The spec file generation logic within impl_srpm is incomplete. It only replaces the Version tag, but not Source0 and Source1. The template spec file contains URLs for these sources. Without replacing them with the local tarball filenames, rpmbuild will likely try to download them from the internet, which is not the intended behavior, or fail if it cannot resolve the macros. This logic should be updated to also replace Source0 and Source1 with the filenames from the pkg variable, similar to how update_spec does it.

    {
        let specin = File::open(format!("contrib/packaging/{NAME}.spec"))
            .map(BufReader::new)
            .context("Opening spec")?;
        let mut o = File::create(td.join(format!("{NAME}.spec"))).map(BufWriter::new)?;
        let srcpath_fname = pkg.srcpath.file_name().unwrap();
        let vendorpath_fname = pkg.vendorpath.file_name().unwrap();
        for line in specin.lines() {
            let line = line?;
            if line.starts_with("Version:") {
                writeln!(o, "# Replaced by cargo xtask package-srpm")?;
                writeln!(o, "Version: {v}")?;
            } else if line.starts_with("Source0") {
                writeln!(o, "Source0:        {}", srcpath_fname)?;
            } else if line.starts_with("Source1") {
                writeln!(o, "Source1:        {}", vendorpath_fname)?;
            } else {
                writeln!(o, "{line}")?;
            }
        }
    }

This chain of unwrap() calls is brittle and will cause a panic if the structure of the cargo-vendor-filterer output TOML changes. While this is an internal build script, it's better to handle this gracefully with proper error handling. Consider using and_then or ? with ok_or_else to provide more informative error messages.

The impl_package() function, which can be time-consuming as it creates tarballs, is called inside both update_spec() (here) and impl_srpm() (line 259). This means that running separate xtasks like spec and package-srpm will cause the packaging process to run multiple times unnecessarily. Consider refactoring to call impl_package() once per high-level task and pass the resulting Package struct to the helper functions. This would improve efficiency and make the data flow clearer.

The use of unwrap() here can cause a panic if the temporary directory path created by tempfile is not valid UTF-8. While unlikely on most systems, it's safer to handle this potential error explicitly by using ? and providing an error context.