I guess I'm hitting a bug in a new curl. (I installed curl so I could install pants; I normally use wget). Curl version on fails is

7.76.1

. If I snap remove curl, apt install curl, I get an older version

7.68.0

. That older version works. ...and when I get the latest curl version

7.77

from the curl site, it works. So I guess I just had unlucky timing when I got curl. Sorry for the noise, folks.

I think it's more likely that the problem curl was installed in a snap. Those can have very restrictive capabilities by design. You may have needed to install the snap in

--devmode

or else done more fine grained tweaking.

--devmode works, yay. Looks like the official answer is to wait a few whiles for someone to flip a permissions switch, then install with --classic: https://github.com/woutervb/snap-curl/issues/2