Add Makefile and RPM packaging

.gitignore

@@ -0,0 +1 @@
+dist/

Makefile

@@ -0,0 +1,52 @@
+IMAGE        := localhost/agent-sandbox:dev
+ROUTER_IMAGE := localhost/agent-sandbox-router:dev
+VERSION      := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+SHELL_FILES  := agent-sandbox router/start.sh router/forwarder tests/test.sh scripts/build-rpm.sh
+
+.PHONY: all build test lint pre-commit rpm clean patch minor major _tag
+
+all: build
+
+# Local images; the in-repo launcher (VERSION=dev) runs these by default.
+build:
+	podman build --format docker -t $(IMAGE) .
+	podman build --format docker -t $(ROUTER_IMAGE) router
+
+test:
+	tests/test.sh
+
+lint:
+	uvx --from shellcheck-py shellcheck $(SHELL_FILES)
+	uvx --from hadolint-py hadolint Containerfile router/Containerfile
+
+pre-commit:
+	@uvx pre-commit run --all-files
+
+rpm:
+	./scripts/build-rpm.sh $(VERSION)
+
+clean:
+	rm -rf dist
+
+# Bump helpers — reads the latest semver tag and creates the next one.
+# If no tag exists yet, starts from v0.0.0.
+_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
+_BASE   := $(if $(_LATEST),$(_LATEST),v0.0.0)
+_MAJ    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1)
+_MIN    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2)
+_PAT    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3)
+
+patch:
+	@NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+minor:
+	@NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+major:
+	@NEW=v$(shell expr $(_MAJ) + 1).0.0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+_tag:
+	git push origin $(TAG)

packaging/nfpm.yaml

@@ -0,0 +1,24 @@
+# Rendered through envsubst by scripts/build-rpm.sh.
+name: agent-sandbox
+version: ${PACKAGE_VERSION}
+release: 1
+arch: noarch
+platform: linux
+description: "Run Claude Code in a rootless podman sandbox with allowlisted egress"
+maintainer: Ben Vincent <ben@unkin.net>
+homepage: https://git.unkin.net/unkin/agent-sandbox
+license: MIT
+
+depends:
+  - podman
+  - bash
+
+contents:
+  - src: dist/agent-sandbox
+    dst: /usr/bin/agent-sandbox
+    file_info:
+      mode: 0755
+  - src: allowed-hosts
+    dst: /usr/share/agent-sandbox/allowed-hosts
+    file_info:
+      mode: 0644

scripts/build-rpm.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Package the launcher and default allowlist into an RPM with nfpm. The
+# packaged launcher defaults to the published images for this version.
+# Usage: scripts/build-rpm.sh [version]   (defaults to $CI_COMMIT_TAG)
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+TAG="${1:-${CI_COMMIT_TAG:-v0.0.0-dev}}"
+mkdir -p dist
+sed "s/^VERSION=dev$/VERSION=$TAG/" agent-sandbox >dist/agent-sandbox
+grep -q "^VERSION=$TAG$" dist/agent-sandbox
+
+export PACKAGE_VERSION="${TAG#v}"
+envsubst <packaging/nfpm.yaml >dist/nfpm.yaml
+nfpm pkg --config dist/nfpm.yaml --target dist --packager rpm
+ls -1 dist/*.rpm