Add Makefile and RPM packaging

scripts/build-rpm.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Package the launcher and default allowlist into an RPM with nfpm. The
+# packaged launcher defaults to the published images for this version.
+# Usage: scripts/build-rpm.sh [version]   (defaults to $CI_COMMIT_TAG)
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+TAG="${1:-${CI_COMMIT_TAG:-v0.0.0-dev}}"
+mkdir -p dist
+sed "s/^VERSION=dev$/VERSION=$TAG/" agent-sandbox >dist/agent-sandbox
+grep -q "^VERSION=$TAG$" dist/agent-sandbox
+
+export PACKAGE_VERSION="${TAG#v}"
+envsubst <packaging/nfpm.yaml >dist/nfpm.yaml
+nfpm pkg --config dist/nfpm.yaml --target dist --packager rpm
+ls -1 dist/*.rpm