It turns out that koji builders can't access kojipkgs.fedoraproject.org over https, but plain http works just fine.
... and make it a top-level script wrapped in %post ... %end.