So this is a weird one. I'd previously grabbed some code from a git repository. But recently when I went to update it, I got an error
fatal: unable to connect to github.com:
github.com[0: 140.82.118.4]: errno=Connection refused
github.com[1: 140.82.118.3]: errno=Connection refused
Uh-oh. Thinking it might be a transient error, I left it for a while. But then when I got the report from my firewall logs, I saw some outbound connection attempts which it was blocking.
Nov 15 12:20:42 DST=140.82.118.4 PROTO=TCP DPT=9418
Nov 15 12:20:43 DST=140.82.118.4 PROTO=TCP DPT=9418
Nov 15 12:20:43 DST=140.82.118.3 PROTO=TCP DPT=9418
So googling around I saw that this port was related to a proprietary git protocol, and then I connected the two events. So apparently the last time I checked out the code, it had used the default git protocol. Then I installed a firewall with egress filtering on the server, so now it was blocking the connection attempts. One solution would be to add tcp/9418 to my firewall rules, but there was actually a simpler way. From the code directory I edited the .git/config file and changed the url= line:
[remote "origin"]
url = https://github.com/repo/repo.git
# url = git://github.com/repo/repo.git
And now my git pull works again.