unos-repository

commit 5a767a333cdae0123a81af56ea7dd45a676c4089
parent ea6bc121a017a1d33e91a9649cc786e92150aa5c
Author: Robin Bron <robin.bron@yourhosting.nl>
Date:   Fri, 25 Sep 2026 01:06:07 +0200

pipeline now has BUCKET_PUBLIC_URL to just get stuff as needed

Diffstat:
M
.conductor.yml
 | 
113
++++++++++++++++++++++++++++++++++++++++---------------------------------------
M
mk/bootstrap-repo.sh
 | 
8
++++++--
M
mk/gen-pipeline.sh
 | 
9
+++++----

3 files changed, 68 insertions(+), 62 deletions(-)
diff --git a/.conductor.yml b/.conductor.yml
@@ -14,7 +14,8 @@
 # dependency is already published by the time a dependent starts.
 #
 # Credentials arrive as environment: BUCKET_ACCESS_KEY, BUCKET_SECRET_KEY,
-# BUCKET_NAME, BUCKET_ENDPOINT (URL), BUCKET_REGION (region name).
+# BUCKET_NAME, BUCKET_ENDPOINT (URL), BUCKET_REGION (region name),
+# BUCKET_PUBLIC_URL (public https endpoint, e.g. https://repo.unos.finwo.net/).
 #
 # Signing comes from the unos-sign-key worker feature, which mounts the key and
 # exports UNOS_KEY_APK_RSA_PRI. Each worker holds a distinct key, so the signer
@@ -50,10 +51,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh zlib --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh zlib --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" zlib
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" zlib
       - ./mk/build.sh zlib
       - ./mk/publish.sh --arch "$ARCH" zlib
 
@@ -63,10 +64,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh openssl --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh openssl --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" openssl
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" openssl
       - ./mk/build.sh openssl
       - ./mk/publish.sh --arch "$ARCH" openssl
 
@@ -78,10 +79,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh apk-tools --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh apk-tools --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" apk-tools
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" apk-tools
       - ./mk/build.sh apk-tools
       - ./mk/publish.sh --arch "$ARCH" apk-tools
 
@@ -91,10 +92,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh base-files --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh base-files --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" base-files
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" base-files
       - ./mk/build.sh base-files
       - ./mk/publish.sh --arch "$ARCH" base-files
 
@@ -104,10 +105,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh busybox --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh busybox --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" busybox
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" busybox
       - ./mk/build.sh busybox
       - ./mk/publish.sh --arch "$ARCH" busybox
 
@@ -119,10 +120,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh curl --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh curl --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" curl
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" curl
       - ./mk/build.sh curl
       - ./mk/publish.sh --arch "$ARCH" curl
 
@@ -132,10 +133,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh dosfstools --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh dosfstools --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" dosfstools
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" dosfstools
       - ./mk/build.sh dosfstools
       - ./mk/publish.sh --arch "$ARCH" dosfstools
 
@@ -145,10 +146,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh e2fsprogs --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh e2fsprogs --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" e2fsprogs
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" e2fsprogs
       - ./mk/build.sh e2fsprogs
       - ./mk/publish.sh --arch "$ARCH" e2fsprogs
 
@@ -158,10 +159,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh efivar --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh efivar --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" efivar
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" efivar
       - ./mk/build.sh efivar
       - ./mk/publish.sh --arch "$ARCH" efivar
 
@@ -171,10 +172,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh popt --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh popt --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" popt
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" popt
       - ./mk/build.sh popt
       - ./mk/publish.sh --arch "$ARCH" popt
 
@@ -186,10 +187,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh efibootmgr --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh efibootmgr --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" efibootmgr
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" efibootmgr
       - ./mk/build.sh efibootmgr
       - ./mk/publish.sh --arch "$ARCH" efibootmgr
 
@@ -199,10 +200,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh glibc --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh glibc --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" glibc
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" glibc
       - ./mk/build.sh glibc
       - ./mk/publish.sh --arch "$ARCH" glibc
 
@@ -212,10 +213,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh libstdc++ --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh libstdc++ --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" libstdc++
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" libstdc++
       - ./mk/build.sh libstdc++
       - ./mk/publish.sh --arch "$ARCH" libstdc++
 
@@ -228,10 +229,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh gptfdisk --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh gptfdisk --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" gptfdisk
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" gptfdisk
       - ./mk/build.sh gptfdisk
       - ./mk/publish.sh --arch "$ARCH" gptfdisk
 
@@ -241,10 +242,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh xz --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh xz --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" xz
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" xz
       - ./mk/build.sh xz
       - ./mk/publish.sh --arch "$ARCH" xz
 
@@ -255,10 +256,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh grub --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh grub --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" grub
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" grub
       - ./mk/build.sh grub
       - ./mk/publish.sh --arch "$ARCH" grub
 
@@ -268,10 +269,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh libmnl --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh libmnl --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" libmnl
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" libmnl
       - ./mk/build.sh libmnl
       - ./mk/publish.sh --arch "$ARCH" libmnl
 
@@ -281,10 +282,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh libcap --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh libcap --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" libcap
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" libcap
       - ./mk/build.sh libcap
       - ./mk/publish.sh --arch "$ARCH" libcap
 
@@ -296,10 +297,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh iproute2 --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh iproute2 --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" iproute2
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" iproute2
       - ./mk/build.sh iproute2
       - ./mk/publish.sh --arch "$ARCH" iproute2
 
@@ -309,10 +310,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh linkd --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh linkd --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" linkd
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" linkd
       - ./mk/build.sh linkd
       - ./mk/publish.sh --arch "$ARCH" linkd
 
@@ -322,10 +323,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh linux-longterm --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh linux-longterm --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" linux-longterm
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" linux-longterm
       - ./mk/build.sh linux-longterm
       - ./mk/publish.sh --arch "$ARCH" linux-longterm
 
@@ -335,10 +336,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh linux-mainline --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh linux-mainline --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" linux-mainline
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" linux-mainline
       - ./mk/build.sh linux-mainline
       - ./mk/publish.sh --arch "$ARCH" linux-mainline
 
@@ -348,10 +349,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh linux-stable --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh linux-stable --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" linux-stable
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" linux-stable
       - ./mk/build.sh linux-stable
       - ./mk/publish.sh --arch "$ARCH" linux-stable
 
@@ -362,10 +363,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh smartmontools --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh smartmontools --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" smartmontools
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" smartmontools
       - ./mk/build.sh smartmontools
       - ./mk/publish.sh --arch "$ARCH" smartmontools
 
@@ -375,10 +376,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh tinyssh --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh tinyssh --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" tinyssh
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" tinyssh
       - ./mk/build.sh tinyssh
       - ./mk/publish.sh --arch "$ARCH" tinyssh
 
@@ -388,10 +389,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh unos-firstboot --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh unos-firstboot --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" unos-firstboot
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" unos-firstboot
       - ./mk/build.sh unos-firstboot
       - ./mk/publish.sh --arch "$ARCH" unos-firstboot
 
@@ -401,10 +402,10 @@ tasks:
     arch: [x86_64]
     requires: [unos-sign-key]
     script:
-      - ./mk/check-revision.sh unos-keys --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/check-revision.sh unos-keys --repo "$BUCKET_PUBLIC_URL" || exit 0
       - ./mk/ci-setup.sh
       - ./mk/bootstrap-host.sh
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" unos-keys
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" unos-keys
       - ./mk/build.sh unos-keys
       - ./mk/publish.sh --arch "$ARCH" unos-keys
 
@@ -444,6 +445,6 @@ tasks:
       - ./mk/bootstrap-host.sh
       # Pull every published package down so the index describes the whole
       # repo, not just whatever this container happened to build.
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL"
       - ./mk/repo-index.sh
       - ./mk/publish.sh --arch "$ARCH" --index-only
diff --git a/mk/bootstrap-repo.sh b/mk/bootstrap-repo.sh
@@ -12,12 +12,13 @@ ROOT=$(cd "${HERE}/.." && pwd)
 ARCH="${ARCH:-x86_64}"
 case "${ARCH}" in arm64) ARCH=aarch64 ;; esac
 
-for v in BUCKET_ACCESS_KEY BUCKET_SECRET_KEY BUCKET_NAME BUCKET_ENDPOINT BUCKET_REGION; do
+for v in BUCKET_ACCESS_KEY BUCKET_SECRET_KEY BUCKET_NAME BUCKET_ENDPOINT BUCKET_REGION BUCKET_PUBLIC_URL; do
   eval "val=\${${v}:-}"
   [ -n "${val}" ] || { echo "bootstrap-repo.sh: ${v} is not set" >&2; exit 1; }
 done
 
 url="${BUCKET_ENDPOINT%/}/${BUCKET_NAME}/${ARCH}/APKINDEX.tar.gz"
+public_url="${BUCKET_PUBLIC_URL%/}/${ARCH}/APKINDEX.tar.gz"
 tmp_body=$(mktemp)
 code=$(curl -sS -o "${tmp_body}" -w '%{http_code}' \
   --aws-sigv4 "aws:amz:${BUCKET_REGION}:s3" \
@@ -26,7 +27,10 @@ code=$(curl -sS -o "${tmp_body}" -w '%{http_code}' \
   "${url}") || code=000
 
 case "${code}" in
-  2*) rm -f "${tmp_body}"; echo "==> repo already has ${ARCH}/APKINDEX.tar.gz (${code}), nothing to do"; exit 0 ;;
+  2*) rm -f "${tmp_body}"
+      anon_code=$(curl -sS -o /dev/null -w '%{http_code}' "${public_url}") || anon_code=000
+      case "${anon_code}" in 2*) echo "==> repo already has ${ARCH}/APKINDEX.tar.gz (${code}, anon ${anon_code}), nothing to do"; exit 0 ;; *) echo "==> repo has ${ARCH}/APKINDEX.tar.gz but public fetch is ${anon_code}, re-publishing" ;; esac
+      ;;
   404) rm -f "${tmp_body}"; echo "==> no ${ARCH}/APKINDEX.tar.gz (404), bootstrapping empty index" ;;
   000) echo "bootstrap-repo.sh: could not reach ${url} (curl failed)" >&2; cat "${tmp_body}" >&2 2>/dev/null || true; rm -f "${tmp_body}"; exit 1 ;;
   400) echo "bootstrap-repo.sh: bad request (400) for ${url} -- check BUCKET_ENDPOINT/BUCKET_NAME/BUCKET_REGION" >&2; echo "--- S3 response ---" >&2; cat "${tmp_body}" >&2 2>/dev/null || true; echo "--- env ---" >&2; echo "ENDPOINT=${BUCKET_ENDPOINT} NAME=${BUCKET_NAME} REGION=${BUCKET_REGION}" >&2; rm -f "${tmp_body}"; exit 1 ;;
diff --git a/mk/gen-pipeline.sh b/mk/gen-pipeline.sh
@@ -56,7 +56,8 @@ emit() {
 # dependency is already published by the time a dependent starts.
 #
 # Credentials arrive as environment: BUCKET_ACCESS_KEY, BUCKET_SECRET_KEY,
-# BUCKET_NAME, BUCKET_ENDPOINT (URL), BUCKET_REGION (region name).
+# BUCKET_NAME, BUCKET_ENDPOINT (URL), BUCKET_REGION (region name),
+# BUCKET_PUBLIC_URL (public https endpoint, e.g. https://repo.unos.finwo.net/).
 #
 # Signing comes from the unos-sign-key worker feature, which mounts the key and
 # exports UNOS_KEY_APK_RSA_PRI. Each worker holds a distinct key, so the signer
@@ -107,10 +108,10 @@ HEADER
     # The feature provides UNOS_KEY_APK_RSA_PRI, which mk/sign-key.inc reads.
     printf '    requires: [unos-sign-key]\n'
     printf '    script:\n'
-    printf '      - ./mk/check-revision.sh %s --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"\n' "$p"
+    printf '      - ./mk/check-revision.sh %s --repo "$BUCKET_PUBLIC_URL" || exit 0\n' "$p"
     printf '      - ./mk/ci-setup.sh\n'
     printf '      - ./mk/bootstrap-host.sh\n'
-    printf '      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH" %s\n' "$p"
+    printf '      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" %s\n' "$p"
     printf '      - ./mk/build.sh %s\n' "$p"
     printf '      - ./mk/publish.sh --arch "$ARCH" %s\n' "$p"
     printf '\n'
@@ -134,7 +135,7 @@ FOOTER
       - ./mk/bootstrap-host.sh
       # Pull every published package down so the index describes the whole
       # repo, not just whatever this container happened to build.
-      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_ENDPOINT/$BUCKET_NAME/$ARCH"
+      - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL"
       - ./mk/repo-index.sh
       - ./mk/publish.sh --arch "$ARCH" --index-only
 FOOTER