Prerequisites

You build the installer on a developer machine that has install4j and a JDK. Signing and notarization add a few more requirements, but those steps are optional for local test builds.

Required for any build

Tool	Why	Notes
install4j 10.x	Compiles DeepPhe-and-Launcher.install4j into installer media	The project targets install4j 10.0.9. The build scripts auto-detect install4jc.
JDK 26	install4j bundles a Java 26 runtime into the installer; the launcher targets Java 26	The project searches .jdk/26/Contents/Home and bundles the 26/jdk-26.0.1+8 runtime.
Bash	The build-*.sh and sign-*.sh helpers are bash scripts	macOS/Linux. On Windows use WSL or run install4jc directly.
Network access	The installer downloads payloads from GitHub at install time, not build time	The build itself does not need the DeepPhe-Dist assets.

Locating install4jc

Both build scripts auto-detect the install4j command-line compiler in this order, preferring the highest version found:

1. $INSTALL4JC if you set it explicitly
2. install4jc on your PATH
3. /Applications/install4j*.app/Contents/Resources/app/bin/install4jc
4. /opt/install4j/bin/install4jc

Override it any time:

export INSTALL4JC=/path/to/install4jc

Additional requirements for signing

These are only needed when you build signed / notarized media or run the Windows asset-signing helper. A local test build skips all of this.

Requirement	Used by	Notes
macOS code-signing keystore + Apple ID app password	install4j macOS signing & notarization	Configured inside the .install4j project; passwords supplied via environment variables.
Windows code-signing certificate (YubiKey, PKCS#11)	install4j Windows media signing and sign-windows-assets.sh	Uses the YubiKey PIV slot; the leaf cert lives on the key, the chain .cer files live under keys/certchain/.
jsign + osslsigncode	sign-windows-assets.sh	brew install jsign osslsigncode
gh (GitHub CLI)	sign-windows-assets.sh and build-all.sh --publish	To download/re-upload release assets and publish installer media

Secrets never live in the repo

Keystores (*.p12, *.pfx, *.jks), PEM keys, PINs, and passwords are all git-ignored and supplied at build time via environment variables or the macOS keychain. See Signing overview and Repo layout.

Which build should I run?

• Local Mac DMG test → the fastest inner loop.
• Full build → all three platforms, optional signing.