The entry point of the application bundled by jpackage is "My App.exe", given that the app is called "My App".
I can sign the installer after jpackage is done. I can sign other resource before I launch jpackage.
But how do I sign this launcher file that is by jpackage? Is there a hook after jpackage have already prepared the files, but haven't yet called Wix?
jpackage can be run in two stages to allow you to apply changes to the app image structure before generating the installer.
First stage use target jpackage --type app-image with --dest and --name parameters to generate the application image as yourstage1.dir\Your App Name:
jpackage --type app-image --dest yourstage1.dir --name "Your App Name" ... etc
Modify the contents of the output folder as needed, such as signing executables. I have a Windows screensaver, so my build renames one .EXE with .SCR extension in this step.
Finally apply jpackage again with the target type appropriate for your environment using --type exe/msi/dmg with --app-image to read the app image folder created in the first stage. Example:
jpackage --type msi --app-image "yourstage1.dir/Your App Name" ... etc
You can add --dest dir to change where the MSI file is created.