M3b review fixes by the design model: curl --globoff, podman --pull=never

Review findings 1 and 2, both plan defects. curl gains --globoff and a leading --disable; both podman runs gain --pull=never. The given fetch.rs and the six golden files change with them. Checked on straylight with a rebuilt image: a glob URL is one request, a missing image fails at once. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-23 15:25:51 -07:00
parent 75c2f1adbf
commit c3aaecdae2
19 changed files with 37 additions and 5 deletions
@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7-egress
 --label=boxmaker=egress
 --network=pasta
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges
@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges
@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges
@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges
@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges
@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges
@@ -39,8 +39,10 @@ fn args() -> HttpFetchArgs {
 #[test]
 fn the_argument_list_is_fixed_and_ends_with_the_url() {
    let expected: Vec<&str> = vec![
+        "--disable",
        "--silent",
        "--show-error",
+        "--globoff",
        "--proto",
        "=https",
        "--proto-redir",