Java 16 or newer. Even though JPackage existed since 14, it was broken.
An Apple signing certificate. The JBigi and JRE libs and the final bundle MUST be signed or users will get a scary warning.

Building

Clone i2p.i2p as a sibling to this module
Build it with ant clean preppkg-osx-only
Set the I2P_SIGNER environment variable to a string identifying the signer.
Set the I2P_BUILD_NUMBER environment variable to some integer >= 1
Run build.sh

How does it work

In order to build an AppBundle that can work from anywhere, it is necessary to use a dedicated main class which determines the current working directory and sets i2p.dir.base to the correct location inside the AppBundle. Therefore the build.sh script:

Compiles the custom main clas and puts it in a launcher.jar
Invokes JPackage with the --app-image switch to create the directory structure of the bundle
Copies the contents of ../i2p.i2p/pkg-temp inside the AppBundle, except for the jars directory
Signs the AppBundle
Invokes JPackage again to build the final .dmg

Notarization

You need an "app-specific password" which you can create at https://appleid.apple.com
Execute

xcrun altool --eval-app --primary-bundle-id net.i2p.router -u <your Apple id> -f <name of the .dmg file>

This will ask you for the password you generated in step 1 and will return a long UUID string you can use to check the progress.

Periodically execute the following to check the progress of the notarisation:

xcrun altool --eval-info <the long UUID string> -u <your Apple id>

If that returns success, staple the notarization to the dmg:

xcrun stapler staple <name of the .dmg>