build: Add curl to packaging images (#8024)

package/Dockerfile

@@ -2,13 +2,6 @@ ARG BASE_IMAGE=debian:bookworm
 
 FROM ${BASE_IMAGE}
 
-# Packaging runs in a vanilla distro image, so the tooling has to come
-# from the distro's archive: debhelper for deb, rpm-build (and the
-# systemd / find-debuginfo macros it depends on) for rpm.
-# The container also uses git (real history) for
-# build_pkg.sh's SOURCE_DATE_EPOCH; otherwise it falls back to a tarball
-# download and the timestamp comes from wall-clock time.
-
 COPY package/install-packaging-tools.sh /tmp/install-packaging-tools.sh
 
 RUN /tmp/install-packaging-tools.sh

package/install-packaging-tools.sh

@@ -22,12 +22,23 @@ case "${ID}" in
         ;;
 esac
 
+# Packaging runs in a vanilla distro image, so the tooling comes from the distro's
+# archive rather than from nixpkgs:
+#
+#   - debhelper and dpkg-dev build the DEB
+#   - rpm-build builds the RPM, with systemd-rpm-macros and redhat-rpm-config
+#     supplying the systemd and find-debuginfo macros the spec uses
+#   - git gives build_pkg.sh a real history to read SOURCE_DATE_EPOCH from;
+#     without one the timestamp falls back to the wall clock
+#   - curl uploads the finished packages in publish_pkg.sh
+#   - ca-certificates lets curl and git verify TLS
 function install() {
     case "${ID}" in
         debian | ubuntu)
             apt-get update -y
             apt-get install -y --no-install-recommends \
                 ca-certificates \
+                curl \
                 debhelper \
                 debhelper-compat \
                 dpkg-dev \
@@ -36,6 +47,7 @@ function install() {
 
         rhel | centos | rocky | almalinux)
             dnf install -y --setopt=install_weak_deps=False \
+                curl-minimal \
                 git \
                 rpm-build \
                 redhat-rpm-config \