test/dev-cmd/bottle: Mark the bottling test as needs_network

[issyl0]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew typecheck with your changes locally?
• Have you successfully run brew tests with your changes locally?

---

• I was on a plane and this failed with:

expected block to not output to stderr, but output
"curl: (6) Could not resolve host: spdx.github.io\nWarning: Failed to fetch SBOM schema, cannot perform SBOM validation!
Warning: Could not fetch JSON schema to validate SBOM!\nWarning: SBOM is not valid, not writing to disk!"

[apainintheneck]

This reminds me that maybe periodically, every week or two, running the test suite in a network isolated environment might be useful to catch these sorts of things quicker.

[Bo98]

Realistically, how often does that file we're downloading change? Seems like something we can vendor like we do for the SPDX license list.

Any breaking changes to the schema would likely require changes on our side but because the latest schema is downloaded it would produce an error for everyone immediately.

For OCI schemas, we at least have them as versioned URLs.

[MikeMcQuaid]

Realistically, how often does that file we're downloading change? Seems like something we can vendor like we do for the SPDX license list.

Yes, we should do this.

For OCI schemas, we at least have them as versioned URLs.

I'm open to changing this however you think is best.