diff --git a/brp-mangle-shebangs b/brp-mangle-shebangs
new file mode 100755
index 0000000..9a65305
--- /dev/null
+++ b/brp-mangle-shebangs
@@ -0,0 +1,54 @@
+#!/bin/sh -eu
+
+# If using normal root, avoid changing anything.
+if [ -z "$RPM_BUILD_ROOT" -o "$RPM_BUILD_ROOT" = "/" ]; then
+  exit 0
+fi
+
+cd "$RPM_BUILD_ROOT"
+
+trim() {
+  printf '%s' "$*"
+}
+
+fail=0
+for f in $(find -executable -type f | xargs --no-run-if-empty file -N --mime-type | grep -Po "^\K.+(?=: text/)"); do
+
+  ts=$(stat -c %y "$f")
+
+  read orig_shebang < "$f" || :
+  shebang=$(trim $(echo "$orig_shebang" | grep -Po "#!\K.*" || echo))
+  if [ -z "$shebang" ]; then
+    echo >&2 "*** WARNING: $f is executable but has empty or no shebang, removing executable bit"
+    chmod -x "$f"
+    touch -d "$ts" "$f"
+    continue
+  elif [ "${shebang%${shebang#?}}" != "/" ]; then
+    echo >&2 "*** ERROR: $f has shebang which doesn't start with '/' ($shebang)"
+    fail=1
+    continue
+  fi
+
+  if ! { echo "$shebang" | grep -q -P "^/(?:usr/)?(?:bin|sbin)/"; }; then
+    continue
+  fi
+
+  # Replace "special" env shebang:
+  # /whatsoever/env foo → /whatsoever/foo
+  shebang=$(echo "$shebang" | sed -r -e 's@^(.+/)env (.+)$@\1\2@')
+
+  # Replace ambiguous python with python2
+  py_shebang=$(echo "$shebang" | sed -r -e 's@/usr/bin/python(\s|$)@/usr/bin/python2\1@')
+
+  if [ "$shebang" != "$py_shebang" ]; then
+    sed -i -e "1c #!$py_shebang" "$f"
+    echo >&2 "*** WARNING: mangling shebang in $f from $orig_shebang to #!$py_shebang. This will become an ERROR, fix it manually!"
+  elif [ "#!$shebang" != "$orig_shebang" ]; then
+    sed -i -e "1c #!$shebang" "$f"
+    echo "mangling shebang in $f from $orig_shebang to #!$shebang"
+  fi
+
+  touch -d "$ts" "$f"
+done
+
+exit $fail
diff --git a/macros b/macros
index 9e5c15b..94b5a7b 100644
--- a/macros
+++ b/macros
@@ -107,6 +107,7 @@
 %__brp_strip_static_archive /usr/lib/rpm/brp-strip-static-archive %{__strip}
 %__brp_python_bytecompile /usr/lib/rpm/brp-python-bytecompile %{__python} %{?_python_bytecompile_errors_terminate_build}
 %__brp_python_hardlink /usr/lib/rpm/brp-python-hardlink
+%__brp_mangle_shebangs /usr/lib/rpm/redhat/brp-mangle-shebangs
 
 %__os_install_post    \
     %{?__brp_ldconfig} \
@@ -118,6 +119,7 @@
     %{?__brp_strip_static_archive} \
     %{?py_auto_byte_compile:%{?__brp_python_bytecompile}} \
     %{?__brp_python_hardlink} \
+    %{?__brp_mangle_shebangs} \
 %{nil}
 
 %__spec_install_post\
diff --git a/redhat-rpm-config.spec b/redhat-rpm-config.spec
index 70281bb..929e39a 100644
--- a/redhat-rpm-config.spec
+++ b/redhat-rpm-config.spec
@@ -6,7 +6,7 @@
 
 Summary: Red Hat specific rpm configuration files
 Name: redhat-rpm-config
-Version: 89
+Version: 90
 Release: 1%{?dist}
 # No version specified.
 License: GPL+
@@ -42,6 +42,12 @@ Source152: macros.vpath
 Source153: macros.forge
 Source154: macros.ldconfig
 
+# Build policy scripts
+# this comes from https://github.com/rpm-software-management/rpm/pull/344
+# added a python -> python2 conversion for fedora with warning
+# and an echo when the mangling happens
+Source201: brp-mangle-shebangs
+
 # Dependency generator scripts (deprecated)
 Source300: find-provides
 Source301: find-provides.ksyms
@@ -122,6 +128,7 @@ install -p -m 444 -t %{buildroot}%{rrcdir} redhat-hardened-*
 install -p -m 444 -t %{buildroot}%{rrcdir} redhat-annobin-*
 install -p -m 755 -t %{buildroot}%{rrcdir} config.*
 install -p -m 755 -t %{buildroot}%{rrcdir} dist.sh rpmsort symset-table kmodtool
+install -p -m 755 -t %{buildroot}%{rrcdir} brp-*
 
 install -p -m 755 -t %{buildroot}%{rrcdir} find-*
 mkdir -p %{buildroot}%{rrcdir}/find-provides.d
@@ -140,6 +147,7 @@ install -p -m 755 -t %{buildroot}%{_rpmconfigdir} kmod.prov
 %dir %{rrcdir}
 %{rrcdir}/macros
 %{rrcdir}/rpmrc
+%{rrcdir}/brp-*
 %{rrcdir}/dist.sh
 %{rrcdir}/redhat-hardened-*
 %{rrcdir}/redhat-annobin-*
@@ -168,6 +176,9 @@ install -p -m 755 -t %{buildroot}%{_rpmconfigdir} kmod.prov
 %{_rpmconfigdir}/macros.d/macros.kmp
 
 %changelog
+* Mon Jan 29 2018 Miro Hrončok <mhroncok@redhat.com> - 90-1
+- Add brp-mangle-shebangs
+
 * Mon Jan 29 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 89-1
 - Add macros.ldconfig