+* Wed Apr 28 2010 Matthias Saou 1.5.2-6
+- Include patch to fix CVE-2010-0055 (#570678).
+
+* Fri Aug 21 2009 Tomas Mraz - 1.5.2-5
+- rebuilt with new openssl
+
+* Mon Jul 27 2009 Fedora Release Engineering - 1.5.2-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
+* Wed Feb 25 2009 Fedora Release Engineering - 1.5.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
+
+* Sun Jan 18 2009 Tomas Mraz 1.5.2-2
+- rebuild with new openssl
+
+* Tue Dec 23 2008 Matthias Saou 1.5.2-1
+- Update to 1.5.2.
+- Remove no longer needed install and memset patches.
+- Disable newly built-by-default static lib and remove useless .la file.
+
+* Tue Feb 19 2008 Fedora Release Engineering
+- Autorebuild for GCC 4.3
+
+* Fri Dec 07 2007 Release Engineering
+- Rebuild for deps
+
+* Thu Aug 23 2007 Matthias Saou 1.5.1-4
+- Rebuild for new BuildID feature.
+- Add /usr/bin/awk build requirement, needed for the libxml configure check.
+
+* Wed Aug 8 2007 Matthias Saou 1.5.1-2
+- Patch memset call with swapped arguments (Dave Jones).
+
+* Wed Jul 11 2007 Matthias Saou 1.5.1-1
+- Update to 1.5.1.
+
+* Wed May 30 2007 Matthias Saou 1.5-1
+- Update to 1.5.
+- Include patch to remove rpath.
+- Include patch to fix file modes, and get the lib properly stripped.
+
+* Sun Feb 25 2007 Matthias Saou 1.4-1
+- Initial RPM release.
+