Full build — all platforms

build-all.sh builds the complete DeepPhe installer distribution from the command line: the macOS, Windows, and Linux media sets defined in DeepPhe-and-Launcher.install4j, written to build/deepphe-installer/.

./build-all.sh

By default this produces signed media (macOS notarized, Windows Authenticode-signed) using the signing configuration inside the .install4j project. Provide the key passwords via environment variables, or pass --no-installer-signing for a quick unsigned build.

Quick unsigned build

For a fast local all-platform build with no signing or notarization:

./build-all.sh --no-installer-signing --faster

This passes --disable-signing --disable-notarization to install4jc.

Sign only the macOS installer media

To produce a signed/notarized macOS DMG while leaving Windows and Linux installer media unsigned:

./build-all.sh --mac-signing-only

This runs install4j twice: first for macOS media id 484 with installer signing enabled, then for Windows/Linux media ids 251,815 with signing and notarization disabled.

Signing the downloadable Windows assets

The launcher downloads its Windows payloads at install time from the DeepPhe-Dist releases. Those payloads are signed separately (they are not part of the installer media). Add --sign to run sign-windows-assets.sh after the build:

./build-all.sh --sign

That step is remote (it re-uploads assets to GitHub) and needs the YubiKey, gh, and jsign, so it is opt-in rather than automatic.

Publishing the installer media

Add --publish to upload the built installer media to a GitHub release:

./build-all.sh --publish

By default the script publishes to DeepPhe/DeepPhe-Dist with the tag deepphe-installer-<version> and uploads versioned asset filenames such as DeepPhe-7.1.dmg. Use --publish-tag or --publish-repo to override those defaults. See Publishing installer media.

Options

Option	Effect
--sign	After building, run ./sign-windows-assets.sh
--mac-signing-only	Sign/notarize only macOS installer media; build Windows/Linux media unsigned
--no-installer-signing	Pass --disable-signing --disable-notarization to install4jc
--publish	Upload built installer media to a GitHub release
--publish-tag TAG	Override the GitHub release tag used by --publish
--publish-repo OWNER/REPO	Override the GitHub repository used by --publish
--clean	Delete the build output directory first
--release VERSION	Override the application version (install4jc --release)
--faster	Disable LZMA/Pack200 compression (fast test builds)
--test	Dry run (install4jc --test)
-v, --verbose	Verbose install4jc output
-h, --help	Show help

Environment

Variable	Purpose
INSTALL4JC	Path to install4jc (auto-detected if unset)
DIST_REPO	Default publish target for --publish
MAC_MEDIA_ID	macOS media set id used by --mac-signing-only (484)
NON_MAC_MEDIA_IDS	Windows/Linux media ids used by --mac-signing-only (251,815)
WIN_KEYSTORE_PASSWORD	Windows code-signing key password
MAC_KEYSTORE_PASSWORD	macOS code-signing key password
APPLE_ID_PASSWORD	App-specific password for macOS notarization
INSTALL4JC_ARGS	Extra args appended to every install4jc call

These are variable names, not values

Never hard-code passwords into scripts or commit them. Export them in your shell session (or a local, git-ignored env file) just before building. See Signing overview.

About the Windows certificate chain

Windows signing uses the YubiKey (PKCS#11), which holds only the leaf certificate. install4j needs the intermediate/root certs on disk to embed the full chain, so when signing is enabled the script points install4j at them:

-D sys.ext.certDir="$SCRIPT_DIR/keys/certchain"

The keys/certchain/ directory holds the public .cer chain files (not secrets). It is only added if it exists.

Output

A successful build writes to build/deepphe-installer/:

build/deepphe-installer/
├── DeepPhe.dmg            # macOS
├── DeepPhe_windows.exe    # Windows (Authenticode-signed)
├── DeepPhe_linux-x64.sh   # Linux self-extracting installer
├── output.txt            # install4j media manifest
└── updates.xml           # install4j auto-update descriptor

The local filenames above are the install4j build outputs. With --publish, build-all.sh uploads versioned copies to the GitHub release. For the 7.1 release, the published installer resources are:

Platform	Published installer
macOS	DeepPhe-7.1.dmg
Windows	DeepPhe_windows-7.1.exe
Linux	DeepPhe_linux-x64-7.1.sh

Reproducing the build on a fresh machine

The .install4j file includes some local absolute paths for payloads and signing files. Those are build-machine configuration, not portable source. On a new machine, update those paths inside install4j (or make them relative) before building. See Repo layout.