Fix missing macOS launcher with administratorRequired (#473, #398)

The launcher was only copied when administratorRequired was false, so the
'startup' helper script called a universalJavaApplicationStub that didn't
exist. Always copy the launcher and invoke it by its real name from
startup.vtl, so customLauncher also works in admin mode.

The admin smoke test job is no longer allowed to fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: fvarrui

.github/scripts/check-macos-app.sh

@@ -29,6 +29,11 @@ if [ -x "$EXE" ]; then pass "executable present: $EXE"; else fail "executable mi
 # launcher stub (also called by the 'startup' script when administratorRequired=true, issues #473/#398)
 if [ -x "$STUB" ]; then pass "launcher present: $STUB"; else fail "launcher missing: $STUB"; fi
 
+# with administratorRequired=true, the 'startup' script must invoke the launcher
+if [ "$ADMIN" = "true" ]; then
+	if grep -q "SCRIPTPATH/$(basename "$STUB")" "$MACOS/startup"; then pass "startup script invokes $(basename "$STUB")"; else fail "startup script doesn't invoke $(basename "$STUB")"; cat "$MACOS/startup"; fi
+fi
+
 # compiled launchers must contain native arm64 code (issues #448/#449)
 if [ "$MAC_STARTUP" != "SCRIPT" ] && [ -f "$STUB" ]; then
 	file "$STUB"

.github/workflows/macos-smoke.yml

@@ -12,8 +12,6 @@ jobs:
     name: ${{ matrix.os }} / ${{ matrix.macStartup }}${{ matrix.admin && ' / admin' || '' }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
-    # administratorRequired is a known failure (issues #473/#398) until fixed
-    continue-on-error: ${{ matrix.admin }}
     strategy:
       fail-fast: false
       matrix:

.minispec/features/fix-473-398-mac-admin-launcher.md

@@ -0,0 +1,21 @@
+# macOS app with administratorRequired has no launcher (#473, #398)
+
+## Problem
+
+With `administratorRequired=true`, the macOS app does nothing after the user enters the admin password (#398). `Contents/MacOS/universalJavaApplicationStub` is missing from the bundle (#473). Reproduced by the macOS smoke tests (run 37165552012, job `macos-15 / SCRIPT / admin`).
+
+## Cause
+
+`MacPackager.processStartupScript()` only copied the launcher (precompiled stub or `customLauncher`) in the non-admin branch. In admin mode it only rendered the `startup` helper script, and `mac/startup.vtl` invoked a hardcoded `universalJavaApplicationStub` that was never copied.
+
+## Solution
+
+- `processStartupScript()` always copies the launcher to `Contents/MacOS` and keeps it in a new `launcher` field (`getLauncher()`). In admin mode `startup` is the executable; otherwise the launcher is.
+- `mac/startup.vtl` invokes `$SCRIPTPATH/${info.launcher.name}` instead of the hardcoded name, so `customLauncher` also works in admin mode.
+- Custom `startup.vtl` templates in users' `assetsDir` keep working: the default launcher is still named `universalJavaApplicationStub`.
+- The smoke test checks that the `startup` script invokes an existing launcher, and the admin job no longer has `continue-on-error`.
+
+## Verification
+
+- macOS smoke tests: the admin job must pass (launcher present, invoked by `startup`).
+- Not verifiable in CI: the password prompt and the app actually starting with admin rights. #398 reporters said a similar fix (branch `issue-398`, before the native launcher) still didn't start the app. Ask them to test a snapshot before closing #398. #473 can be closed with this fix.

src/main/java/io/github/fvarrui/javapackager/packagers/MacPackager.java

@@ -34,6 +34,7 @@ public class MacPackager extends Packager {
 	private File javaFolder;
 	private File macOSFolder;
 	private File jreBundleFolder;
+	private File launcher;
 
 	public MacPackager() {		
 		super();
@@ -44,6 +45,10 @@ public File getAppFile() {
 		return appFile;
 	}
 
+	public File getLauncher() {
+		return launcher;
+	}
+
 	@Override
 	public void doInit() throws Exception {
 
@@ -121,12 +126,21 @@ public File doCreateApp() throws Exception {
 	}
 
 	private void processStartupScript() throws Exception {
-		
+
+		// copies the launcher (custom or precompiled) to Contents/MacOS
+		File customLauncher = macConfig.getCustomLauncher();
+		if (customLauncher != null && customLauncher.canRead() && customLauncher.isFile()) {
+			FileUtils.copyFileToFolder(customLauncher, macOSFolder);
+			this.launcher = new File(macOSFolder, customLauncher.getName());
+		} else {
+			this.launcher = preparePrecompiledStartupStub();
+		}
+		launcher.setExecutable(true, false);
+
 		if (this.administratorRequired) {
 
 			// We need a helper script ("startup") in this case,
-			// which invokes the launcher script/ executable with administrator rights.
-			// TODO: admin script depends on launcher file name 'universalJavaApplicationStub'
+			// which invokes the launcher with administrator rights.
 
 			// sets startup file
 			this.executable = new File(macOSFolder, "startup");
@@ -136,13 +150,8 @@ private void processStartupScript() throws Exception {
 
 		} else {
 
-			File launcher = macConfig.getCustomLauncher();
-			if (launcher != null && launcher.canRead() && launcher.isFile()){
-				FileUtils.copyFileToFolder(launcher, macOSFolder);
-				this.executable = new File(macOSFolder, launcher.getName());
-			} else {
-				this.executable = preparePrecompiledStartupStub();
-			}
+			this.executable = launcher;
+
 		}
 
 		executable.setExecutable(true, false);

src/main/resources/mac/startup.vtl

@@ -1,4 +1,4 @@
 #!/bin/bash
 # MacOS startup script generated by JavaPackager plugin
 SCRIPTPATH=`cd "$(dirname "$0")" ; pwd`
-osascript -e "do shell script quoted form of \"$SCRIPTPATH\" & \"/universalJavaApplicationStub $@\" with administrator privileges" &
+osascript -e "do shell script quoted form of \"$SCRIPTPATH/${info.launcher.name}\" & \" $@\" with administrator privileges" &