Thanks to you pointing this out, I investigated and determined that both steps need to be completed for both rpms and srpms. Accordingly, I wrote a basic srpm upload test to make sure it gets the provides and requires data.