From 0144546973a9c87f3c82e0e4c6bf1ef0a178d0e5 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Fri, 23 Oct 2026 22:29:01 +1100
Subject: [PATCH] Add Makefile and RPM packaging

---
 .gitignore           |  1 +
 Makefile             | 52 ++++++++++++++++++++++++++++++++++++++++++++
 packaging/nfpm.yaml  | 24 ++++++++++++++++++++
 scripts/build-rpm.sh | 16 ++++++++++++++
 4 files changed, 93 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 Makefile
 create mode 100644 packaging/nfpm.yaml
 create mode 100755 scripts/build-rpm.sh

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..849ddff
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+dist/
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..eb90071
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,52 @@
+IMAGE        := localhost/agent-sandbox:dev
+ROUTER_IMAGE := localhost/agent-sandbox-router:dev
+VERSION      := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+SHELL_FILES  := agent-sandbox router/start.sh router/forwarder tests/test.sh scripts/build-rpm.sh
+
+.PHONY: all build test lint pre-commit rpm clean patch minor major _tag
+
+all: build
+
+# Local images; the in-repo launcher (VERSION=dev) runs these by default.
+build:
+	podman build --format docker -t $(IMAGE) .
+	podman build --format docker -t $(ROUTER_IMAGE) router
+
+test:
+	tests/test.sh
+
+lint:
+	uvx --from shellcheck-py shellcheck $(SHELL_FILES)
+	uvx --from hadolint-py hadolint Containerfile router/Containerfile
+
+pre-commit:
+	@uvx pre-commit run --all-files
+
+rpm:
+	./scripts/build-rpm.sh $(VERSION)
+
+clean:
+	rm -rf dist
+
+# Bump helpers — reads the latest semver tag and creates the next one.
+# If no tag exists yet, starts from v0.0.0.
+_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
+_BASE   := $(if $(_LATEST),$(_LATEST),v0.0.0)
+_MAJ    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1)
+_MIN    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2)
+_PAT    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3)
+
+patch:
+	@NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+minor:
+	@NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+major:
+	@NEW=v$(shell expr $(_MAJ) + 1).0.0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+_tag:
+	git push origin $(TAG)
diff --git a/packaging/nfpm.yaml b/packaging/nfpm.yaml
new file mode 100644
index 0000000..03c90d7
--- /dev/null
+++ b/packaging/nfpm.yaml
@@ -0,0 +1,24 @@
+# Rendered through envsubst by scripts/build-rpm.sh.
+name: agent-sandbox
+version: ${PACKAGE_VERSION}
+release: 1
+arch: noarch
+platform: linux
+description: "Run Claude Code in a rootless podman sandbox with allowlisted egress"
+maintainer: Ben Vincent <ben@unkin.net>
+homepage: https://git.unkin.net/unkin/agent-sandbox
+license: MIT
+
+depends:
+  - podman
+  - bash
+
+contents:
+  - src: dist/agent-sandbox
+    dst: /usr/bin/agent-sandbox
+    file_info:
+      mode: 0755
+  - src: allowed-hosts
+    dst: /usr/share/agent-sandbox/allowed-hosts
+    file_info:
+      mode: 0644
diff --git a/scripts/build-rpm.sh b/scripts/build-rpm.sh
new file mode 100755
index 0000000..95d3f6e
--- /dev/null
+++ b/scripts/build-rpm.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Package the launcher and default allowlist into an RPM with nfpm. The
+# packaged launcher defaults to the published images for this version.
+# Usage: scripts/build-rpm.sh [version]   (defaults to $CI_COMMIT_TAG)
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+TAG="${1:-${CI_COMMIT_TAG:-v0.0.0-dev}}"
+mkdir -p dist
+sed "s/^VERSION=dev$/VERSION=$TAG/" agent-sandbox >dist/agent-sandbox
+grep -q "^VERSION=$TAG$" dist/agent-sandbox
+
+export PACKAGE_VERSION="${TAG#v}"
+envsubst <packaging/nfpm.yaml >dist/nfpm.yaml
+nfpm pkg --config dist/nfpm.yaml --target dist --packager rpm
+ls -1 dist/*.rpm