When jpackage creates a signed .pkg file from a predefined unsigned app image, the wrong value of "signed" property is put in the ".jpackage.xml" file. The value is "true," but it should be "false" because the app image is unsigned.

This should be fixed.

The better fix would be not to put ".jpackage.xml" file in .pkg at all. jpackage is supposed to add ".jpackage.xml" file in the app image only when it is doing app packaging and not native packaging. This is how it works on Linux and Windows, but not on macOS.