diff --git a/.gitattributes b/.gitattributes
index c9ca36b067..d6e99cb389 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -6,3 +6,4 @@
 .gitignore                  export-ignore
 .gitreview                  export-ignore
 tools/make-version.pl       export-subst
+packaging/source/git-export-release.sh.in export-subst
diff --git a/docbook/wsdg_src/WSDG_chapter_sources.adoc b/docbook/wsdg_src/WSDG_chapter_sources.adoc
index 9be495372a..754dc20cfd 100644
--- a/docbook/wsdg_src/WSDG_chapter_sources.adoc
+++ b/docbook/wsdg_src/WSDG_chapter_sources.adoc
@@ -940,9 +940,12 @@ to build the Debian Package.
 
 ==== Red Hat: .rpm Packages
 
-You can build an RPM package using the `rpm-package` target. The package
-version is derived from the current git HEAD, so you must build from a
-git checkout.
+You can build an RPM package using the `rpm-package` target. If you
+are building from a git checkout, the package version is derived from
+the current git HEAD. If you are building from source extracted from a
+tarball created with `git archive` (such as those downloaded from
+http://www.wireshark.org/download.html), you must place the original
+tarball into your build directory.
 
 The package is built using https://rpm.org/[rpmbuild], which comes as
 standard on many flavours of Linux, including Red Hat, Fedora, and
diff --git a/packaging/source/git-export-release.sh.in b/packaging/source/git-export-release.sh.in
index 7242619977..2fc6169875 100755
--- a/packaging/source/git-export-release.sh.in
+++ b/packaging/source/git-export-release.sh.in
@@ -41,6 +41,37 @@ fi
 
 TARBALL="${DESTDIR}/wireshark-${VERSION}.tar.xz"
 
+# A tarball produced by 'git archive' will have the $Format string
+# substituted due to the use of 'export-subst' in .gitattributes.
+# shellcheck disable=SC2016
+COMMIT='$Format:%H$'
+
+if [[ $COMMIT != \$F* ]] ; then
+    # This file was extracted from a tarball produced by git archive
+    # and so we are not in a git repository.
+    if [[ -f "$TARBALL" ]] ; then
+        # git get-tar-commit-id works outside a git repo, as it
+        # only reads the first 1024 bytes of the tar extended header.
+        if [[ $(git get-tar-commit-id < <(xzcat "$TARBALL")) == "$COMMIT" ]] ; then
+            echo "$TARBALL commit ID matches $COMMIT."
+        else
+            # Allow people to make changes to a downloaded source tarball
+            # and re-tar it?
+            echo "WARNING: $TARBALL is not the original git archive."
+        fi
+        exit 0
+    fi
+
+    echo ""
+    echo "The build system cannot produce a source tarball outside of a git repository."
+    echo "If you are trying to build an RPM package from source extracted from a tarball,"
+    echo "copy it (i.e., wireshark-${VERSION}.tar.xz) to"
+    echo "$DESTDIR"
+    echo "and run the build command again."
+
+    exit 1
+fi
+
 COMMIT="${CI_COMMIT_SHA:-HEAD}"
 
 STASH_ID=$(git stash create)