diff --git a/Jenkinsfile b/Jenkinsfile
index 181827d8e..6394b7ad9 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -10,7 +10,7 @@
 // builds. readTrusted reads it from the revision this job is for, without
 // cloning the repo.
 def selectedLabels() {
-  def sel = readTrusted('build-scripts/labels.txt').readLines()
+  def sel = readTrusted('build-scripts/canaries.txt').readLines()
       .collect { it.trim() }
       .findAll { it.startsWith('PACKAGES_') && it ==~ params.LABEL_FILTER }
   if (!sel) {
diff --git a/README-build-in-container.md b/README-build-in-container.md
new file mode 100644
index 000000000..d8e0b3fdd
--- /dev/null
+++ b/README-build-in-container.md
@@ -0,0 +1,8 @@
+Build with ./build-in-container.py
+
+Using ./build-in-container.py --shell you can run the build interactively and debug issues.
+Start in the container by running /srv/source/buildscripts/build-in-container-inner.sh
+
+This will copy repository sources that are needed from the read-only /srv location to read-write work area in /home/builder/build.
+
+Continue debugging by running steps in /home/builder/buildscripts/build-scripts/0*.sh
diff --git a/build-in-container-inner.sh b/build-in-container-inner.sh
index a77d0d2af..98a1bd0d9 100755
--- a/build-in-container-inner.sh
+++ b/build-in-container-inner.sh
@@ -4,15 +4,20 @@ set -e
 # Configuration via environment variables:
 #   PROJECT, BUILD_TYPE, EXPLICIT_ROLE, BUILD_NUMBER, EXPLICIT_VERSION
 
+# let setup-cfengine-build-host.sh know we are in a container
+sudo touch /etc/cfengine-in-container.flag
+
 BASEDIR=/home/builder/build
 export BASEDIR
 export AUTOBUILD_PATH="$BASEDIR/buildscripts"
+OUTPUT=/output
+export OUTPUT
 
 mkdir -p "$BASEDIR"
 
 # Bind-mounted directories may be owned by the host user's UID.
 # Fix ownership so builder can write to them.
-sudo chown -R "$(id -u):$(id -g)" "$HOME/.cache" /output
+sudo chown -R "$(id -u):$(id -g)" "$HOME/.cache" "$OUTPUT"
 
 # And hand ownership back to the host user on the way out.
 if [ -n "$HOST_UID" ] && [ -n "$HOST_GID" ]; then
@@ -85,49 +90,10 @@ fi
 export SOURCE_DATE_EPOCH
 echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH"
 
-install_mission_portal_deps() (
-    set -e
-
-    if [ -f "$BASEDIR/mission-portal/public/scripts/package.json" ]; then
-        echo "Installing npm dependencies..."
-        npm ci --prefix "$BASEDIR/mission-portal/public/scripts/"
-        echo "Building react components..."
-        npm run build --prefix "$BASEDIR/mission-portal/public/scripts/"
-        rm -rf "$BASEDIR/mission-portal/public/scripts/node_modules"
-    fi
-
-    if [ -f "$BASEDIR/mission-portal/composer.json" ]; then
-        echo "Installing Mission Portal PHP dependencies..."
-        (cd "$BASEDIR/mission-portal" && composer install --no-dev --ignore-platform-reqs --prefer-dist)
-    fi
-
-    if [ -f "$BASEDIR/nova/api/http/composer.json" ]; then
-        echo "Installing Nova API PHP dependencies..."
-        (cd "$BASEDIR/nova/api/http" && composer install --no-dev --ignore-platform-reqs --prefer-dist)
-    fi
-
-    if [ -f "$BASEDIR/mission-portal/public/themes/default/bootstrap/cfengine_theme.less" ]; then
-        echo "Compiling Mission Portal styles..."
-        mkdir -p "$BASEDIR/mission-portal/public/themes/default/bootstrap/compiled/css"
-        (cd "$BASEDIR/mission-portal/public/themes/default/bootstrap" &&
-            lessc --compress ./cfengine_theme.less ./compiled/css/cfengine.less.css)
-    fi
-
-    if [ -f "$BASEDIR/mission-portal/ldap/composer.json" ]; then
-        echo "Installing LDAP API PHP dependencies..."
-        (cd "$BASEDIR/mission-portal/ldap" && composer install --no-dev --ignore-platform-reqs --prefer-dist)
-    fi
-
-    # Composer falls back to git clone when GitHub's anonymous zipball
-    # rate limit is hit, leaving non-reproducible .git directories in the
-    # vendor tree. Strip them.
-    find "$BASEDIR/mission-portal" "$BASEDIR/nova/api/http" -type d -name .git -path '*/vendor/*' -exec rm -rf {} +
-)
-
 # Lets whoever consumes the output check that it arrived intact. Sorted in the C
 # locale so that the list itself comes out the same every time.
 write_sha256sums() (
-    cd /output
+    cd "$OUTPUT"
     # shellcheck disable=SC2094
     # > Make sure not to read and write the same file in the same pipeline.
     # find leaves it out by name, so the list never covers itself.
@@ -135,55 +101,11 @@ write_sha256sums() (
         | LC_ALL=C sort | xargs -r sha256sum > sha256sums.txt
 )
 
-# Build the source tarballs. They are the same whichever platform builds them,
-# so only this image builds them, and nothing else here does. /output is
-# <output-dir>/tarballs on the host, as the packages' /output is per label.
-#
-# Each tarball's timestamps follow its own repository: Makefile.am in core and in
-# masterfiles clamps every mtime in the tarball to SOURCE_DATE_EPOCH, so taking
-# it from the last commit keeps a tarball identical until its own sources change.
-build_tarballs() (
-    set -e
-
-    (
-        cd "$BASEDIR/core"
-        SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)
-        export SOURCE_DATE_EPOCH
-        echo "core SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH"
-
-        rm -f cfengine-3.*.tar.gz
-        # Configure so the dist target exists, undone again below.
-        ./configure -C
-        make dist
-        mv cfengine-3.*.tar.gz /output/
-        make distclean
-    )
-
-    (
-        cd "$BASEDIR/masterfiles"
-        SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)
-        export SOURCE_DATE_EPOCH
-        echo "masterfiles SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH"
-
-        rm -f cfengine-masterfiles*.tar.gz
-        ./configure
-        make dist        # source tarball:  cfengine-masterfiles-<version>.tar.gz
-        make tar-package # package tarball: cfengine-masterfiles-<version>.pkg.tar.gz
-        mv cfengine-masterfiles*.tar.gz /output/
-        make distclean
-    )
-
-    write_sha256sums
-)
-
-# === Step runner with failure reporting ===
-# Disable set -e so we can capture exit codes and report which step failed.
-set +e
 run_step() {
     local name="$1"
     shift
     echo "=== Running $name ==="
-    "$@"
+    "$BASEDIR/buildscripts/build-scripts/$name" "$@"
     local rc=$?
     if [ $rc -ne 0 ]; then
         echo ""
@@ -193,36 +115,26 @@ run_step() {
 }
 
 # === Build steps ===
-run_step "01-autogen" "$BASEDIR/buildscripts/build-scripts/autogen"
 
 if [ "$TARBALLS" = yes ]; then
-    run_step "02-tarballs" build_tarballs
+    run_step autogen
+    run_step build-tarballs
     echo ""
     echo "=== Build complete ==="
-    ls -lh /output/
+    ls -lh "$OUTPUT"
     exit 0
 fi
 
-run_step "02-install-dependencies" "$BASEDIR/buildscripts/build-scripts/install-dependencies"
-# Mission Portal is an Enterprise/nova-only component; its sources are only
-# synced when PROJECT=nova. Skip this step for community hubs.
-if [ "$PROJECT" = "nova" ] && [ "$EXPLICIT_ROLE" = "hub" ]; then
-    run_step "03-mission-portal-deps" install_mission_portal_deps
-fi
-run_step "04-configure" "$BASEDIR/buildscripts/build-scripts/configure"
-run_step "05-compile" "$BASEDIR/buildscripts/build-scripts/compile"
-run_step "06-package" "$BASEDIR/buildscripts/build-scripts/package"
-
-# === Copy output packages ===
-# Packages are created under $BASEDIR/<project>/ by dpkg-buildpackage / rpmbuild.
-# Exclude deps-packaging to avoid copying dependency packages.
-find "$BASEDIR" -maxdepth 4 \
-    -path "$BASEDIR/buildscripts/deps-packaging" -prune -o \
-    \( -name '*.deb' -o -name '*.rpm' -o -name '*.msi' -o -name '*.pkg.tar.gz' \) -print \
-    -exec cp {} /output/ \;
+NO_TESTS=true
+export NO_TESTS
+
+for script in "$BASEDIR/buildscripts/build-scripts"/0*; do
+  name="$(basename "$script")"
+  run_step "$name"
+done
 
 write_sha256sums
 
 echo ""
 echo "=== Build complete ==="
-ls -lh /output/
+ls -lh "$OUTPUT"/
diff --git a/build-scripts/0000-system-dependencies b/build-scripts/0000-system-dependencies
new file mode 100755
index 000000000..8a6db48de
--- /dev/null
+++ b/build-scripts/0000-system-dependencies
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -ex
+thisdir="$(dirname "$0")"
+sudo bash "$thisdir"/../ci/setup-cfengine-build-host.sh
diff --git a/build-scripts/0005-repositories b/build-scripts/0005-repositories
new file mode 120000
index 000000000..e69f3dc94
--- /dev/null
+++ b/build-scripts/0005-repositories
@@ -0,0 +1 @@
+repositories
\ No newline at end of file
diff --git a/build-scripts/0010-autogen b/build-scripts/0010-autogen
new file mode 120000
index 000000000..563ea1500
--- /dev/null
+++ b/build-scripts/0010-autogen
@@ -0,0 +1 @@
+autogen
\ No newline at end of file
diff --git a/build-scripts/0020-clean-buildmachine b/build-scripts/0020-clean-buildmachine
new file mode 120000
index 000000000..3e44a57b8
--- /dev/null
+++ b/build-scripts/0020-clean-buildmachine
@@ -0,0 +1 @@
+clean-buildmachine
\ No newline at end of file
diff --git a/build-scripts/0030-bootstrap-mission-portal b/build-scripts/0030-bootstrap-mission-portal
new file mode 120000
index 000000000..da139a1d1
--- /dev/null
+++ b/build-scripts/0030-bootstrap-mission-portal
@@ -0,0 +1 @@
+bootstrap-mission-portal
\ No newline at end of file
diff --git a/build-scripts/0035-generate-pull-request-file b/build-scripts/0035-generate-pull-request-file
new file mode 120000
index 000000000..019f7567e
--- /dev/null
+++ b/build-scripts/0035-generate-pull-request-file
@@ -0,0 +1 @@
+generate-pull-request-file
\ No newline at end of file
diff --git a/build-scripts/0040-build-tarballs b/build-scripts/0040-build-tarballs
new file mode 120000
index 000000000..0d1b19ec2
--- /dev/null
+++ b/build-scripts/0040-build-tarballs
@@ -0,0 +1 @@
+build-tarballs
\ No newline at end of file
diff --git a/build-scripts/0050-unpack-tarballs b/build-scripts/0050-unpack-tarballs
new file mode 120000
index 000000000..f4e734e68
--- /dev/null
+++ b/build-scripts/0050-unpack-tarballs
@@ -0,0 +1 @@
+unpack-tarballs
\ No newline at end of file
diff --git a/build-scripts/0060-install-dependencies b/build-scripts/0060-install-dependencies
new file mode 120000
index 000000000..365df31b2
--- /dev/null
+++ b/build-scripts/0060-install-dependencies
@@ -0,0 +1 @@
+install-dependencies
\ No newline at end of file
diff --git a/build-scripts/0070-configure b/build-scripts/0070-configure
new file mode 120000
index 000000000..cabc7046d
--- /dev/null
+++ b/build-scripts/0070-configure
@@ -0,0 +1 @@
+configure
\ No newline at end of file
diff --git a/build-scripts/0080-generate-source-tarballs b/build-scripts/0080-generate-source-tarballs
new file mode 120000
index 000000000..ae7ba0935
--- /dev/null
+++ b/build-scripts/0080-generate-source-tarballs
@@ -0,0 +1 @@
+generate-source-tarballs
\ No newline at end of file
diff --git a/build-scripts/0090-compile b/build-scripts/0090-compile
new file mode 120000
index 000000000..f8808babb
--- /dev/null
+++ b/build-scripts/0090-compile
@@ -0,0 +1 @@
+compile
\ No newline at end of file
diff --git a/build-scripts/0100-produce-debug-symbols b/build-scripts/0100-produce-debug-symbols
new file mode 120000
index 000000000..017abf496
--- /dev/null
+++ b/build-scripts/0100-produce-debug-symbols
@@ -0,0 +1 @@
+produce-debug-symbols
\ No newline at end of file
diff --git a/build-scripts/0110-package b/build-scripts/0110-package
new file mode 120000
index 000000000..597acc768
--- /dev/null
+++ b/build-scripts/0110-package
@@ -0,0 +1 @@
+package
\ No newline at end of file
diff --git a/build-scripts/0120-prepare-results b/build-scripts/0120-prepare-results
new file mode 120000
index 000000000..b1b48550e
--- /dev/null
+++ b/build-scripts/0120-prepare-results
@@ -0,0 +1 @@
+prepare-results
\ No newline at end of file
diff --git a/build-scripts/0130-test b/build-scripts/0130-test
new file mode 120000
index 000000000..30d74d258
--- /dev/null
+++ b/build-scripts/0130-test
@@ -0,0 +1 @@
+test
\ No newline at end of file
diff --git a/build-scripts/0140-prepare-results b/build-scripts/0140-prepare-results
new file mode 120000
index 000000000..b1b48550e
--- /dev/null
+++ b/build-scripts/0140-prepare-results
@@ -0,0 +1 @@
+prepare-results
\ No newline at end of file
diff --git a/build-scripts/autogen b/build-scripts/autogen
index 236f30b25..7ba0dbef3 100755
--- a/build-scripts/autogen
+++ b/build-scripts/autogen
@@ -18,6 +18,10 @@
 # ```
 #
 
+# note that this script should be a no-op if an artifacts.tgz is present
+thisdir="$(dirname "$0")"
+bash "$thisdir"/../ci/setup-ci-host.sh --bootstrap
+
 # Get the BASEDIR variable holding the path to where our repos are checked out
 . "$(dirname "$0")/functions"
 
@@ -61,11 +65,15 @@ done
 # Run autogen.sh on each repository
 for proj in $projects; do
     # autogen.sh is quite verbose, so only print the output in case of failure
-    log_debug "Running autogen.sh for project $proj..."
     (
         cd "$BASEDIR/$proj"
-        export NO_CONFIGURE=1
-        run_and_print_on_failure ./autogen.sh
+        if [ ! -f configure ] || [ ! -f CFVERSION ]; then
+            log_debug "Running autogen.sh for project $proj..."
+            export NO_CONFIGURE=1
+            run_and_print_on_failure ./autogen.sh
+        else
+            log_debug "Skipping autogen.sh in $proj as configure and/or CFVERSION files already exist"
+        fi
     )
 done
 
diff --git a/build-scripts/bootstrap-mission-portal b/build-scripts/bootstrap-mission-portal
new file mode 100755
index 000000000..c59b7063d
--- /dev/null
+++ b/build-scripts/bootstrap-mission-portal
@@ -0,0 +1,55 @@
+. "$(dirname "$0")"/functions
+. detect-environment
+. compile-options
+. version
+    set -e
+
+if [ "$ROLE" != "hub" ]; then
+  echo "ROLE is not hub so skipping $0"
+  exit 0
+fi
+
+if command -v composer >/dev/null; then
+  COMPOSER=$(command -v composer)
+elif [ -f /usr/local/bin/composer.phar ]; then
+  COMPOSER=/usr/local/bin/composer.phar
+else
+  echo "Error: could not find composer command in PATH or at /usr/local/bin/composer.phar"
+  exit 1
+fi
+
+
+if [ -f "$BASEDIR/mission-portal/public/scripts/package.json" ]; then
+    echo "Installing npm dependencies..."
+    npm ci --prefix "$BASEDIR/mission-portal/public/scripts/"
+    echo "Building react components..."
+    npm run build --prefix "$BASEDIR/mission-portal/public/scripts/"
+    rm -rf "$BASEDIR/mission-portal/public/scripts/node_modules"
+fi
+
+if [ -f "$BASEDIR/mission-portal/composer.json" ]; then
+    echo "Installing Mission Portal PHP dependencies..."
+    (cd "$BASEDIR/mission-portal" && php "$COMPOSER" install --no-dev --ignore-platform-reqs --prefer-dist)
+fi
+
+if [ -f "$BASEDIR/nova/api/http/composer.json" ]; then
+    echo "Installing Nova API PHP dependencies..."
+    (cd "$BASEDIR/nova/api/http" && php "$COMPOSER" install --no-dev --ignore-platform-reqs --prefer-dist)
+fi
+
+if [ -f "$BASEDIR/mission-portal/public/themes/default/bootstrap/cfengine_theme.less" ]; then
+    echo "Compiling Mission Portal styles..."
+    mkdir -p "$BASEDIR/mission-portal/public/themes/default/bootstrap/compiled/css"
+    (cd "$BASEDIR/mission-portal/public/themes/default/bootstrap" &&
+        lessc --compress ./cfengine_theme.less ./compiled/css/cfengine.less.css)
+fi
+
+if [ -f "$BASEDIR/mission-portal/ldap/composer.json" ]; then
+    echo "Installing LDAP API PHP dependencies..."
+    (cd "$BASEDIR/mission-portal/ldap" && php "$COMPOSER" install --no-dev --ignore-platform-reqs --prefer-dist)
+fi
+
+# Composer falls back to git clone when GitHub's anonymous zipball
+# rate limit is hit, leaving non-reproducible .git directories in the
+# vendor tree. Strip them.
+find "$BASEDIR/mission-portal" "$BASEDIR/nova/api/http" -type d -name .git -path '*/vendor/*' -exec rm -rf {} +
diff --git a/build-scripts/bootstrap-tarballs b/build-scripts/bootstrap-tarballs
index 4a27d3009..72b2a28a1 100755
--- a/build-scripts/bootstrap-tarballs
+++ b/build-scripts/bootstrap-tarballs
@@ -1,184 +1,7 @@
-#!/bin/bash
-
-# This script is supposed generate tarballs from the core & masterfiles
-# repositories. We also use these tarballs later in the build process to make
-# sure that they actually work.
-#
-# Currently this script does a lot more than bootstrap tarballs.
-# It also fetches pull request info and installs PHP and javascript dependencies.
-# The history behind this is that this script is run early in the bootstrap-pr job,
-# and these extra steps effectively saves compute time for subsequent hub builds.
-# Maybe we should rename it to only bootstrap (see ENT-13064).
-#
-# You will first need to run the autogen script. E.g.:
-#   PROJECT=community ./buildscripts/build-scripts/autogen
-# Then you can run it like this:
-#   BUILD_TYPE=DEBUG ./buildscripts/build-scripts/bootstrap-tarballs
-#
-# The script expects the following repositories to be side by side:
-# .
-# ├── buildscripts
-# ├── core
-# ├── enterprise
-# ├── nova
-# ├── mission-portal
-# ├── libntech
-# └── masterfiles
-#
-# ^ When building community you won't need enterprise, nova, mission-portal
-#
-
-_dir=$(readlink -e "$(dirname "$0")")
-# refactored a few functions into single file scripts for easier development/debugging, see ENT-12741 and ENT-12595
-# Easier to add a path to a script than source a file of functions.
-export PATH="$_dir"/bin:$PATH
-. "$(dirname "$0")"/functions
-. detect-environment
-. compile-options
-. version
-
-mkdir -p "$BASEDIR"/output/tarballs
-
-# the first part of the script is not really critical
-set +e
-
-# Get information about PRs among the used revisions.
-# These PRs will have to be notified of build progress.
-#
-# Variables such as MISSION_PORTAL_REV may be set by the CI (Jenkins) to build and test multiple PR's together.
-# The variables typically hold a branch name or a pull request ID.
-# PR IDs can also be preceded by 'pull' or 'origin/pull'.
-# E.g.:
-# - MISSION_PORTAL_REV=pull/1755
-# - MISSION_PORTAL_REV=origin/pull/1755
-# where the trailing number is the pull request ID.
-#
-# Furthermore, they can be suffixed by anything after a subsequent slash (/).
-# We usually use:
-# - ID alone
-# - pull/ID/head
-# - pull/ID/merge
-#
-# This loop fetches information about the PRs if the respective variable is set.
-#
-for repo_spec in cfengine/buildscripts cfengine/core cfengine/masterfiles cfengine/enterprise cfengine/nova cfengine/mission-portal NorthernTechHQ/libntech; do
-    # remove organization/ from start of repo_spec
-    # E.g. 'cfengine/mission-portal' -> 'mission-portal'
-    repo="${repo_spec#*/}"
-
-    # Convert to uppercase, swap hyphens with underscore and append '_REV'
-    # E.g. 'mission-portal' -> 'MISSION_PORTAL_REV'
-    rev_param_name="$(echo "$repo" | tr '[:lower:]-' '[:upper:]_')_REV"
-
-    # Try to dereference the result from above and skip the rest of the loop
-    # unless the variable is defined.
-    revision="${!rev_param_name}" || continue
-
-    # remove "origin/" (if any)
-    revision="${revision##origin/}"
-
-    # Check to see if the resolved variable starts with 'pull/'
-    if expr "$revision" : "pull/" >/dev/null; then
-        # Extract the revision number. E.g. 'pull/1755' -> '1755'
-        pr_nr="$(echo "$revision" | cut -d/ -f2)"
-
-        get-github-pull-request-info "$repo_spec" "$pr_nr" >>"$BASEDIR"/output/PRs
-    fi
-done
-
-# now script failures should fail the script
+#!/usr/bin/env bash
+# legacy bootstrap-tarballs was split into build-tarballs and bootstrap-mission-portal
+# todo: remove this script when it is no longer called from anywhere
 set -e
-
-# Build tarball from core repository
-cd "$BASEDIR"/core
-rm -f cfengine-3.*.tar.gz
-git rev-parse HEAD >"$BASEDIR"/output/core-commitID
-# Configure in order to run "make dist", deleted later.
-log_debug "Running configure on core repository..."
-run_and_print_on_failure ./configure -C
-# Normalize source timestamps to avoid errors like:
-# configure: error: newly created file is older than distributed files!
-find . -exec touch -t 202501010000.00 {} +
-log_debug "Running make dist on core repository..."
-run_and_print_on_failure make dist
-mv cfengine-3.*.tar.gz "$BASEDIR"/output/tarballs/
-log_debug "Running make distclean on core repository..."
-run_and_print_on_failure make distclean
-
-# Build tarballs from masterfiles repository
-cd "$BASEDIR"/masterfiles
-rm -f cfengine-masterfiles*.tar.gz
-git rev-parse HEAD >"$BASEDIR"/output/masterfiles-commitID
-# Configure in order to run "make dist", deleted later.
-log_debug "Running configure on masterfiles repository..."
-run_and_print_on_failure ./configure
-# Normalize source timestamps to avoid errors like:
-# configure: error: newly created file is older than distributed files!
-find . -exec touch -t 202501010000.00 {} +
-log_debug "Running make dist on masterfiles repository..."
-run_and_print_on_failure make dist # source tarball
-log_debug "Running make tar-package on masterfiles repository..."
-run_and_print_on_failure make tar-package # package tarball (containing all files as if they were installed under "prefix".)
-mv cfengine-masterfiles*.tar.gz "$BASEDIR"/output/tarballs/
-log_debug "Running make distclean on masterfiles repository..."
-run_and_print_on_failure make distclean
-
-# Compute a checksum list that can be used to verify the integrity of the
-# tarballs
-cd "$BASEDIR"/output/tarballs
-sha256sum -- *.tar.gz >sha256sums.txt
-# Add the BSD (16-bit) checksum of the checksum list to it's filename. This way
-# you can verify the integrity of the checksum list itself.
-CKSUM=$(sum sha256sums.txt | cut -d ' ' -f 1)
-mv sha256sums.txt sha256sums."$CKSUM".txt
-
-log_debug "Installing javascript npm dependencies..."
-(
-    if test -f "$BASEDIR"/mission-portal/public/scripts/package.json; then
-        cd "$BASEDIR"/mission-portal/public/scripts
-        # display node & npm versions
-        npm --version
-        node --version
-        # install dependencies from npmjs
-        run_and_print_on_failure npm ci --prefix "$BASEDIR"/mission-portal/public/scripts/
-        # build react components
-        run_and_print_on_failure npm run build --prefix "$BASEDIR"/mission-portal/public/scripts/
-        # remove node_modules since the bundles are already built
-        run_and_print_on_failure rm -rf "$BASEDIR"/mission-portal/public/scripts/node_modules
-    fi
-)
-
-log_debug "Installing PHP composer dependencies from mission-portal repository..."
-(
-    if test -f "$BASEDIR"/mission-portal/composer.json; then
-        cd "$BASEDIR"/mission-portal
-        # install PHP dependencies from composer
-        run_and_print_on_failure php /usr/bin/composer install --no-dev
-    fi
-)
-
-log_debug "Installing PHP composer dependencies from nova repository..."
-(
-    if test -f "$BASEDIR"/nova/api/http/composer.json; then
-        cd "$BASEDIR"/nova/api/http
-        # install PHP dependencies from composer
-        run_and_print_on_failure php /usr/bin/composer install --no-dev --ignore-platform-reqs
-    fi
-)
-
-log_debug "Compiling Mission Portal styles..."
-(
-    if test -f "$BASEDIR"/mission-portal/public/themes/default/bootstrap/cfengine_theme.less; then
-        cd "$BASEDIR"/mission-portal/public/themes/default/bootstrap
-        run_and_print_on_failure npx -p less lessc --compress ./cfengine_theme.less ./compiled/css/cfengine.less.css
-    fi
-)
-
-log_debug "Installing LDAP API PHP composer dependencies..."
-(
-    if test -f "$BASEDIR"/mission-portal/ldap/composer.json; then
-        cd "$BASEDIR"/mission-portal/ldap
-        # install PHP dependencies from composer
-        run_and_print_on_failure php /usr/bin/composer install --no-dev
-    fi
-)
+thisdir="$(dirname "$0")"
+bash "$thisdir"/build-tarballs
+bash "$thisdir"/bootstrap-mission-portal
diff --git a/build-scripts/build-tarballs b/build-scripts/build-tarballs
new file mode 100755
index 000000000..ac4262f6b
--- /dev/null
+++ b/build-scripts/build-tarballs
@@ -0,0 +1,102 @@
+#!/bin/sh
+
+#
+# This script builds tarballs for core and masterfiles for later use.
+#
+# Build the source tarballs. They are the same whichever platform builds them,
+# so only this image builds them, and nothing else here does.
+#
+# This script looks for two optional env vars:
+# - TARBALLS - if yes, then run this script, otherwise do not. The default is to not run this script.
+#    this variable is provided by build-in-container.py
+# - OUTPUT - optional, for container builds this should be /output. The default is <pwd>/output
+#
+# Additionally, if we are running in a Jenkins job, JOB_NAME will be set and if bootstrap-pr then the script will run fully.
+#
+# Each tarball's timestamps follow its own repository: Makefile.am in core and in
+# masterfiles clamps every mtime in the tarball to SOURCE_DATE_EPOCH, so taking
+# it from the last commit keeps a tarball identical until its own sources change.
+
+# The script expects the following repositories to exist side by side:
+# .
+# ├── buildscripts
+# ├── core
+# └── masterfiles
+# The script can be run as described in the usage message below:
+
+usage() {
+    echo "Usage: [TARBALLS=yes] $0"
+}
+
+. "$(dirname "$0")"/functions
+. detect-environment
+. compile-options
+. version
+set -e
+
+if [ -z "$TARBALLS" ] || [ "$TARBALLS" != "yes" ]; then
+  if [ -z "$JOB_NAME" ] || [ "$JOB_NAME" != "bootstrap-pr" ]; then
+    log_debug "Neither TARBALLS=yes or JOB_NAME=bootstrap-pr was in environment variables so skipping $0"
+    exit 0
+  fi
+fi
+
+if [ -z "$OUTPUT" ]; then
+  OUTPUT="$BASEDIR"/output/tarballs/
+fi
+
+if [ ! -d "$OUTPUT" ]; then
+  log_debug "OUTPUT dir: $OUTPUT does not exist. Creating it now."
+  mkdir -p "$OUTPUT"
+fi
+
+log_debug "OUTPUT dir is $OUTPUT"
+
+(
+  cd "$BASEDIR/core"
+  SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)
+  export SOURCE_DATE_EPOCH
+  log_debug "core SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH"
+  
+  rm -f cfengine-3.*.tar.gz
+
+  log_debug "Writing flag file used by vagrant-pr and testing-pr: $OUTPUT/core-commitID"
+  git rev-parse HEAD > "$OUTPUT"/core-commitID
+
+  # Configure so the dist target exists, undone again below.
+  log_debug "Running ./configure -C in core..."
+  run_and_print_on_failure ./configure -C
+
+  log_debug "Running make dist in core..."
+  run_and_print_on_failure make dist
+
+  mv cfengine-3.*.tar.gz "$OUTPUT"
+
+  log_debug "Running make distclean in core..."
+  run_and_print_on_failure make distclean
+)
+
+(
+  cd "$BASEDIR/masterfiles"
+  SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)
+  export SOURCE_DATE_EPOCH
+  log_debug "masterfiles SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH"
+
+  rm -f cfengine-masterfiles*.tar.gz
+
+  log_debug "Writing flag file used by vagrant-pr and testing-pr: $OUTPUT/masterfiles-commitID"
+  git rev-parse HEAD >"$OUTPUT"/masterfiles-commitID
+
+  log_debug "Running ./configure in masterfiles..."
+  run_and_print_on_failure ./configure
+
+  log_debug "Running make dist in masterfiles..."
+  run_and_print_on_failure make dist        # source tarball:  cfengine-masterfiles-<version>.tar.gz
+
+  log_debug "Running make tar-package in masterfiles..."
+  run_and_print_on_failure make tar-package # package tarball: cfengine-masterfiles-<version>.pkg.tar.gz
+
+  mv cfengine-masterfiles*.tar.gz "$OUTPUT"
+  log_debug "Running make distclean in masterfiles..."
+  run_and_print_on_failure make distclean
+)
diff --git a/build-scripts/canaries.txt b/build-scripts/canaries.txt
new file mode 100644
index 000000000..94d367bb2
--- /dev/null
+++ b/build-scripts/canaries.txt
@@ -0,0 +1,9 @@
+# canary labels
+
+PACKAGES_HUB_x86_64_linux_redhat_8
+
+PACKAGES_HUB_x86_64_linux_ubuntu_22
+
+PACKAGES_x86_64_linux_redhat_7
+
+PACKAGES_x86_64_mingw
diff --git a/build-scripts/compare-versions b/build-scripts/compare-versions
index c17ba4e6c..a0c0d5d75 100755
--- a/build-scripts/compare-versions
+++ b/build-scripts/compare-versions
@@ -54,6 +54,10 @@ fi
 # themselves, however, in my opinion it reads better this way)
 for proj_i in $projects; do
     for proj_j in $projects; do
+        if [ ! -f "$BASEDIR/$proj_i/CFVERSION" ]; then
+            echo "Missing CFVERSION file in $BASEDIR/$proj_i"
+            exit 1
+        fi
         # The CFVERSION file is read into the tr command which removes
         # whitespace and the sed command extracts the major, minor & patch
         # version number from the string.
diff --git a/build-scripts/configure b/build-scripts/configure
index ba88698e3..8cc50f60b 100755
--- a/build-scripts/configure
+++ b/build-scripts/configure
@@ -25,6 +25,12 @@
 . compile-options
 . version
 
+echo "CRAIG debug location of bootstrap-pr output files"
+set -x
+find "$BASEDIR" -name '*.tar.gz'
+set +x
+
+
 # Make sure the PROJECT variable is set correctly
 case "$PROJECT" in
 community)
diff --git a/build-scripts/create-empty-test b/build-scripts/create-empty-test
index e7905f59c..8e5f52dbf 100755
--- a/build-scripts/create-empty-test
+++ b/build-scripts/create-empty-test
@@ -5,6 +5,7 @@
 # test report saying that there were no tests to report.
 
 for repo in core nova; do
+    mkdir -p "$BASEDIR/$repo/tests/unit"
     cat <<EOF >"$BASEDIR/$repo/tests/unit/no_tests.xml"
 <?xml version="1.0" encoding="UTF-8"?>
 <testsuite name="no_tests_to_report">
diff --git a/build-scripts/functions b/build-scripts/functions
index 769b8f55c..95dbd98a3 100644
--- a/build-scripts/functions
+++ b/build-scripts/functions
@@ -75,8 +75,10 @@ export_variables() {
         esac
 
         AUTOBUILD_PATH=$(dirname "$SCRIPTDIR")
-
+    else
+        SCRIPTDIR="$AUTOBUILD_PATH"/build-scripts
     fi
+    export SCRIPTDIR
     BASEDIR=$(dirname "$AUTOBUILD_PATH")
     export BASEDIR
 
diff --git a/build-scripts/generate-pull-request-file b/build-scripts/generate-pull-request-file
new file mode 100755
index 000000000..23680a9fa
--- /dev/null
+++ b/build-scripts/generate-pull-request-file
@@ -0,0 +1,70 @@
+#!/bin/bash
+
+# Get information about PRs among the used revisions.
+# These PRs will have to be notified of build progress.
+#
+# Variables such as MISSION_PORTAL_REV may be set by the CI (Jenkins) to build and test multiple PR's together.
+# The variables typically hold a branch name or a pull request ID.
+# PR IDs can also be preceded by 'pull' or 'origin/pull'.
+# E.g.:
+# - MISSION_PORTAL_REV=pull/1755
+# - MISSION_PORTAL_REV=origin/pull/1755
+# where the trailing number is the pull request ID.
+#
+# Furthermore, they can be suffixed by anything after a subsequent slash (/).
+# We usually use:
+# - ID alone
+# - pull/ID/head
+# - pull/ID/merge
+#
+# This loop fetches information about the PRs if the respective variable is set.
+#
+# The script expects the following repositories to be side by side:
+# .
+# ├── buildscripts
+# ├── core
+# ├── enterprise
+# ├── nova
+# ├── mission-portal
+# ├── libntech
+# └── masterfiles
+#
+# ^ When building community you won't need enterprise, nova, mission-portal
+#
+
+_dir=$(readlink -e "$(dirname "$0")")
+# refactored a few functions into single file scripts for easier development/debugging, see ENT-12741 and ENT-12595
+# Easier to add a path to a script than source a file of functions.
+export PATH="$_dir"/bin:$PATH
+. "$(dirname "$0")"/functions
+. detect-environment
+. compile-options
+. version
+
+# errors are not critical
+set +e
+
+for repo_spec in cfengine/buildscripts cfengine/core cfengine/masterfiles cfengine/enterprise cfengine/nova cfengine/mission-portal NorthernTechHQ/libntech; do
+    # remove organization/ from start of repo_spec
+    # E.g. 'cfengine/mission-portal' -> 'mission-portal'
+    repo="${repo_spec#*/}"
+
+    # Convert to uppercase, swap hyphens with underscore and append '_REV'
+    # E.g. 'mission-portal' -> 'MISSION_PORTAL_REV'
+    rev_param_name="$(echo "$repo" | tr '[:lower:]-' '[:upper:]_')_REV"
+
+    # Try to dereference the result from above and skip the rest of the loop
+    # unless the variable is defined.
+    revision="${!rev_param_name}" || continue
+
+    # remove "origin/" (if any)
+    revision="${revision##origin/}"
+
+    # Check to see if the resolved variable starts with 'pull/'
+    if expr "$revision" : "pull/" >/dev/null; then
+        # Extract the revision number. E.g. 'pull/1755' -> '1755'
+        pr_nr="$(echo "$revision" | cut -d/ -f2)"
+
+        get-github-pull-request-info "$repo_spec" "$pr_nr" >>"$BASEDIR"/output/PRs
+    fi
+done
diff --git a/build-scripts/generate-source-tarballs b/build-scripts/generate-source-tarballs
index e99f6cc67..4c3271a86 100755
--- a/build-scripts/generate-source-tarballs
+++ b/build-scripts/generate-source-tarballs
@@ -26,9 +26,11 @@
 . detect-environment
 . compile-options
 
+cd "$BASEDIR"
+
 for repo in core masterfiles; do
     log_debug "Running target make dist in $repo repository..."
-    (cd $repo && run_and_print_on_failure "$MAKE" V=1 dist)
+    (cd "$repo" && run_and_print_on_failure "$MAKE" V=1 dist)
 done
 
 # Copy to the directory that's being uploaded to buildcache
diff --git a/build-scripts/package b/build-scripts/package
index f98378a49..4d94954da 100755
--- a/build-scripts/package
+++ b/build-scripts/package
@@ -344,12 +344,18 @@ deb)
 
     # Build the DEB package
     log_debug "Building DEB package with dpkg-buildpackage"
+    log_debug "CRAIG debug DEB package location, pwd: $(pwd)"
     log_debug "DEB_BUILD_OPTIONS: $DEB_BUILD_OPTIONS"
     (
         cd "$BASEDIR/$PKG/pkg"
         export DEB_BUILD_OPTIONS="$DEB_BUILD_OPTIONS"
         dpkg-buildpackage -b -us -uc -rfakeroot # -b: binary only, -us/-uc: don't sign
     ) || false
+    log_debug "CRAIG find .deb files in BASEDIR: $BASEDIR"
+set -x
+find "$BASEDIR" -name 'cfengine*.deb'
+set +x
+
 
     # Also create generic TAR package for manual installation
     log_debug "Creating generic TAR package for DEB build"
diff --git a/build-scripts/prepare-results b/build-scripts/prepare-results
index 3903a6fe9..9ed3d4276 100755
--- a/build-scripts/prepare-results
+++ b/build-scripts/prepare-results
@@ -1,4 +1,6 @@
 #!/bin/sh
+set -x
+echo CRAIG DEBUG $0
 
 # Prepare build artifacts and test results for collection/archival.
 # This script collects built packages and test results from various locations
diff --git a/build-scripts/repositories b/build-scripts/repositories
new file mode 100755
index 000000000..2ee171071
--- /dev/null
+++ b/build-scripts/repositories
@@ -0,0 +1,19 @@
+set -ex
+. "$(dirname "$0")"/functions
+
+REPOS="core masterfiles"
+if test "$PROJECT" = "nova"; then
+  REPOS="$REPOS enterprise"
+fi
+if [ "$PROJECT" = "nova" ] && [ "$EXPLICIT_ROLE" = "hub" ]; then
+  REPOS="$REPOS nova mission-portal"
+fi
+
+cd "$BASEDIR"
+
+for repo in $REPOS; do
+  if [ ! -d "$BASEDIR/$repo" ]; then
+    echo "cloning $repo at pwd $(pwd)"
+    git clone git@github.com:cfengine/$repo --recursive
+  fi
+done
diff --git a/build-scripts/revision-file b/build-scripts/revision-file
index c3445f0af..6d35edec5 100755
--- a/build-scripts/revision-file
+++ b/build-scripts/revision-file
@@ -79,8 +79,8 @@ for _dir in $_dirs; do
             echo "$(basename "$0"): Debug: Revision file already exists in $_dir"
         fi
     else
-        echo "$(basename "$0"): Error: Expected to find the '$_dir' directory in '$BASEDIR', but it's not there"
-        exit 1
+        # just a warning below, to enable just building with buildscripts for dependencies only without any other repositories like core, etc.
+        echo "$(basename "$0"): Warning: Expected to find the '$_dir' directory in '$BASEDIR', but it's not there"
     fi
 done
 
diff --git a/build-scripts/test b/build-scripts/test
index 524b67074..114e4c1f1 100755
--- a/build-scripts/test
+++ b/build-scripts/test
@@ -4,14 +4,18 @@
 . detect-environment
 . compile-options
 
-# $NO_TEST and $NO_ACCEPTANCE_TESTS are usually set by Jenkins
+# NO_TESTS and NO_ACCEPTANCE_TESTS are usually set by Jenkins
 if [ "true" = "$NO_TESTS" ] || [ "true" = "$NO_ACCEPTANCE_TESTS" ]; then
     # In order to keep Jenkins happy, we create an empty test report saying that there were no tests to report.
-    log_debug "Creating empty test (\$NO_TESTS=$NO_TEST, \$NO_ACCEPTANCE_TESTS=$NO_ACCEPTANCE_TESTS)"
+    log_debug "Creating empty test (\$NO_TESTS=$NO_TESTS, \$NO_ACCEPTANCE_TESTS=$NO_ACCEPTANCE_TESTS)"
     create-empty-test
     exit 0
 fi
 
+# pre-reqs during a build, clean all packages and re-install from packages built in $HOME/.cache probably
+"$BASEDIR"/buildscripts/build-scripts/clean-buildmachine
+"$BASEDIR"/buildscripts/build-scripts/install-dependencies
+
 if [ -n "$TEST_MACHINE" ]; then
     # Prepares the test machine by creating a chroot environment.
     log_debug "Preparing test machine"
diff --git a/build-scripts/unpack-tarballs b/build-scripts/unpack-tarballs
index bb67aa9af..f43606dd2 100755
--- a/build-scripts/unpack-tarballs
+++ b/build-scripts/unpack-tarballs
@@ -28,8 +28,26 @@
 . detect-environment
 . compile-options
 
-SOURCE_TARBALL="$BASEDIR/output/tarballs/cfengine-3.*.tar.gz"
+if [ ! -d "$BASEDIR"/output/tarballs ]; then
+  echo "No $BASEDIR/output/tarballs so skipping $0"
+  exit 0
+fi
+
+log_debug "CRAIG DEBUG location of tarballs..."
+set -x
+find "$BASEDIR" -name '*.tar.gz'
+set +x
+
+SOURCE_TARBALL="$(ls $BASEDIR/output/tarballs/cfengine-3.*.tar.gz)"
+echo "CRAIG found SOURCE_TARBALL=$SOURCE_TARBALL"
+
 MASTERFILES_TARBALL=$(find "$BASEDIR"/output/tarballs/ -name 'cfengine-masterfiles*.tar.gz' -a ! \( -name '*pkg.tar.gz' \))
+echo "CRAIG found MASTERFILES_TARBALL=$MASTERFILES_TARBALL"
+
+if [ ! -f "$SOURCE_TARBALL" ] || [ ! -f "$MASTERFILES_TARBALL" ]; then
+    echo "Did not find SOURCE_TARBALL: $SOURCE_TARBALL or MASTERFILES_TARBALL: $MASTERFILES_TARBALL so skipping $0 script"
+    exit 0
+fi
 
 # DELETE the git-checked-out directories, they are tainted with
 # ./configure artifacts anyway.  The tarballs are unpacked and symlinked
diff --git a/build-scripts/version b/build-scripts/version
index d1f392e1f..9026569bf 100644
--- a/build-scripts/version
+++ b/build-scripts/version
@@ -19,11 +19,11 @@
 # repository. The script is executed when you run the autogen.sh.
 CORE_VERSION=$(cat "$BASEDIR"/core/CFVERSION)
 VERSION="${EXPLICIT_VERSION:-$CORE_VERSION}"
-echo "$(basename $0): Debug: Detected CFEngine version number $VERSION"
+log_debug "Detected CFEngine version number $VERSION"
 
 # The RELEASE number is the actual release of the package. It starts as 1 and
 # would incremented each time you create a new release of the CFEngine package
 # of the same version.
 RELEASE="${EXPLICIT_RELEASE:-1}"
 export RELEASE
-echo "$(basename $0): Debug: Detected CFEngine package release number $RELEASE"
+log_debug "Detected CFEngine package release number $RELEASE"
diff --git a/ci/cfengine-build-host-setup.cf b/ci/cfengine-build-host-setup.cf
index ceb93eb10..a54f1c0af 100644
--- a/ci/cfengine-build-host-setup.cf
+++ b/ci/cfengine-build-host-setup.cf
@@ -36,7 +36,10 @@ bundle agent cfengine_build_host_setup
       "ntp";
 
     debian|ubuntu::
-      "fail2ban" comment => "Ban IPs with repeated failed SSH auth attempts";
+      "fail2ban"
+        comment => "Ban IPs with repeated failed SSH auth attempts",
+        if => "not_in_container";
+
       "libltdl7" package_policy => "delete";
       "libltdl-dev" package_policy => "delete";
       "binutils";
@@ -176,10 +179,11 @@ bundle agent cfengine_build_host_setup
 
     !(redhat_7|centos_7).(redhat|centos).(yum_dnf_conf_ok).epel_release_ok::
       "fail2ban-server"
-        comment => "Ban IPs with repeated failed SSH auth attempts. On centos/rhel 8+ we must specify individual packages instead of just fail2ban as package method will append -*.* which would include conflicting shorewall and shorewall-lite packages.";
+        comment => "Ban IPs with repeated failed SSH auth attempts. On centos/rhel 8+ we must specify individual packages instead of just fail2ban as package method will append -*.* which would include conflicting shorewall and shorewall-lite packages.",
+        if => "not_in_container";
 
-      "fail2ban-sendmail";
-      "fail2ban-firewalld";
+      "fail2ban-sendmail" if => "not_in_container";
+      "fail2ban-firewalld" if => "not_in_container";
       "ccache";
       "fakeroot";
       "perl-JSON-PP";
@@ -277,7 +281,6 @@ bundle agent cfengine_build_host_setup
       "not_in_container"
         expression => not(fileexists("/etc/cfengine-in-container.flag")),
         comment => "We use an explicit flag file that we control to avoid ambiguity about whether we are in a container or not.";
-
 @if minimum_version(3.23)
     # Rust is build dependency for leech2 (gate on ubuntu>=20, debian>=12, redhat>=7)
     ubuntu::
@@ -292,7 +295,6 @@ bundle agent cfengine_build_host_setup
       "leech2_build_toolchain_host"
         expression => version_compare("$(sys.os_version_major)", ">=", "7");
 @endif
-
     any::
       "have_rust" expression => fileexists("/opt/rust/bin/rustc");
       "have_protoc" expression => fileexists("/usr/local/bin/protoc");
@@ -381,11 +383,12 @@ bundle agent cfengine_build_host_setup
         comment => "note: centos-7 has installed instead of --installed argument, and that works on rhel-8 and rhel-9 so go with the sub-command instead of option";
 
   commands:
-    sshd_hardened::
+    sshd_hardened.not_in_container::
       'kill -1 $(pgrep -f "sshd -D")'
         handle => "sshd_restarted",
         contain => in_shell,
         comment => "Reload sshd config with SIGHUP(1) to apply hardened configuration";
+
     have_tmp_mount::
       "mount -o remount,size=5G /tmp"
         comment => "We could check if /tmp was size 5G but not worth the trouble since this remount call just sets the maximum size of the tmpfs in virtual memory.",
@@ -513,6 +516,7 @@ root - core unlimited
         );
 
       "/etc/fail2ban/jail.local"
+        if => "not_in_container",
         create => "true",
         content => "[sshd]
 enabled = true
@@ -524,6 +528,7 @@ findtime = 600",
         comment => "Configure fail2ban to ban IPs after 5 failed SSH attempts within 10 minutes";
 
       "$(sshd_config_files)"
+        if => "not_in_container",
         edit_line => comment_lines_matching(
           "^$(sshd_hardening_directives)\s+(?!no\s*$).*", "#"
         ),
@@ -532,7 +537,7 @@ findtime = 600",
 
       "/etc/ssh/sshd_config"
         edit_line => prepend_if_no_line("$(sshd_hardening_directives) no"),
-        if => fileexists("/etc/ssh/sshd_config"),
+        if => and("not_in_container", fileexists("/etc/ssh/sshd_config")),
         classes => if_repaired("sshd_hardened"),
         comment => "Ensure SSH hardening directives are at the top of sshd_config, before any Include";
 
@@ -642,7 +647,7 @@ jenkins ALL=NOPASSWD: /usr/bin/podman
     !have_sys_user.(suse|sles|opensuse)::
       "useradd -u 3 sys -g sys" contain => in_shell;
 
-    linux::
+    linux.not_in_container::
       "sshd -T 2>/dev/null | grep -qiE '^PermitRootLogin no'"
         depends_on => { "sshd_restarted" },
         contain => in_shell,
@@ -659,12 +664,12 @@ jenkins ALL=NOPASSWD: /usr/bin/podman
         comment => "Verify KbdInteractiveAuthentication (OpenSSH 8.7+) or ChallengeResponseAuthentication (older) is disabled";
 
   services:
-    any::
+    not_in_container::
       "fail2ban"
         service_policy => "start",
         comment => "Ensure fail2ban is running";
 
-    fail2ban_config_changed::
+    fail2ban_config_changed.not_in_container::
       "fail2ban"
         service_policy => "restart",
         comment => "Restart fail2ban to apply jail configuration";
diff --git a/ci/setup-cfengine-build-host.sh b/ci/setup-cfengine-build-host.sh
index 9bf06059c..bd259e1d4 100755
--- a/ci/setup-cfengine-build-host.sh
+++ b/ci/setup-cfengine-build-host.sh
@@ -8,6 +8,11 @@ if [ -n "$cfengine_role" ]; then
     touch /etc/cfengine-"$cfengine_role".flag
 fi
 
+if uname | grep -i darwin >/dev/null; then
+  echo "Error: MacOS(Darwin) not supported yet."
+  exit 1
+fi
+
 # install needed packages and software for a build host
 set -e
 if [ "$(id -u)" != "0" ]; then
@@ -62,7 +67,7 @@ function cleanup() {
     set -e
     set -x
     [ -f /var/log/messages ] && tail /var/log/messages
-    command -v journalctl >/dev/null && journalctl | grep -P '(error|fail)'
+    command -v journalctl >/dev/null && journalctl | grep -P '(error|fail)' || true
     if command -v apt >/dev/null 2>&1; then
         # workaround for CFE-4544, remove scriptlets call systemctl even when systemctl is-system-running returns false
         # Replace systemctl with a no-op stub that always succeeds. We can't
diff --git a/ci/setup-ci-host.sh b/ci/setup-ci-host.sh
index b646fb9d5..d0a71aa89 100755
--- a/ci/setup-ci-host.sh
+++ b/ci/setup-ci-host.sh
@@ -27,14 +27,20 @@ function file-line()
 
 function github-known-hosts()
 {
-  echo "ensuring github hostkeys are added to /home/jenkins/.ssh/known_hosts"
+  mkdir ~/.ssh
+  echo "ensuring github hostkeys are added to ~/.ssh/known_hosts"
   grep '^github.com' "$thisdir"/known_hosts | while read -r key; do
-    file-line /home/jenkins/.ssh/known_hosts "$key"
+    file-line ~/.ssh/known_hosts "$key"
   done
-  chown jenkins /home/jenkins/.ssh/known_hosts
-  chmod 0600 /home/jenkins/.ssh/known_hosts
+  chown $(id -un) ~/.ssh/known_hosts
+  chmod 0600 ~/.ssh/known_hosts
 }
 
+if [ "$1" = "--bootstrap" ]; then
+  # todo, setup needed dependencies for a bootstrap host
+  exit 0
+fi
+
 echo "ensuring that github.com hostkeys are in ~/.ssh/known_hosts"
 github-known-hosts
 
diff --git a/container/Dockerfile.debian b/container/Dockerfile.debian
index bc139e0f9..ee9be9321 100644
--- a/container/Dockerfile.debian
+++ b/container/Dockerfile.debian
@@ -44,6 +44,9 @@ RUN /tmp/linux-install-rust.sh
 RUN useradd -m -s /bin/bash builder \
     && echo "builder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/builder
 
+# let setup-cfengine-build-host.sh know that we are in a container
+RUN touch /etc/cfengine-in-container.flag
+
 USER builder
 WORKDIR /home/builder
 
diff --git a/container/Dockerfile.mingw b/container/Dockerfile.mingw
index a8b9faec9..7982b5fd7 100644
--- a/container/Dockerfile.mingw
+++ b/container/Dockerfile.mingw
@@ -38,6 +38,9 @@ RUN /tmp/linux-install-rust.sh x86_64-pc-windows-gnu
 RUN useradd -m -s /bin/bash builder \
     && echo "builder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/builder
 
+# Let setup-cfengine-build-host.sh know we are in a container
+RUN touch /etc/cfengine-in-container.flag
+
 USER builder
 WORKDIR /home/builder
 
diff --git a/container/Dockerfile.rhel b/container/Dockerfile.rhel
index 12d5a2179..4d82a419d 100644
--- a/container/Dockerfile.rhel
+++ b/container/Dockerfile.rhel
@@ -59,6 +59,9 @@ RUN if [ -n "${EXTRA_PKGS}" ]; then dnf install -y ${EXTRA_PKGS} && dnf clean al
 RUN useradd -m -s /bin/bash builder \
     && echo "builder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/builder
 
+# let setup-cfengine-build-host.sh know we are in a container
+RUN touch /etc/cfengine-in-container.flag
+
 USER builder
 WORKDIR /home/builder
 
diff --git a/container/Dockerfile.rhel7 b/container/Dockerfile.rhel7
index eb61542af..cadf71d8d 100644
--- a/container/Dockerfile.rhel7
+++ b/container/Dockerfile.rhel7
@@ -51,6 +51,9 @@ RUN /tmp/linux-install-rust.sh
 RUN useradd -m -s /bin/bash builder \
     && echo "builder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/builder
 
+# let setup-cfengine-build-host.sh know we are in a container
+RUN touch /etc/cfengine-in-container.flag
+
 USER builder
 WORKDIR /home/builder
 
diff --git a/container/Dockerfile.tarballs b/container/Dockerfile.tarballs
index 0a06d2121..c040039e2 100644
--- a/container/Dockerfile.tarballs
+++ b/container/Dockerfile.tarballs
@@ -28,6 +28,10 @@ RUN apt-get -qy update && apt-get -y install \
 RUN useradd -m -s /bin/bash builder \
     && echo "builder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/builder
 
+# let setup-cfengine-build-host.sh know we are in a container and bootstrapping
+RUN touch /etc/cfengine-in-container.flag
+RUN touch /etc/cfengine-bootstrap-pr-host.flag
+
 USER builder
 WORKDIR /home/builder