nappelin mirror: blobs by sha256, read-only