How do I get rpmbuild to download all of the sources for a particular .spec?

In the spec file, you can place %undefine _disable_source_fetch anywhere before the source URL.

For security purposes, you should also specify the sha256sum, and check it in the %prep section prior to setup.

Here is a working example:

Name:       monit
Version:    5.25.1
Release:    1%{?dist}
Summary:    Monitoring utility for unix systems

Group:      Applications/System
License:    GNU AFFERO GENERAL PUBLIC LICENSE version 3
URL:        https://mmonit.com/monit/
%undefine _disable_source_fetch
Source0:    https://mmonit.com/monit/dist/%name-%version.tar.gz
%define     SHA256SUM0 4b5c25ceb10825f1e5404f1d8a7b21507716b82bc20c3586f86603691c3b81bc

%define debug_package %nil

BuildRequires:  coreutils

%description
Monit is a small Open Source utility for managing and monitoring Unix systems. Monit conducts automatic maintenance
and repair and can execute meaningful causal actions in error situations.

%prep
echo "%SHA256SUM0  %SOURCE0" | sha256sum -c -
%setup -q

...

Credits

@YaroslavFedevych for undefine _disable_source_fetch.

For posterity, there is another way to do it, which does not need any additional tools or downloads:

rpmbuild --undefine=_disable_source_fetch -ba /path/to/your.spec

Downloading sources automatically is forbidden by default because RPM lacks built-in integrity checks for the source archives. The network has to be trusted, and any checksums and signatures checked. This restriction makes sense for package maintainers, as they are responsible for shipping trusted code.

However, when you know what you are doing and understand the risks, you may just forcibly lift the restriction.

The spectool utility from the rpmdevtools package can do this. Just install rpmdevtools and point spectools at the .spec like so:

spectool -g -R SPECS/nginx.spec

It will download any missing sources into rpm's %{_sourcedir} (usually SOURCES) directory.