$RPM_SOURCE_DIR or %\{_sourcedir}
An example of this from the kde-l10n package:
*Correct Use:*
for i in $(cat %{SOURCE1000}) ; do
echo $i | grep -v '^#' && \
bzip2 -dc %{_sourcedir}/%{name}-$i-%{version}.tar.bz2 | tar -xf -
*Incorrect Use:*
install -m 644 $RPM_SOURCE_DIR/php.conf $RPM_BUILD_ROOT/etc/httpd/conf.d
sed -e "s/@PHP_APIVER@/%{apiver}/;s/@PHP_ZENDVER@/%{zendver}/;s/@PHP_PDOVER@/%{pdover}/" \
< $RPM_SOURCE_DIR/macros.php > macros.php
install -m 644 %{SOURCE1} $RPM_BUILD_ROOT/etc/httpd/conf.d
sed -e "s/@PHP_APIVER@/%{apiver}/;s/@PHP_ZENDVER@/%{zendver}/;s/@PHP_PDOVER@/%{pdover}/" \
< %{SOURCE3} > macros.php
Packages which use files itemized as Source# files, must refer to those files by their Source# macro name, and must not use $RPM_SOURCE_DIR or %\{sourcedir} to refer to those files.
Source1: php.conf
Source2: php.ini
Source3: macros.php
This is done to ensure that Fedora SRPMS are properly generated. If a Source# item is renamed, a spec which refers to its old name may succeed locally (because the file is still in %\{_sourcedir} along with the new file), but the proper file will not be included in the SRPM.
When there is an available list of supplementary source files, it is permissible to use this list in conjunction with %\{sourcedir} to simplify operations on those supplementary source files.
where Source1000: subdirs-kde-l10n is a list provided by upstream of all the languages supported, and there are ~50 SourceN: tags, which can vary from version from version, but match the languages listed in Source1000, for the tarballs provided by upstream.