[rpms/mcrouter] rawhide: Version the bundled() Provides, complete the License tag, prune unneeded code

[rpms/mcrouter] rawhide: Version the bundled() Provides, complete the License tag, prune unneeded code

[Michel Lind]

            A new commit has been pushed.

            Repo   : rpms/mcrouter
            Branch : rawhide
            Commit : 6af53de3f3b314e74f6b435308f11ebaefee756c
            Author : Michel Lind <salimma@fedoraproject.org>
            Date   : 2026-09-25T08:33:23+01:00
            Stats  : +254/-37 in 5 file(s)
            URL    : https://src.fedoraproject.org/rpms/mcrouter/c/6af53de3f3b314e74f6b435308f11ebaefee756c?branch=rawhide

            Log:
            Version the bundled() Provides, complete the License tag, prune unneeded code

- bundled() Provides now carry the version getdeps records for each
  vendored project (<tag>^<distance>.<commit>, liboqs 0.12.0)
- Add BSL-1.0, Zlib, MIT-CMU and LicenseRef-Fedora-Public-Domain to the
  License tag: per-file licenses in mvfst's third-party headers, folly's
  Crc32cDetail.cpp and liboqs's brg_endian.h and AES code, all compiled
  in, found by the licensecheck pass the license check now runs
- Delete fbthrift's Go bindings and the autotools m4/ directory in
  %prep; exclude the build-only CMake helpers (GPL-2.0 find modules,
  NCSA CheckAtomic.cmake) from the license scans
- Run the license check at the start of %build, with its per-file pass
  only when the vendor tarball is not the one recorded as checked
- Drop the wangle OpenSSL 4 patch, landed upstream; spell Memcached

Addresses the review, rhbz#2537668: versioned bundled() Provides as the
bundling guidelines want, and the licenses its licensecheck pass found
in the unpacked sources. Source1 is regenerated with the getdeps change
that records versions (Patch4); vendor/getdeps-vendor.txt names the
commits: folly 4fe489aa, fizz efde4a98, wangle deeb66af, mvfst 614035f7,
fbthrift 2e1a4623.

Assisted-by: Claude Code:claude-fable-5-1
Signed-off-by: Michel Lind <salimma@fedoraproject.org>
(cherry picked from commit ff0308064d081cf6f6caab8bff5ae68c407d7f66)
Signed-off-by: Michel Lind <salimma@fedoraproject.org>

---
diff --git a/0006-getdeps-record-the-checked-out-commit-in-getdeps-vendor.txt.patch b/0006-getdeps-record-the-checked-out-commit-in-getdeps-vendor.txt.patch
index 13366d7..3a5aeb9 100644
--- a/0006-getdeps-record-the-checked-out-commit-in-getdeps-vendor.txt.patch
+++ b/0006-getdeps-record-the-checked-out-commit-in-getdeps-vendor.txt.patch
@@ -1,52 +1,144 @@
 From: Michel Lind <salimma@fedoraproject.org>
-Date: Mon, 21 Sep 2026 20:10:00 +0100
-Subject: [PATCH] getdeps: record the checked-out commit in getdeps-vendor.txt
+Date: Thu, 24 Sep 2026 11:00:00 +0100
+Subject: [PATCH] getdeps: record the checked-out commit and a version in getdeps-vendor.txt
 
 `getdeps.py vendor` wrote fetcher.hash() next to each vendored project,
-which is the manifest's idea of the version: for a git project without a
-pinned rev that is the branch name, so a project that ships no
-build/deps/github_hashes (mcrouter) got
+which for a git project without a pinned rev is the branch name, so a
+project that ships no build/deps/github_hashes (mcrouter) got "folly
+main" recorded, identifying nothing. Ask the checkout for HEAD instead.
 
-  folly main
-  fizz main
-
-recorded, identifying nothing. Ask the checkout for HEAD instead, and
-keep hash() for fetchers that are not git checkouts (tarballs already
-record their content hash). A downstream consumer relies on this file to
-say which revision of each dependency it bundled.
+Also record a version as a third field where one can be determined: for
+a git checkout the nearest tag (git describe, deepening the shallow clone
+as needed), as the tag itself when HEAD is tagged or
+<tag>^<distance>.<commit> otherwise; for a downloaded archive the
+version in its file name. Distributions that bundle the vendored tree
+need "Provides: bundled(<name>) = <version>" (Fedora's bundling
+guidelines), and this is what they can derive it from.
 
 Signed-off-by: Michel Lind <salimma@fedoraproject.org>
 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
 ---
-  build/fbcode_builder/getdeps/cli.py              | 28 ++++++++++++-
-  build/fbcode_builder/getdeps/test/vendor_test.py | 53 ++++++++++++++++++++++++
-  2 files changed, 80 insertions(+), 1 deletion(-)
+  build/fbcode_builder/getdeps/cli.py              | 106 +++++++++++++++++++-
+  build/fbcode_builder/getdeps/test/vendor_test.py | 118 +++++++++++++++++++++++
+  2 files changed, 223 insertions(+), 1 deletion(-)
 
 diff --git a/build/fbcode_builder/getdeps/cli.py b/build/fbcode_builder/getdeps/cli.py
-index cbd4589f..2e209a6c 100644
+index cbd4589f..01f3f919 100644
 --- a/build/fbcode_builder/getdeps/cli.py
 +++ b/build/fbcode_builder/getdeps/cli.py
-@@ -26,6 +26,7 @@ from .dyndeps import create_dyn_dep_munger
+@@ -6,12 +6,14 @@
+ import argparse
+ import json
+ import os
++import re
+ import shutil
+ import subprocess
+ import sys
+ import tarfile
+ import tempfile
+ from pathlib import Path
++from urllib.parse import urlparse
+ 
+ # We don't import cache.create_cache directly as the facebook
+ # specific import below may monkey patch it, and we want to
+@@ -25,7 +27,9 @@ from .cmd_base import BUILD_TYPE_ARG, ProjectCmdBase, UsageError
+ from .dyndeps import create_dyn_dep_munger
  from .errors import TransientFailure
  from .fetcher import (
++    ArchiveFetcher,
      file_name_is_cmake_file,
 +    GitFetcher,
      is_public_commit,
      list_files_under_dir_newer_than_timestamp,
      safe_extractall,
-@@ -260,7 +261,7 @@ class VendorCmd(ProjectCmdBase):
+@@ -260,7 +264,11 @@ class VendorCmd(ProjectCmdBase):
                  ignore=shutil.ignore_patterns(".git"),
                  ignore_dangling_symlinks=True,
              )
 -            vendored.append("%s %s\n" % (m.name, fetcher.hash()))
-+            vendored.append("%s %s\n" % (m.name, _vendored_revision(fetcher)))
++            entry = "%s %s" % (m.name, _vendored_revision(fetcher))
++            version = _vendored_version(fetcher)
++            if version:
++                entry += " " + version
++            vendored.append(entry + "\n")
              vendored_names.add(m.name)
          # Drop trees recorded by a previous run that are no longer
          # dependencies (e.g. after --allow-system-packages or --no-tests
-@@ -289,6 +290,31 @@ class VendorCmd(ProjectCmdBase):
+@@ -289,6 +297,102 @@ class VendorCmd(ProjectCmdBase):
              f.writelines(vendored)
  
  
++_VERSION_IN_NAME = re.compile(r"\d+(?:[._]\d+)+|\d{4}-\d{2}-\d{2}")
++
++
++def _version_from_url(url: str) -> str | None:
++    """Best-effort version of a downloaded archive, from its file name:
++    liboqs/archive/refs/tags/0.12.0.tar.gz -> 0.12.0,
++    boost_1_83_0.tar.bz2 -> 1.83.0, re2/archive/2020-11-01.tar.gz ->
++    2020.11.01. None when the name has no version-like run (e.g. a commit
++    hash)."""
++    name = urlparse(url).path.rsplit("/", 1)[-1]
++    m = _VERSION_IN_NAME.search(name)
++    if not m:
++        return None
++    return m.group(0).replace("_", ".").replace("-", ".")
++
++
++def _git_describe_version(repo_dir: str) -> str | None:
++    """Version of a git checkout relative to its nearest tag, in the form
++    a distribution can use: the tag itself (without a leading v) when HEAD
++    is tagged, else <tag>^<distance>.<short commit>. getdeps clones are
++    shallow, so deepen the history a few times before giving up."""
++    git = ["git", "-C", repo_dir]
++
++    def describe() -> str | None:
++        try:
++            out = subprocess.check_output(
++                git + ["describe", "--tags", "--long", "--abbrev=7"],
++                stderr=subprocess.DEVNULL,
++            )
++        except (subprocess.CalledProcessError, OSError):
++            return None
++        return out.decode("utf-8").strip()
++
++    desc = describe()
++    for _ in range(4):
++        if desc:
++            break
++        try:
++            subprocess.check_call(
++                git + ["fetch", "-q", "--tags", "--deepen=250", "origin"],
++                stdout=subprocess.DEVNULL,
++                stderr=subprocess.DEVNULL,
++            )
++        except (subprocess.CalledProcessError, OSError):
++            return None
++        desc = describe()
++    if not desc:
++        return None
++    m = re.match(r"^(.*)-(\d+)-g([0-9a-f]+)$", desc)
++    if not m:
++        return None
++    tag, distance, commit = m.groups()
++    tag = re.sub(r"^v(?=\d)", "", tag)
++    if distance == "0":
++        return tag
++    return "%s^%s.%s" % (tag, distance, commit)
++
++
++def _vendored_version(fetcher) -> str | None:
++    """The version to record next to a vendored tree, or None when it cannot
++    be determined; see _version_from_url and _git_describe_version."""
++    if isinstance(fetcher, GitFetcher):
++        repo_dir = fetcher.get_src_dir()
++        if os.path.isdir(os.path.join(repo_dir, ".git")):
++            return _git_describe_version(repo_dir)
++        return None
++    if isinstance(fetcher, ArchiveFetcher):
++        return _version_from_url(fetcher.url)
++    return None
++
++
 +def _vendored_revision(fetcher) -> str:
 +    """The revision to record for a vendored tree.
 +
@@ -76,7 +168,7 @@ index cbd4589f..2e209a6c 100644
  class InstallSysDepsCmd(ProjectCmdBase):
      def setup_project_cmd_parser(self, parser):
 diff --git a/build/fbcode_builder/getdeps/test/vendor_test.py b/build/fbcode_builder/getdeps/test/vendor_test.py
-index 1d96fea6..69837de7 100644
+index 1d96fea6..898b4f40 100644
 --- a/build/fbcode_builder/getdeps/test/vendor_test.py
 +++ b/build/fbcode_builder/getdeps/test/vendor_test.py
 @@ -9,6 +9,7 @@ import contextlib
@@ -95,7 +187,7 @@ index 1d96fea6..69837de7 100644
      ChangeStatus,
      LocalDirFetcher,
      PreinstalledNopFetcher,
-@@ -119,6 +121,57 @@ class VendorCmdTest(unittest.TestCase):
+@@ -119,6 +121,122 @@ class VendorCmdTest(unittest.TestCase):
          with open(os.path.join(self.output_dir, "getdeps-vendor.txt")) as f:
              self.assertEqual(f.read(), "depa %s\n" % ("a" * 40))
  
@@ -150,6 +242,71 @@ index 1d96fea6..69837de7 100644
 +            self.assertEqual(f.read(), "depa %s\n" % head)
 +        self.assertEqual(len(head), 40)
 +
++    def test_records_version_from_nearest_tag(self) -> None:
++        build_opts = MagicMock()
++        build_opts.scratch_dir = self.tmp
++        fetcher = GitFetcher(
++            build_opts,
++            MagicMock(),
++            "https://example.invalid/depa.git",
++            rev=None,
++            depth=None,
++            branch="main",
++        )
++        repo = fetcher.get_src_dir()
++        os.makedirs(repo)
++        git = [
++            "git",
++            "-c",
++            "user.name=t",
++            "-c",
++            "user.email=t@t",
++            "-c",
++            "commit.gpgsign=false",
++            "-c",
++            "core.hooksPath=/dev/null",
++        ]
++        run = lambda *a: subprocess.check_call(git + list(a), cwd=repo)
++        run("init", "-q", "-b", "main")
++        run("commit", "-q", "--allow-empty", "-m", "one")
++        run("tag", "v2026.09.21.00")
++        fetcher.update = lambda: ChangeStatus()
++        top = FakeSourceFetcher(self.make_src_tree("top"), "t" * 40)
++        manifests = [make_manifest("depa"), make_manifest("top")]
++
++        # exactly on the tag: the tag, without its v
++        self.run_vendor(manifests, {"depa": fetcher, "top": top})
++        with open(os.path.join(self.output_dir, "getdeps-vendor.txt")) as f:
++            self.assertTrue(f.read().endswith(" 2026.09.21.00\n"))
++
++        # two commits past it: <tag>^<distance>.<commit>
++        run("commit", "-q", "--allow-empty", "-m", "two")
++        run("commit", "-q", "--allow-empty", "-m", "three")
++        head = (
++            subprocess.check_output(["git", "rev-parse", "--short=7", "HEAD"], cwd=repo)
++            .decode()
++            .strip()
++        )
++        self.run_vendor(manifests, {"depa": fetcher, "top": top})
++        with open(os.path.join(self.output_dir, "getdeps-vendor.txt")) as f:
++            self.assertTrue(f.read().endswith(" 2026.09.21.00^2.%s\n" % head))
++
++    def test_version_from_download_url(self) -> None:
++        from ..cli import _version_from_url
++
++        cases = {
++            "https://github.com/open-quantum-safe/liboqs/archive/refs/tags/0.12.0.tar.gz": "0.12.0",
++            "https://github.com/fmtlib/fmt/archive/refs/tags/12.1.0.tar.gz": "12.1.0",
++            "https://example.invalid/boost_1_83_0.tar.bz2": "1.83.0",
++            "https://github.com/google/re2/archive/2020-11-01.tar.gz": "2020.11.01",
++            "https://github.com/LMDB/lmdb/archive/refs/tags/LMDB_0.9.31.tar.gz": "0.9.31",
++            "https://sourceware.org/elfutils/ftp/0.193/elfutils-0.193.tar.bz2": "0.193",
++            "https://files.pythonhosted.org/packages/ab/PyYAML-6.0.3-cp38-cp38-manylinux2014_x86_64.whl": "6.0.3",
++            "https://github.com/libunwind/libunwind/archive/f081cf42917bdd5c428b77850b473f31f81767cf.tar.gz": None,
++        }
++        for url, expected in cases.items():
++            self.assertEqual(_version_from_url(url), expected, url)
++
      def test_replaces_stale_vendored_tree(self) -> None:
          stale = os.path.join(self.output_dir, "depa", "stale.txt")
          os.makedirs(os.path.dirname(stale))

diff --git a/README.md b/README.md
index de05b75..dcf5729 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,11 @@ To update:
 tree; regenerate the per-project breakdown behind the `License` tag with
 
     awk '{ print "# " $1 " v" $2 }' vendor/getdeps-vendor.txt > vendor/modules.txt
-    go_vendor_license --config getdeps-vendor-licenses.toml report all -L
+    /usr/lib/rpm/getdeps_vendor_license_check --config getdeps-vendor-licenses.toml --report \
+        --expression "$(go_vendor_license --config getdeps-vendor-licenses.toml report expression -L)"
+
+The report is the expression `%check` accepts: the license files' licenses
+plus what `licensecheck` finds in file headers, with the files behind each
+of the latter.
 
 from the unpacked source root with the vendor tarball extracted.

diff --git a/getdeps-vendor-licenses.toml b/getdeps-vendor-licenses.toml
index e0645c1..ab45d4f 100644
--- a/getdeps-vendor-licenses.toml
+++ b/getdeps-vendor-licenses.toml
@@ -3,16 +3,26 @@
 # Paths are relative to the unpacked source tree.
 [licensing]
 detector = "askalono"
-# Not compiled into mcrouter: each Meta project's copy of the fbcode_builder
-# build scripts (MIT) and fbthrift's Go bindings. Excluding them keeps the License
+# Present at build time but not part of the shipped binaries: each Meta
+# project's copy of the fbcode_builder build scripts (needed by its CMake
+# configure), liboqs's tests and the liboqs algorithms OQS_MINIMAL_BUILD
+# leaves out. Excluding them keeps the License
 # tag to what the binaries actually contain.
 exclude_directories = [
+  # the project's own fbcode_builder copy (GPL-2.0 CMake find modules for
+  # LMDB and re2 among the helpers) and the vendored projects' cmake helper
+  # directories (NCSA CheckAtomic.cmake): needed to configure, not shipped
+  "build/fbcode_builder",
+  "vendor/fizz/fizz/cmake",
+  "vendor/wangle/wangle/cmake",
+  "vendor/mvfst/cmake",
   "vendor/folly/build/fbcode_builder",
   "vendor/fizz/build/fbcode_builder",
   "vendor/wangle/build/fbcode_builder",
   "vendor/mvfst/build/fbcode_builder",
   "vendor/fbthrift/build/fbcode_builder",
-  "vendor/fbthrift/thrift/lib/go",
+  # liboqs test suite (Unlicense), not built: OQS tests are off
+  "vendor/liboqs/liboqs-0.12.0/tests",
   # liboqs is built with OQS_MINIMAL_BUILD limited to Kyber and ML-KEM (see
   # the liboqs manifest); the other algorithm families are never compiled
   "vendor/liboqs/liboqs-0.12.0/src/kem/bike",
@@ -92,3 +102,13 @@ expression = "CC0-1.0 OR Apache-2.0"
 path = "vendor/liboqs/liboqs-0.12.0/src/kem/ml_kem/pqcrystals-kyber-standard_ml-kem-768_ref/LICENSE"
 sha256sum = "53681bce13fd98721b4cabcd0b6184c6a92d9de813a02536161cc706e4ea9f2e"
 expression = "CC0-1.0 OR Apache-2.0"
+
+# Vendored code the build does not need at all: %getdeps_vendor_prune deletes
+# it in %prep, so it is neither scanned nor declared. Anything a CMakeLists.txt
+# still refers to (each project's build/fbcode_builder/CMake modules, liboqs's
+# tests directory) cannot go here and is excluded from the scans above instead.
+[getdeps]
+prune_directories = [
+  "vendor/fbthrift/thrift/lib/go",
+]
+

diff --git a/mcrouter.spec b/mcrouter.spec
index fa19b76..916a564 100644
--- a/mcrouter.spec
+++ b/mcrouter.spec
@@ -40,7 +40,7 @@
 Name:           mcrouter
 Version:        %{tagver}%{?snapinfo}
 Release:        %autorelease
-Summary:        Memcached protocol router for scaling memcached deployments
+Summary:        Memcached protocol router for scaling Memcached deployments
 
 # SourceLicense needs rpm >= 4.19; EPEL 9 (rpm 4.16) gets the full expression
 # on the SRPM as before
@@ -54,13 +54,26 @@ SourceLicense:  MIT
 # MIT AND BSD-2-Clause AND BSD-3-Clause             mvfst (third-party code)
 # MIT AND CC0-1.0 AND (Apache-2.0 OR CC0-1.0)       liboqs (Kyber/ML-KEM only)
 # CC0-1.0 is liboqs' aarch64 Kyber code, as in Fedora's own liboqs License tag.
+# Per-file licenses that the license files do not show, found by licensecheck
+# (the full check below): folly/hash/detail/Crc32cDetail.cpp is Zlib, mvfst's
+# quic/common/third-party/{expected.hpp,optional.h} are BSL-1.0, liboqs's
+# common/sha3 brg_endian.h is MIT-CMU and its common/aes implementations are
+# public domain, all compiled in. GPL-2.0 CMake find modules for LMDB and re2
+# and an NCSA CheckAtomic.cmake under build/fbcode_builder and the projects'
+# cmake/ directories are build-system helpers, nothing from them is compiled
+# or shipped; the license config excludes them.
+# mcrouter/lib/fbi/queue.h (BSD-3-Clause and/or MIT) is covered by both.
 License:        %{shrink:
     MIT AND
     Apache-2.0 AND
     BSD-2-Clause AND
     BSD-3-Clause AND
     CC0-1.0 AND
-    (Apache-2.0 OR CC0-1.0)
+    (Apache-2.0 OR CC0-1.0) AND
+    BSL-1.0 AND
+    Zlib AND
+    MIT-CMU AND
+    LicenseRef-Fedora-Public-Domain
 }
 URL:            https://github.com/facebook/mcrouter
 # GitHub ignores the last path component of an archive URL, so the file is
@@ -71,6 +84,16 @@ Source0:        %{url}/archive/%{archive_ref}/%{name}-%{version}.tar.gz
 # recorded in vendor/getdeps-vendor.txt; produced by ./vendor.sh
 Source1:        %{name}-%{version}-vendor.tar.xz
 Source2:        getdeps-vendor-licenses.toml
+# The per-file licensecheck pass of the license check is expensive; run it
+# only when Source1 is not the tarball it last passed on. After a full pass
+# on a new tarball, copy its sha512 here from the sources file. (Plain rpm:
+# this also runs when the SRPM is built, without folly-rpm-macros.)
+%global vendor_checked_sha512 5471feffa64249ad669fb4f831aa05c468d429edf688abd40aade27f10e0f42d463105c7d41b89581d9151176168815390acdd28ada762272229155dfa9b38fb
+%if "%(sha512sum %{SOURCE1} 2>/dev/null | cut -c1-128)" == "%{vendor_checked_sha512}"
+%bcond_with license_full_check
+%else
+%bcond_without license_full_check
+%endif
 
 # Patches to the vendored trees (vendor/<project>/...) are applied at build
 # time, after Source1 is unpacked; ./vendor.sh skips them when vendoring.
@@ -90,8 +113,9 @@ Patch2:         0004-folly-F14-fallback-forward-exact-key-lookups.patch
 # mcrouter itself against current folly (explicit gflags includes) and
 # Boost 1.90 (filesystem/convenience.hpp removed); submitted internally
 Patch3:         0005-Build-against-current-folly-and-Boost-1.90.patch
-# getdeps-vendor.txt recorded "main" for the unpinned dependencies; record
-# the checked-out commit instead (applied by vendor.sh before vendoring)
+# getdeps-vendor.txt recorded "main" for the unpinned dependencies: record
+# the checked-out commit and the version each bundled() Provides carries
+# (applied by vendor.sh before vendoring)
 Patch4:         0006-getdeps-record-the-checked-out-commit-in-getdeps-vendor.txt.patch
 
 # ppc64le was dropped in 0.41.0.20250203 over the folly F14 fallback bug
@@ -99,7 +123,7 @@ Patch4:         0006-getdeps-record-the-checked-out-commit-in-getdeps-vendor.txt
 # builds on ppc64le with the same patch.
 ExclusiveArch:  x86_64 aarch64 ppc64le
 
-BuildRequires:  folly-rpm-macros >= 46
+BuildRequires:  folly-rpm-macros >= 46-3
 %if %{with toolchain_clang}
 BuildRequires:  clang
 %else
@@ -107,15 +131,15 @@ BuildRequires:  gcc-c++
 %endif
 
 %description
-Mcrouter (pronounced mc router) is a memcached protocol router for scaling
-memcached deployments.
+Mcrouter (pronounced mc router) is a Memcached protocol router for scaling
+Memcached deployments.
 
 Because the routing and feature logic are abstracted from the client in
 mcrouter deployments, the client may simply communicate with destination
 hosts through mcrouter over a TCP connection using standard memcached
 protocol. Typically, little or no client modification is needed to use
 mcrouter, which was designed to be a drop-in proxy between the client and
-memcached hosts.
+Memcached hosts.
 
 
 %generate_buildrequires
@@ -125,9 +149,22 @@ memcached hosts.
 
 %prep
 %autosetup -n %{archive_dir} -a1 -p1
+# delete vendored code that is neither compiled nor referenced by the build
+# (the config's prune_directories: fbthrift's Go bindings)
+%getdeps_vendor_prune -c %{SOURCE2}
+# autotools leftovers (FSFAP boost macros, a GPL-3.0-or-later
+# ax_python_devel.m4), not used by the CMake build
+rm -rf mcrouter/m4
 
 
 %build
+# Verify the License tag first: it only needs the unpacked trees, and a
+# wrong tag then fails here in minutes rather than after the build. Not in
+# %%prep, which the dynamic BuildRequires passes run more than once, before
+# the detector is installed. -f adds the per-file licensecheck pass, see
+# vendor_checked_sha512 above.
+# -L: liboqs's LICENSE.txt sits in a versioned subdirectory of its tree
+%getdeps_vendor_license_check -c %{SOURCE2} -L %{?with_license_full_check:-f}
 %getdeps_build %{?with_check:-t}
 
 
@@ -137,8 +174,6 @@ memcached hosts.
 
 
 %check
-# -L: liboqs's LICENSE.txt sits in a versioned subdirectory of its tree
-%getdeps_vendor_license_check -c %{SOURCE2} -L
 %if %{with check}
 %getdeps_test
 %endif

diff --git a/sources b/sources
index b2171bf..d2acfe2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (mcrouter-2026.09.21.00^1.d8b07b0-vendor.tar.xz) = 454fa45d5cde24911faff092d429be74e5edd1af8f3053724538d5c62caba9dd8f4538198216ced790b2e02b098c1cfa8ba1d5b7fce1762fb6bfeaabedde2177
+SHA512 (mcrouter-2026.09.21.00^1.d8b07b0-vendor.tar.xz) = 5471feffa64249ad669fb4f831aa05c468d429edf688abd40aade27f10e0f42d463105c7d41b89581d9151176168815390acdd28ada762272229155dfa9b38fb
 SHA512 (mcrouter-2026.09.21.00^1.d8b07b0.tar.gz) = 59e1433d6e95ff5005f4db4e9e4dd363e10343df2a792056073f0c204517cd676e310d14d9c6a86517580e9792e93575e2c7240852778be313c564888211cf07