AFAIK, they've always refused to provide them. Unfortunately qmail isn't GPL or similar, so they can't be required to provide them on those grounds. However, and I never bothered to check this, if you see that any of the patches are GPL then I believe they will have to provide the SRPM. But, of course, you'll have to really get on them and maybe drum up some outcry once you have the facts in hand.