common.smk: Conditionally include --no-sign-request option

[joverlee521]

Description of proposed changes

Conditionally include --no-sign-request option for download rules if the s3_src config param is pointing to the public Nextstrain S3 bucket (s3://nextstrain-data/).

This means AWS credentials are no longer necessary for the public h5n1-cattle-outbreak genome build.

After running nextstrain update docker, I can successfully run the h5n1-cattle-outbreak build with:

nextstrain build . \
    --snakefile Snakefile.genome \
    --config s3_src=s3://nextstrain-data/files/workflows/avian-flu/h5n1

Or you can point to the specific image

nextstrain build --image nextstrain/base:build-20240612T230750Z . \
    --snakefile Snakefile.genome \
    --config s3_src=s3://nextstrain-data/files/workflows/avian-flu/h5n1

Related issue(s)

Dependent on nextstrain/docker-base#215
Follow up to #47

Checklist

• Checks pass

[joverlee521]

From @jameshadfield in nextstrain/docker-base#213 (comment):

(Or we could just change avian-flu to use curl, right?)

Yes, as long as we are fine with maintaining separate download rules for the default avian flu builds and the h5n1 cattle outbreak build.

[trvrb]

I think this needs to work from Docker and not just Conda. I don't have a preference for curl vs aws s3 cp, but curl seems like a potentially easy fix.

[joverlee521]

Docker issue will be resolved by nextstrain/docker-base#214 nextstrain/docker-base#215

[joverlee521]

It would be more robust to call aws s3api get-bucket-policy-status to check if the bucket is public or not rather than relying on a hard-coded bucket here.

I'm going to punt on that and say we can implement it in the ingest/download-from-s3 script and update this workflow to call download-from-s3 later.