Pasting here Arun Babu Neelicattu's message
https://bugzilla.redhat.com/show_bug.cgi?id=2283640#c11
and replying below
=======
Following up on DM conversation with Germano, one thing I noticed while building the spec file locally was that the source file in the build environment is not the same as the source defined in the spec file. Unsure if I should raise a new ticket for this one.

> $ cat sources 
> SHA512 (web-eid-2.5.0.tar.gz) = 1ab370c3553ef04145e66577c93ea25310c385409a0f23aff3b20f41cd4ce2664abf914f9c8b985b269550e24f04fbda53fcad3867db073b6f2600dfb0836f0b
> $ fedpkg sources
> Downloading web-eid-2.5.0.tar.gz from https://src.fedoraproject.org/repo/pkgs
> ######################################################################## 100.0%
> $ sha512sum web-eid-2.5.0.tar.gz 
> 1ab370c3553ef04145e66577c93ea25310c385409a0f23aff3b20f41cd4ce2664abf914f9c8b985b269550e24f04fbda53fcad3867db073b6f2600dfb0836f0b  web-eid-2.5.0.tar.gz

Source file specified as SOURCE0:
> $ curl -sL https://github.com/web-eid/web-eid-app/archive/v2.5.0/web-eid-2.5.0.tar.gz | sha512sum -
> 629f797e1d28c370480fc2b57a580c93e42eecb9fbd07a0d6c23b184f7420992a776931eb38cdbf5fca87bdc6d347f1f3ef6185990cc8a1f43ad09c8aa7071e3  -

The delta is the content inside the submodule directory lib/libelectronic-id.

> $ tar tf web-eid-2.5.0.tar.gz  | grep "lib/libelectronic-id" | wc -l
> 146
> $ curl -sL https://github.com/web-eid/web-eid-app/archive/v2.5.0/web-eid-2.5.0.tar.gz | tar -ztf - | grep "lib/libelectronic-id" | wc -l
> 1

I could not find much on what the expectation is on source trees with submodules.
=======



The .tar.gz in Fedora repository is the same I used in the package review request, which contained the submodule:
https://bugzilla.redhat.com/show_bug.cgi?id=2298838#c9

Also all .tar.xz on Github upstream include the submodule.

I don't know why the .tar.gz I used is no longer available on Github, I suppose it has been removed from upstream developer, and the one you can download now is the Github auto-generated, which as every auto-generated .tar.gz does not include submodules

I posted a message in the mailing list to better understand how I should deal with submodules

https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/VOGWNPRI4WMIWE324VNKT3QHVPNREKS5/



Reproducible: Always