diff --git a/.python-service-identity.metadata b/.python-service-identity.metadata
new file mode 100644
index 0000000..27616a2
--- /dev/null
+++ b/.python-service-identity.metadata
@@ -0,0 +1 @@
+bf805eb2e4987b9a9ffd59f62094ec84b529dd84  SOURCES/service_identity-24.2.0.tar.gz
diff --git a/SOURCES/0001-Remove-coverage-toml-test-dependency.patch b/SOURCES/0001-Remove-coverage-toml-test-dependency.patch
new file mode 100644
index 0000000..750b38c
--- /dev/null
+++ b/SOURCES/0001-Remove-coverage-toml-test-dependency.patch
@@ -0,0 +1,61 @@
+From 5ab6102dbf6429fe63b2db6f0f6b43a125efe3b5 Mon Sep 17 00:00:00 2001
+From: Carl George <carlwgeorge@gmail.com>
+Date: Wed, 6 Nov 2024 18:30:12 -0600
+Subject: [PATCH 1/2] Remove coverage[toml] test dependency
+
+---
+ pyproject.toml | 31 +------------------------------
+ 1 file changed, 1 insertion(+), 30 deletions(-)
+
+diff --git a/pyproject.toml b/pyproject.toml
+index dabd973..a43705c 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -36,7 +36,7 @@ dynamic = ["version", "readme"]
+ 
+ [project.optional-dependencies]
+ idna = ["idna"]
+-tests = ["coverage[toml]>=5.0.2", "pytest"]
++tests = ["pytest"]
+ docs = ["sphinx", "furo", "myst-parser", "sphinx-notfound-page", "pyOpenSSL"]
+ mypy = ["mypy", "types-pyOpenSSL", "idna"]
+ dev = ["service-identity[tests,mypy,idna]", "pyOpenSSL"]
+@@ -93,35 +93,6 @@ filterwarnings = ["once::Warning"]
+ norecursedirs = ["tests/typing"]
+ 
+ 
+-[tool.coverage.run]
+-parallel = true
+-branch = true
+-source = ["service_identity"]
+-
+-[tool.coverage.paths]
+-source = ["src", ".tox/py*/**/site-packages"]
+-
+-[tool.coverage.report]
+-show_missing = true
+-skip_covered = true
+-exclude_lines = [
+-    # a more strict default pragma
+-    "\\# pragma: no cover\\b",
+-
+-    # allow defensive code
+-    "^\\s*raise AssertionError\\b",
+-    "^\\s*raise NotImplementedError\\b",
+-    "^\\s*return NotImplemented\\b",
+-    "^\\s*raise$",
+-
+-    # typing-related code
+-    "^if (False|TYPE_CHECKING):",
+-    ": \\.\\.\\.(\\s*#.*)?$",
+-    "^ +\\.\\.\\.$",
+-    "-> ['\"]?NoReturn['\"]?:",
+-]
+-
+-
+ [tool.interrogate]
+ omit-covered-files = true
+ verbose = 2
+-- 
+2.47.0
+
diff --git a/SOURCES/0002-Remove-hatch-fancy-pypi-readme-build-system-dependency.patch b/SOURCES/0002-Remove-hatch-fancy-pypi-readme-build-system-dependency.patch
new file mode 100644
index 0000000..a41203e
--- /dev/null
+++ b/SOURCES/0002-Remove-hatch-fancy-pypi-readme-build-system-dependency.patch
@@ -0,0 +1,59 @@
+From d8ef2148b09d6bfa5a6b9c5b025961ad40993e91 Mon Sep 17 00:00:00 2001
+From: Carl George <carlwgeorge@gmail.com>
+Date: Wed, 6 Nov 2024 18:27:44 -0600
+Subject: [PATCH 2/2] Remove hatch-fancy-pypi-readme build-system dependency
+
+---
+ pyproject.toml | 31 +------------------------------
+ 1 file changed, 1 insertion(+), 30 deletions(-)
+
+diff --git a/pyproject.toml b/pyproject.toml
+index a43705c..3d76d43 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -1,5 +1,5 @@
+ [build-system]
+-requires = ["hatchling", "hatch-vcs", "hatch-fancy-pypi-readme"]
++requires = ["hatchling", "hatch-vcs"]
+ build-backend = "hatchling.build"
+ 
+ [project]
+@@ -55,35 +55,6 @@ Twitter = "https://twitter.com/hynek"
+ source = "vcs"
+ raw-options = { local_scheme = "no-local-version" }
+ 
+-[tool.hatch.metadata.hooks.fancy-pypi-readme]
+-content-type = "text/markdown"
+-
+-[[tool.hatch.metadata.hooks.fancy-pypi-readme.fragments]]
+-text = "# Service Identity Verification for pyOpenSSL & *cryptography*\n"
+-
+-[[tool.hatch.metadata.hooks.fancy-pypi-readme.fragments]]
+-path = "README.md"
+-start-after = "spiel-begin -->\n"
+-
+-[[tool.hatch.metadata.hooks.fancy-pypi-readme.fragments]]
+-text = """
+-
+-
+-## Release Information
+-
+-"""
+-
+-[[tool.hatch.metadata.hooks.fancy-pypi-readme.fragments]]
+-path = "CHANGELOG.md"
+-pattern = "\n(###.+?\n)## "
+-
+-[[tool.hatch.metadata.hooks.fancy-pypi-readme.fragments]]
+-text = """
+-----
+-
+-[Complete Changelog →](https://service-identity.readthedocs.io/en/stable/changelog.html)
+-"""
+-
+ 
+ [tool.pytest.ini_options]
+ addopts = ["-ra", "--strict-markers", "--strict-config"]
+-- 
+2.47.0
+
diff --git a/SPECS/python-service-identity.spec b/SPECS/python-service-identity.spec
new file mode 100644
index 0000000..9438669
--- /dev/null
+++ b/SPECS/python-service-identity.spec
@@ -0,0 +1,84 @@
+%bcond tests 1
+%bcond docs %{undefined rhel}
+
+Name:           python-service-identity
+Version:        24.2.0
+Release:        2%{?dist}
+Summary:        Service identity verification for pyOpenSSL & cryptography
+License:        MIT
+URL:            https://github.com/pyca/service-identity
+Source:         %{pypi_source service_identity}
+# Downstream-only patch to remove coverage[toml] test dependency
+Patch:          0001-Remove-coverage-toml-test-dependency.patch
+# Downstream-only patch to remove hatch-fancy-pypi-readme build-system dependency
+Patch:          0002-Remove-hatch-fancy-pypi-readme-build-system-dependency.patch
+
+BuildArch:      noarch
+BuildRequires:  python3-devel
+
+%global common_description %{expand:
+Use this package if you want to verify that a PyCA cryptography certificate is
+valid for a certain hostname or IP address, or if you use pyOpenSSL and don’t
+want to be MITMed, or if you want to inspect certificates from either for
+service IDs.  service-identity aspires to give you all the tools you need for
+verifying whether a certificate is valid for the intended purposes.  In the
+simplest case, this means host name verification.  However, service-identity
+implements RFC 6125 fully.}
+
+%description %{common_description}
+
+%package -n     python3-service-identity
+Summary:        %{summary}
+
+%description -n python3-service-identity %{common_description}
+
+%package doc
+Summary:        Documentation for %{name}
+
+%description doc
+%{common_description}
+
+This is the documentation package for %{name}.
+
+%pyproject_extras_subpkg -n python3-service-identity idna
+
+%prep
+%autosetup -p1 -n service_identity-%{version}
+
+%generate_buildrequires
+%pyproject_buildrequires %{?with_tests:-x tests,idna} %{?with_docs:-x docs}
+
+%build
+%pyproject_wheel
+
+%install
+%pyproject_install
+%pyproject_save_files -l service_identity
+
+%if %{with docs}
+# Previously the docs were built with PYTHONPATH=%%{pyproject_build_lib}, but
+# that macro is now deprecated.  It also only works with setuptools, and
+# upstream switched to hatchling.  Building the docs relies on the library
+# being installed, so we have to do it here in %%install instead of in %%build.
+PYTHONPATH=%{buildroot}%{python3_sitelib} sphinx-build docs html
+# remove the sphinx-build leftovers
+rm -rf html/.{doctrees,buildinfo}
+%endif
+
+%check
+%if %{with tests}
+%pytest -v
+%else
+%pyproject_check_import
+%endif
+
+%files -n python3-service-identity -f %{pyproject_files}
+%doc README.md
+
+%if %{with docs}
+%files doc
+%doc html
+%license LICENSE
+%endif
+
+%changelog