I'm not certain that much more effort is required. Untraceable uploads with Onionshare over a Tor browser would conceal the origin of source RPMs that did not

I'm not certain that much more effort is required. Untraceable uploads with Onionshare over a Tor browser would conceal the origin of source RPMs that did not bear fingerprints. Once captured, all that is really required is the updated SPEC file, and any modified sources or patches (if I remember my RPM internals correctly). Alma could maintain such an Onionshare instance. If the SPEC and patch files are specifically GPL, I'm not sure that Alma could be compelled to forego them.