From 0a0b20731e899a745be2cd4a2ea9e892503a4aed Mon Sep 17 00:00:00 2001
From: David Given <dg@cowlark.com>
Date: Mon, 21 Sep 2026 14:29:19 +0000
Subject: [PATCH 01/11] Merge extra dependencies in jpackage invocations.

---
 java/com/cowlark/fluxengine/BUILD.bazel |  1 +
 scripts/jpackage.bzl                    | 38 ++++++++++++++++++++++---
 2 files changed, 35 insertions(+), 4 deletions(-)

diff --git a/java/com/cowlark/fluxengine/BUILD.bazel b/java/com/cowlark/fluxengine/BUILD.bazel
index 27c681c9..bc092758 100644
--- a/java/com/cowlark/fluxengine/BUILD.bazel
+++ b/java/com/cowlark/fluxengine/BUILD.bazel
@@ -68,6 +68,7 @@ jpackage(
     app_version = "1.0.0",
     stamp = True,
     extra_launchers = [":fluxengine-gui.properties"],
+    extra_jars = ["@maven//:io_github_dsheirer_libusb4java_darwin_aarch64"],
     jar = ":fluxengine_deploy.jar",
     launcher_icon = select({
         "@platforms//os:osx": "//extras:fluxengine_icns",
diff --git a/scripts/jpackage.bzl b/scripts/jpackage.bzl
index 2fccb11c..6487ab81 100644
--- a/scripts/jpackage.bzl
+++ b/scripts/jpackage.bzl
@@ -66,6 +66,13 @@ def _jpackage_impl(ctx):
     else:
         out = ctx.actions.declare_file(ctx.attr.package_name + "_" + ctx.attr.app_version + "." + extension)
     launchers = _launcher_properties(ctx)
+    merge_extra_jars = "\n".join([
+        '            (cd workdir/native && "{jar_tool}" xf "{jar}")'.format(
+            jar_tool = java_runtime.java_home + "/bin/jar",
+            jar = extra_jar.path,
+        )
+        for extra_jar in ctx.files.extra_jars
+    ])
 
     # jpackage writes a lot of scratch state (a jlink runtime image and an app
     # image) and chmods files in it. Do all the scratch work in a plain
@@ -91,14 +98,18 @@ def _jpackage_impl(ctx):
     stamp_inputs = [ctx.info_file] if ctx.attr.stamp else []
     ctx.actions.run_shell(
         outputs = [out],
-        inputs = [jar] + [f for (_, f) in launchers] +\
+        inputs = [jar] + ctx.files.extra_jars + [f for (_, f) in launchers] +\
                  ([ctx.file.launcher_icon] if ctx.file.launcher_icon else []) + stamp_inputs,
         tools = [java_runtime.files],
         use_default_shell_env = True,
         command = """
             rm -rf workdir
-            mkdir -p workdir/input workdir/tmp workdir/dest workdir/home workdir/rpmbuild workdir/resources
+            mkdir -p workdir/input workdir/native workdir/tmp workdir/dest workdir/home workdir/rpmbuild workdir/resources
             cp -L "{jar}" workdir/input/
+{merge_extra_jars}
+            if [ -n "$(find workdir/native -type f -print -quit)" ]; then
+                "{jar_tool}" uf "workdir/input/{main_jar}" -C workdir/native .
+            fi
             chmod u+w workdir/input/*
             printf '[Desktop Entry]\\nName=FluxEngine\\nComment=FluxEngine\\nExec=APPLICATION_LAUNCHER\\nIcon=APPLICATION_ICON\\nTerminal=false\\nType=Application\\nCategories=DEPLOY_BUNDLE_CATEGORY\\n' > workdir/resources/fluxengine-gui.desktop
             if [ "{package_type}" = "rpm" ]; then
@@ -145,6 +156,8 @@ def _jpackage_impl(ctx):
             info_file = ctx.info_file.path if ctx.attr.stamp else "",
             jar = jar.path,
             main_jar = jar.basename,
+            jar_tool = java_runtime.java_home + "/bin/jar",
+            merge_extra_jars = merge_extra_jars,
             main_class = ctx.attr.main_class,
             add_launcher_args = _add_launcher_args(launchers),
             out = out.path,
@@ -167,6 +180,13 @@ def _jpackage_app_image_impl(ctx):
     else:
         out = ctx.actions.declare_file(ctx.attr.package_name + "_" + ctx.attr.app_version + ".tar.xz")
     launchers = _launcher_properties(ctx)
+    merge_extra_jars = "\n".join([
+        '            (cd workdir/native && "{jar_tool}" xf "{jar}")'.format(
+            jar_tool = java_runtime.java_home + "/bin/jar",
+            jar = extra_jar.path,
+        )
+        for extra_jar in ctx.files.extra_jars
+    ])
 
     # jpackage --type app-image writes a directory (with a jlink runtime image
     # and the app launcher) and chmods files in it. Do the scratch work in a
@@ -180,14 +200,18 @@ def _jpackage_app_image_impl(ctx):
     stamp_inputs = [ctx.info_file] if ctx.attr.stamp else []
     ctx.actions.run_shell(
         outputs = [out],
-        inputs = [jar] + [f for (_, f) in launchers] +\
+        inputs = [jar] + ctx.files.extra_jars + [f for (_, f) in launchers] +\
                  ([ctx.file.launcher_icon] if ctx.file.launcher_icon else []) + stamp_inputs,
         tools = [java_runtime.files],
         use_default_shell_env = True,
         command = """
             rm -rf workdir
-            mkdir -p workdir/input workdir/tmp workdir/dest workdir/home workdir/resources
+            mkdir -p workdir/input workdir/native workdir/tmp workdir/dest workdir/home workdir/resources
             cp -L "{jar}" workdir/input/
+{merge_extra_jars}
+            if [ -n "$(find workdir/native -type f -print -quit)" ]; then
+                "{jar_tool}" uf "workdir/input/{main_jar}" -C workdir/native .
+            fi
             chmod u+w workdir/input/*
             printf '[Desktop Entry]\nName=FluxEngine\nComment=FluxEngine\nExec=APPLICATION_LAUNCHER\nIcon=APPLICATION_ICON\nTerminal=false\nType=Application\nCategories=DEPLOY_BUNDLE_CATEGORY\n' > workdir/resources/fluxengine-gui.desktop
             TMPDIR="$(pwd)/workdir/tmp"
@@ -224,6 +248,8 @@ def _jpackage_app_image_impl(ctx):
             info_file = ctx.info_file.path if ctx.attr.stamp else "",
             jar = jar.path,
             main_jar = jar.basename,
+            jar_tool = java_runtime.java_home + "/bin/jar",
+            merge_extra_jars = merge_extra_jars,
             main_class = ctx.attr.main_class,
             add_launcher_args = _add_launcher_args(launchers),
             out = out.path,
@@ -248,6 +274,10 @@ _jpackage_attrs = {
         doc = "jpackage launcher properties files; " +
               "each launcher is named after the file (minus its .properties suffix).",
     ),
+    "extra_jars": attr.label_list(
+        allow_files = [".jar"],
+        doc = "Additional runtime JARs copied beside the main application JAR.",
+    ),
     "launcher_icon": attr.label(
         allow_single_file = [".png", ".ico", ".icns"],
         doc = "Icon for all launchers, added to each launcher's " +

From 084e1f7698b51350a819cc58f55b5f81a4297716 Mon Sep 17 00:00:00 2001
From: David Given <dg@cowlark.com>
Date: Mon, 21 Sep 2026 14:41:46 +0000
Subject: [PATCH 02/11] Typo fix.

---
 MODULE.bazel | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MODULE.bazel b/MODULE.bazel
index 5331a7ab..66884d52 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -19,6 +19,7 @@ maven.install(
         "com.jayway.jsonpath:json-path:3.0.0",
         "junit:junit:4.13.2",
         "org.usb4java:usb4java:1.3.0",
+        "io.github.dsheirer:libusb4java-darwin-aarch64:1.3.1",
         "com.formdev:flatlaf:3.7.2",
         "com.formdev:flatlaf-swingx:3.7.2",
         "org.exbin.bined:bined-core:0.2.2",

From 732d2a05140f51ee4d84df7f8e4e362704d1bb8b Mon Sep 17 00:00:00 2001
From: David Given <dg@cowlark.com>
Date: Mon, 21 Sep 2026 15:47:11 +0000
Subject: [PATCH 03/11] Another try at fixing the OSX ARM builds.

---
 scripts/jpackage.bzl | 28 ++++++++++++----------------
 1 file changed, 12 insertions(+), 16 deletions(-)

diff --git a/scripts/jpackage.bzl b/scripts/jpackage.bzl
index 6487ab81..3c06b15f 100644
--- a/scripts/jpackage.bzl
+++ b/scripts/jpackage.bzl
@@ -66,8 +66,9 @@ def _jpackage_impl(ctx):
     else:
         out = ctx.actions.declare_file(ctx.attr.package_name + "_" + ctx.attr.app_version + "." + extension)
     launchers = _launcher_properties(ctx)
-    merge_extra_jars = "\n".join([
-        '            (cd workdir/native && "{jar_tool}" xf "{jar}")'.format(
+    stage_extra_jars = "\n".join([
+        ('            cp -L "{jar}" workdir/input/\n'
+         '            (cd workdir/input && "{jar_tool}" xf "{jar}")').format(
             jar_tool = java_runtime.java_home + "/bin/jar",
             jar = extra_jar.path,
         )
@@ -104,12 +105,9 @@ def _jpackage_impl(ctx):
         use_default_shell_env = True,
         command = """
             rm -rf workdir
-            mkdir -p workdir/input workdir/native workdir/tmp workdir/dest workdir/home workdir/rpmbuild workdir/resources
+            mkdir -p workdir/input workdir/tmp workdir/dest workdir/home workdir/rpmbuild workdir/resources
             cp -L "{jar}" workdir/input/
-{merge_extra_jars}
-            if [ -n "$(find workdir/native -type f -print -quit)" ]; then
-                "{jar_tool}" uf "workdir/input/{main_jar}" -C workdir/native .
-            fi
+{stage_extra_jars}
             chmod u+w workdir/input/*
             printf '[Desktop Entry]\\nName=FluxEngine\\nComment=FluxEngine\\nExec=APPLICATION_LAUNCHER\\nIcon=APPLICATION_ICON\\nTerminal=false\\nType=Application\\nCategories=DEPLOY_BUNDLE_CATEGORY\\n' > workdir/resources/fluxengine-gui.desktop
             if [ "{package_type}" = "rpm" ]; then
@@ -157,7 +155,7 @@ def _jpackage_impl(ctx):
             jar = jar.path,
             main_jar = jar.basename,
             jar_tool = java_runtime.java_home + "/bin/jar",
-            merge_extra_jars = merge_extra_jars,
+            stage_extra_jars = stage_extra_jars,
             main_class = ctx.attr.main_class,
             add_launcher_args = _add_launcher_args(launchers),
             out = out.path,
@@ -180,8 +178,9 @@ def _jpackage_app_image_impl(ctx):
     else:
         out = ctx.actions.declare_file(ctx.attr.package_name + "_" + ctx.attr.app_version + ".tar.xz")
     launchers = _launcher_properties(ctx)
-    merge_extra_jars = "\n".join([
-        '            (cd workdir/native && "{jar_tool}" xf "{jar}")'.format(
+    stage_extra_jars = "\n".join([
+        ('            cp -L "{jar}" workdir/input/\n'
+         '            (cd workdir/input && "{jar_tool}" xf "{jar}")').format(
             jar_tool = java_runtime.java_home + "/bin/jar",
             jar = extra_jar.path,
         )
@@ -206,12 +205,9 @@ def _jpackage_app_image_impl(ctx):
         use_default_shell_env = True,
         command = """
             rm -rf workdir
-            mkdir -p workdir/input workdir/native workdir/tmp workdir/dest workdir/home workdir/resources
+            mkdir -p workdir/input workdir/tmp workdir/dest workdir/home workdir/resources
             cp -L "{jar}" workdir/input/
-{merge_extra_jars}
-            if [ -n "$(find workdir/native -type f -print -quit)" ]; then
-                "{jar_tool}" uf "workdir/input/{main_jar}" -C workdir/native .
-            fi
+{stage_extra_jars}
             chmod u+w workdir/input/*
             printf '[Desktop Entry]\nName=FluxEngine\nComment=FluxEngine\nExec=APPLICATION_LAUNCHER\nIcon=APPLICATION_ICON\nTerminal=false\nType=Application\nCategories=DEPLOY_BUNDLE_CATEGORY\n' > workdir/resources/fluxengine-gui.desktop
             TMPDIR="$(pwd)/workdir/tmp"
@@ -249,7 +245,7 @@ def _jpackage_app_image_impl(ctx):
             jar = jar.path,
             main_jar = jar.basename,
             jar_tool = java_runtime.java_home + "/bin/jar",
-            merge_extra_jars = merge_extra_jars,
+            stage_extra_jars = stage_extra_jars,
             main_class = ctx.attr.main_class,
             add_launcher_args = _add_launcher_args(launchers),
             out = out.path,

From be1832a4c84385a5138c39dd64cacc339414dd64 Mon Sep 17 00:00:00 2001
From: David Given <dg@cowlark.com>
Date: Mon, 21 Sep 2026 15:56:44 +0000
Subject: [PATCH 04/11] Typo fix.

---
 scripts/jpackage.bzl | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/jpackage.bzl b/scripts/jpackage.bzl
index 3c06b15f..12130404 100644
--- a/scripts/jpackage.bzl
+++ b/scripts/jpackage.bzl
@@ -67,7 +67,7 @@ def _jpackage_impl(ctx):
         out = ctx.actions.declare_file(ctx.attr.package_name + "_" + ctx.attr.app_version + "." + extension)
     launchers = _launcher_properties(ctx)
     stage_extra_jars = "\n".join([
-        ('            cp -L "{jar}" workdir/input/\n'
+        ('            cp -L "{jar}" workdir/input/\n' +
          '            (cd workdir/input && "{jar_tool}" xf "{jar}")').format(
             jar_tool = java_runtime.java_home + "/bin/jar",
             jar = extra_jar.path,
@@ -179,7 +179,7 @@ def _jpackage_app_image_impl(ctx):
         out = ctx.actions.declare_file(ctx.attr.package_name + "_" + ctx.attr.app_version + ".tar.xz")
     launchers = _launcher_properties(ctx)
     stage_extra_jars = "\n".join([
-        ('            cp -L "{jar}" workdir/input/\n'
+        ('            cp -L "{jar}" workdir/input/\n' +
          '            (cd workdir/input && "{jar_tool}" xf "{jar}")').format(
             jar_tool = java_runtime.java_home + "/bin/jar",
             jar = extra_jar.path,

From 775495b0f35123083fff5d6d73b1f118e4e53206 Mon Sep 17 00:00:00 2001
From: David Given <dg@cowlark.com>
Date: Mon, 21 Sep 2026 19:37:01 +0200
Subject: [PATCH 05/11] For OSX, only generate a launcher for the GUI.

---
 java/com/cowlark/fluxengine/BUILD.bazel | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/java/com/cowlark/fluxengine/BUILD.bazel b/java/com/cowlark/fluxengine/BUILD.bazel
index bc092758..c786a263 100644
--- a/java/com/cowlark/fluxengine/BUILD.bazel
+++ b/java/com/cowlark/fluxengine/BUILD.bazel
@@ -67,14 +67,13 @@ jpackage(
     package_name = "fluxengine",
     app_version = "1.0.0",
     stamp = True,
-    extra_launchers = [":fluxengine-gui.properties"],
     extra_jars = ["@maven//:io_github_dsheirer_libusb4java_darwin_aarch64"],
     jar = ":fluxengine_deploy.jar",
     launcher_icon = select({
         "@platforms//os:osx": "//extras:fluxengine_icns",
         "//conditions:default": "//extras:icon.png",
     }),
-    main_class = "com.cowlark.fluxengine.cli.Main",
+    main_class = "com.cowlark.fluxengine.gui.Gui",
     package_type = select({
         "@platforms//os:osx": "dmg",
         "//conditions:default": "unsupported",

From 84e17260054f33effd099d2610b703ded001ef59 Mon Sep 17 00:00:00 2001
From: David Given <dg@cowlark.com>
Date: Mon, 21 Sep 2026 19:39:02 +0200
Subject: [PATCH 06/11] Sign the OSX application.

---
 scripts/jpackage.bzl | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scripts/jpackage.bzl b/scripts/jpackage.bzl
index 12130404..5b89f9ac 100644
--- a/scripts/jpackage.bzl
+++ b/scripts/jpackage.bzl
@@ -122,6 +122,8 @@ def _jpackage_impl(ctx):
             if [ "{package_type}" = "msi" ]; then WIN_CONSOLE="--win-console"; fi
             LINUX_PACKAGE_NAME=""
             if [ "{package_type}" = "deb" ] || [ "{package_type}" = "rpm" ]; then LINUX_PACKAGE_NAME="--linux-package-name {package_name}"; fi
+            MAC_SIGN=""
+            if [ "{package_type}" = "dmg" ]; then MAC_SIGN="--mac-sign"; fi
             # Determine app version: STABLE_VERSION from Bazel stamp, else fallback.
             APP_VERSION="{app_version}"
             if [ "{stamp}" = "True" ] && [ -f "{info_file}" ]; then
@@ -138,6 +140,7 @@ def _jpackage_impl(ctx):
                 --main-jar "{main_jar}" \
                 --main-class "{main_class}" \
                 $WIN_CONSOLE \
+                $MAC_SIGN \
                 --resource-dir "$(pwd)/workdir/resources" \
                 {add_launcher_args} \
                 --jlink-options "--strip-debug --no-header-files --no-man-pages --strip-native-commands" \

From abbfb3fd41ded1cff498aff484e47005f2ef69a0 Mon Sep 17 00:00:00 2001
From: David Given <dg@cowlark.com>
Date: Mon, 21 Sep 2026 19:42:41 +0200
Subject: [PATCH 07/11] Change the OSX package name.

---
 java/com/cowlark/fluxengine/BUILD.bazel | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/com/cowlark/fluxengine/BUILD.bazel b/java/com/cowlark/fluxengine/BUILD.bazel
index c786a263..25b3b830 100644
--- a/java/com/cowlark/fluxengine/BUILD.bazel
+++ b/java/com/cowlark/fluxengine/BUILD.bazel
@@ -64,7 +64,7 @@ jpackage(
 
 jpackage(
     name = "fluxengine_dmg",
-    package_name = "fluxengine",
+    package_name = "FluxEngine",
     app_version = "1.0.0",
     stamp = True,
     extra_jars = ["@maven//:io_github_dsheirer_libusb4java_darwin_aarch64"],

From 9d775cfccd77323c0c2096a437a4918ea575f053 Mon Sep 17 00:00:00 2001
From: David Given <dg@cowlark.com>
Date: Mon, 21 Sep 2026 19:47:20 +0200
Subject: [PATCH 08/11] Set the mac package name. Simplify jpackage a bit.

---
 java/com/cowlark/fluxengine/BUILD.bazel | 14 +++++++++-----
 scripts/jpackage.bzl                    | 11 ++++++++---
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/java/com/cowlark/fluxengine/BUILD.bazel b/java/com/cowlark/fluxengine/BUILD.bazel
index 25b3b830..fe38cf20 100644
--- a/java/com/cowlark/fluxengine/BUILD.bazel
+++ b/java/com/cowlark/fluxengine/BUILD.bazel
@@ -17,12 +17,12 @@ jpackage(
     name = "fluxengine_deb",
     package_name = "fluxengine",
     app_version = "1.0.0",
-    stamp = True,
     extra_launchers = [":fluxengine-gui.properties"],
     jar = ":fluxengine_deploy.jar",
     launcher_icon = "//extras:icon.png",
     main_class = "com.cowlark.fluxengine.cli.Main",
     package_type = "deb",
+    stamp = True,
     tags = ["manual"],
 )
 
@@ -30,12 +30,12 @@ jpackage(
     name = "fluxengine_rpm",
     package_name = "fluxengine",
     app_version = "1.0.0",
-    stamp = True,
     extra_launchers = [":fluxengine-gui.properties"],
     jar = ":fluxengine_deploy.jar",
     launcher_icon = "//extras:icon.png",
     main_class = "com.cowlark.fluxengine.cli.Main",
     package_type = "rpm",
+    stamp = True,
     tags = ["manual"],
 )
 
@@ -47,7 +47,6 @@ jpackage(
     name = "fluxengine_msi",
     package_name = "fluxengine",
     app_version = "1.0.0",
-    stamp = True,
     extra_launchers = [":fluxengine-gui.properties"],
     jar = ":fluxengine_deploy.jar",
     launcher_icon = select({
@@ -59,6 +58,7 @@ jpackage(
         "@platforms//os:windows": "msi",
         "//conditions:default": "unsupported",
     }),
+    stamp = True,
     tags = ["manual"],
 )
 
@@ -66,8 +66,11 @@ jpackage(
     name = "fluxengine_dmg",
     package_name = "FluxEngine",
     app_version = "1.0.0",
-    stamp = True,
     extra_jars = ["@maven//:io_github_dsheirer_libusb4java_darwin_aarch64"],
+    extra_jpackage_args = [
+        "--mac-sign",
+        "--mac-package-name FluxEngine",
+    ],
     jar = ":fluxengine_deploy.jar",
     launcher_icon = select({
         "@platforms//os:osx": "//extras:fluxengine_icns",
@@ -78,6 +81,7 @@ jpackage(
         "@platforms//os:osx": "dmg",
         "//conditions:default": "unsupported",
     }),
+    stamp = True,
     tags = ["manual"],
 )
 
@@ -85,10 +89,10 @@ jpackage_app_image(
     name = "fluxengine_app_image",
     package_name = "fluxengine",
     app_version = "1.0.0",
-    stamp = True,
     extra_launchers = [":fluxengine-gui.properties"],
     jar = ":fluxengine_deploy.jar",
     launcher_icon = "//extras:icon.png",
     main_class = "com.cowlark.fluxengine.cli.Main",
+    stamp = True,
     tags = ["manual"],
 )
diff --git a/scripts/jpackage.bzl b/scripts/jpackage.bzl
index 5b89f9ac..053028cc 100644
--- a/scripts/jpackage.bzl
+++ b/scripts/jpackage.bzl
@@ -122,8 +122,6 @@ def _jpackage_impl(ctx):
             if [ "{package_type}" = "msi" ]; then WIN_CONSOLE="--win-console"; fi
             LINUX_PACKAGE_NAME=""
             if [ "{package_type}" = "deb" ] || [ "{package_type}" = "rpm" ]; then LINUX_PACKAGE_NAME="--linux-package-name {package_name}"; fi
-            MAC_SIGN=""
-            if [ "{package_type}" = "dmg" ]; then MAC_SIGN="--mac-sign"; fi
             # Determine app version: STABLE_VERSION from Bazel stamp, else fallback.
             APP_VERSION="{app_version}"
             if [ "{stamp}" = "True" ] && [ -f "{info_file}" ]; then
@@ -140,7 +138,7 @@ def _jpackage_impl(ctx):
                 --main-jar "{main_jar}" \
                 --main-class "{main_class}" \
                 $WIN_CONSOLE \
-                $MAC_SIGN \
+                {extra_jpackage_args} \
                 --resource-dir "$(pwd)/workdir/resources" \
                 {add_launcher_args} \
                 --jlink-options "--strip-debug --no-header-files --no-man-pages --strip-native-commands" \
@@ -161,6 +159,7 @@ def _jpackage_impl(ctx):
             stage_extra_jars = stage_extra_jars,
             main_class = ctx.attr.main_class,
             add_launcher_args = _add_launcher_args(launchers),
+            extra_jpackage_args = " ".join(ctx.attr.extra_jpackage_args),
             out = out.path,
         ),
         mnemonic = "Jpackage" + package_type.title(),
@@ -229,6 +228,7 @@ def _jpackage_app_image_impl(ctx):
                 --input "$(pwd)/workdir/input" \
                 --main-jar "{main_jar}" \
                 --main-class "{main_class}" \
+                {extra_jpackage_args} \
                 --resource-dir "$(pwd)/workdir/resources" \
                 {add_launcher_args} \
                 --jlink-options "--strip-debug --no-header-files --no-man-pages --strip-native-commands" \
@@ -251,6 +251,7 @@ def _jpackage_app_image_impl(ctx):
             stage_extra_jars = stage_extra_jars,
             main_class = ctx.attr.main_class,
             add_launcher_args = _add_launcher_args(launchers),
+            extra_jpackage_args = " ".join(ctx.attr.extra_jpackage_args),
             out = out.path,
         ),
         mnemonic = "JpackageAppImage",
@@ -301,6 +302,10 @@ _jpackage_attrs = {
         doc = "The jpackage package type: deb/rpm (Linux), msi (Windows), dmg (macOS). " +
               "Use select() so this is only set to the matching platform.",
     ),
+    "extra_jpackage_args": attr.string_list(
+        default = [],
+        doc = "Additional arguments to pass to jpackage verbatim.",
+    ),
 }
 
 jpackage = rule(

From 8fcc4dc5985689ace383dc7ec82d290ad5375adb Mon Sep 17 00:00:00 2001
From: David Given <dg@cowlark.com>
Date: Mon, 21 Sep 2026 19:50:19 +0200
Subject: [PATCH 09/11] Change the OSX package name back again.

---
 java/com/cowlark/fluxengine/BUILD.bazel | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/com/cowlark/fluxengine/BUILD.bazel b/java/com/cowlark/fluxengine/BUILD.bazel
index fe38cf20..fa3e2443 100644
--- a/java/com/cowlark/fluxengine/BUILD.bazel
+++ b/java/com/cowlark/fluxengine/BUILD.bazel
@@ -64,7 +64,7 @@ jpackage(
 
 jpackage(
     name = "fluxengine_dmg",
-    package_name = "FluxEngine",
+    package_name = "fluxengine",
     app_version = "1.0.0",
     extra_jars = ["@maven//:io_github_dsheirer_libusb4java_darwin_aarch64"],
     extra_jpackage_args = [

From 4e0d94087c709791e734d7979b7c19fa0c017937 Mon Sep 17 00:00:00 2001
From: David Given <dg@cowlark.com>
Date: Mon, 21 Sep 2026 19:53:29 +0200
Subject: [PATCH 10/11] Clean up leftover flags.

---
 java/com/cowlark/fluxengine/BUILD.bazel | 5 -----
 scripts/jpackage.bzl                    | 2 +-
 2 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/java/com/cowlark/fluxengine/BUILD.bazel b/java/com/cowlark/fluxengine/BUILD.bazel
index fa3e2443..5af6dfb6 100644
--- a/java/com/cowlark/fluxengine/BUILD.bazel
+++ b/java/com/cowlark/fluxengine/BUILD.bazel
@@ -16,7 +16,6 @@ java_binary(
 jpackage(
     name = "fluxengine_deb",
     package_name = "fluxengine",
-    app_version = "1.0.0",
     extra_launchers = [":fluxengine-gui.properties"],
     jar = ":fluxengine_deploy.jar",
     launcher_icon = "//extras:icon.png",
@@ -29,7 +28,6 @@ jpackage(
 jpackage(
     name = "fluxengine_rpm",
     package_name = "fluxengine",
-    app_version = "1.0.0",
     extra_launchers = [":fluxengine-gui.properties"],
     jar = ":fluxengine_deploy.jar",
     launcher_icon = "//extras:icon.png",
@@ -46,7 +44,6 @@ jpackage(
 jpackage(
     name = "fluxengine_msi",
     package_name = "fluxengine",
-    app_version = "1.0.0",
     extra_launchers = [":fluxengine-gui.properties"],
     jar = ":fluxengine_deploy.jar",
     launcher_icon = select({
@@ -65,7 +62,6 @@ jpackage(
 jpackage(
     name = "fluxengine_dmg",
     package_name = "fluxengine",
-    app_version = "1.0.0",
     extra_jars = ["@maven//:io_github_dsheirer_libusb4java_darwin_aarch64"],
     extra_jpackage_args = [
         "--mac-sign",
@@ -88,7 +84,6 @@ jpackage(
 jpackage_app_image(
     name = "fluxengine_app_image",
     package_name = "fluxengine",
-    app_version = "1.0.0",
     extra_launchers = [":fluxengine-gui.properties"],
     jar = ":fluxengine_deploy.jar",
     launcher_icon = "//extras:icon.png",
diff --git a/scripts/jpackage.bzl b/scripts/jpackage.bzl
index 053028cc..5da4889e 100644
--- a/scripts/jpackage.bzl
+++ b/scripts/jpackage.bzl
@@ -289,7 +289,7 @@ _jpackage_attrs = {
         doc = "The package name; also used for the output filename.",
     ),
     "app_version": attr.string(
-        mandatory = True,
+        default = "1.0.0",
         doc = "Application version, e.g. '1.0.0'. Used as fallback when stamp is off.",
     ),
     "stamp": attr.bool(

From 1444810e804765287c5fdb0005f1a2c588715dd1 Mon Sep 17 00:00:00 2001
From: David Given <dg@cowlark.com>
Date: Mon, 21 Sep 2026 20:27:07 +0200
Subject: [PATCH 11/11] Try signing the dmg from a script.

---
 .github/workflows/ccpp.yml              |  6 +-
 java/com/cowlark/fluxengine/BUILD.bazel |  1 -
 scripts/resign-dmg.sh                   | 76 +++++++++++++++++++++++++
 3 files changed, 81 insertions(+), 2 deletions(-)
 create mode 100644 scripts/resign-dmg.sh

diff --git a/.github/workflows/ccpp.yml b/.github/workflows/ccpp.yml
index 39cdac4a..5a5d08c7 100644
--- a/.github/workflows/ccpp.yml
+++ b/.github/workflows/ccpp.yml
@@ -56,12 +56,16 @@ jobs:
           bazel test //... --test_output=errors
           bazel build //:fluxengine_dmg --config=stamp --test_output=errors
 
+      - name: Signing package
+        run: |
+          cd fluxengine
+          sh scripts/resign-dmg.sh bazel-bin/java/com/cowlark/fluxengine/fluxengine.dmg fluxengine-signed.dmg
       - name: Upload build artifacts
         uses: actions/upload-artifact@v4
         with:
           name: ${{ github.event.repository.name }}.${{ github.sha }}.osx.${{ runner.arch }}
           path: |
-            fluxengine/bazel-bin/java/com/cowlark/fluxengine/*.dmg
+            fluxengine/fluxengine-signed.dmg
 
   build-windows:
     runs-on: windows-latest
diff --git a/java/com/cowlark/fluxengine/BUILD.bazel b/java/com/cowlark/fluxengine/BUILD.bazel
index 5af6dfb6..862d86f7 100644
--- a/java/com/cowlark/fluxengine/BUILD.bazel
+++ b/java/com/cowlark/fluxengine/BUILD.bazel
@@ -64,7 +64,6 @@ jpackage(
     package_name = "fluxengine",
     extra_jars = ["@maven//:io_github_dsheirer_libusb4java_darwin_aarch64"],
     extra_jpackage_args = [
-        "--mac-sign",
         "--mac-package-name FluxEngine",
     ],
     jar = ":fluxengine_deploy.jar",
diff --git a/scripts/resign-dmg.sh b/scripts/resign-dmg.sh
new file mode 100644
index 00000000..d6ee81f7
--- /dev/null
+++ b/scripts/resign-dmg.sh
@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+#
+# resign-dmg.sh: unpack a dmg, ad-hoc sign the .app inside, and rebuild the dmg.
+#
+# Usage: ./resign-dmg.sh input.dmg [output.dmg]
+# If output.dmg is omitted, the input file is replaced.
+#
+# Set SIGN_IDENTITY to use a real certificate instead of ad-hoc ("-"):
+#   SIGN_IDENTITY="Developer ID Application: Your Name (TEAMID)" ./resign-dmg.sh in.dmg
+
+set -euo pipefail
+
+IN_DMG="${1:?Usage: $0 input.dmg [output.dmg]}"
+OUT_DMG="${2:-$IN_DMG}"
+IDENTITY="${SIGN_IDENTITY:--}"
+
+[[ -f "$IN_DMG" ]] || { echo "Not found: $IN_DMG" >&2; exit 1; }
+
+WORK="$(mktemp -d)"
+MOUNT="$WORK/mount"
+STAGE="$WORK/stage"
+mkdir -p "$MOUNT" "$STAGE"
+
+cleanup() {
+  hdiutil detach "$MOUNT" -quiet -force 2>/dev/null || true
+  rm -rf "$WORK"
+}
+trap cleanup EXIT
+
+echo "==> Mounting $IN_DMG"
+hdiutil attach "$IN_DMG" -mountpoint "$MOUNT" -nobrowse -readonly -quiet
+
+# Reuse the original volume name
+VOLNAME="$(diskutil info "$MOUNT" | sed -n 's/^ *Volume Name: *//p')"
+VOLNAME="${VOLNAME:-$(basename "$IN_DMG" .dmg)}"
+
+echo "==> Copying contents (volume: $VOLNAME)"
+# ditto preserves symlinks (e.g. /Applications), xattrs and hidden files
+ditto "$MOUNT" "$STAGE"
+hdiutil detach "$MOUNT" -quiet
+
+APP="$(find "$STAGE" -maxdepth 1 -name '*.app' -type d | head -n 1)"
+[[ -n "$APP" ]] || { echo "No .app found in dmg" >&2; exit 1; }
+echo "==> Found app: $(basename "$APP")"
+
+# Remove any existing (possibly broken) signatures and quarantine flags
+xattr -cr "$APP" || true
+find "$APP" -name '_CodeSignature' -type d -prune -exec rm -rf {} + 2>/dev/null || true
+
+echo "==> Signing nested binaries (identity: $IDENTITY)"
+# Sign every Mach-O file (dylibs, jspawnhelper, java, launcher, ...) inside-out.
+# Deepest paths first so nested code is signed before what contains it.
+find "$APP" -type f -print0 \
+  | while IFS= read -r -d '' f; do
+      if file -b "$f" | grep -q 'Mach-O'; then
+        printf '%s\n' "$f"
+      fi
+    done \
+  | awk '{ print length($0) "\t" $0 }' | sort -rn | cut -f2- \
+  | while IFS= read -r f; do
+      codesign --force --sign "$IDENTITY" --timestamp=none "$f"
+    done
+
+echo "==> Signing app bundle"
+codesign --force --sign "$IDENTITY" --timestamp=none "$APP"
+
+echo "==> Verifying"
+codesign --verify --deep --strict --verbose=2 "$APP"
+codesign -dvv "$APP" 2>&1 | grep -E 'Signature|Identifier' || true
+
+echo "==> Building dmg: $OUT_DMG"
+TMP_DMG="$WORK/out.dmg"
+hdiutil create -volname "$VOLNAME" -srcfolder "$STAGE" -ov -format UDZO -quiet "$TMP_DMG"
+mv -f "$TMP_DMG" "$OUT_DMG"
+
+echo "Done: $OUT_DMG"