Merge branch 'develop' into feature/hub

# Conflicts: # .github/workflows/release.yml # .idea/runConfigurations/Cryptomator_Linux.xml # .idea/runConfigurations/Cryptomator_Linux_Dev.xml # .idea/runConfigurations/Cryptomator_Windows.xml # .idea/runConfigurations/Cryptomator_Windows_Dev.xml # .idea/runConfigurations/Cryptomator_macOS.xml # .idea/runConfigurations/Cryptomator_macOS_Dev.xml # pom.xml # src/main/java/module-info.java # src/main/java/org/cryptomator/ui/controls/NiceSecurePasswordField.java # src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/MasterkeyFileLoadingModule.java # src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/MasterkeyFileLoadingStrategy.java # src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/PassphraseEntryController.java # src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/SelectMasterkeyFileController.java # src/main/resources/license/THIRD-PARTY.txt
2026-05-14 08:41:28 +00:00 · 2022-04-08 20:23:59 +02:00
parent 9f7442c1c0 752e61219c
commit f3bfe7b64c
202 changed files with 4169 additions and 2620 deletions
--- a/.github/workflows/appimage.yml
+++ b/.github/workflows/appimage.yml
@@ -0,0 +1,158 @@
+name: Build AppImage
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version'
+        required: false
+
+env:
+  JAVA_VERSION: 17
+
+jobs:
+  build:
+    name: Build AppImage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Setup Java
+        uses: actions/setup-java@v2
+        with:
+          distribution: 'temurin'
+          java-version: ${{ env.JAVA_VERSION }}
+          cache: 'maven'
+      - id: versions 
+        name: Apply version information
+        run: |
+          if [[ $GITHUB_REF =~ refs/tags/[0-9]+\.[0-9]+\.[0-9]+.* ]]; then
+            SEM_VER_STR=${GITHUB_REF##*/}
+            mvn versions:set -DnewVersion=${SEM_VER_STR}
+          elif [[ "${{ github.event.inputs.version }}" =~ [0-9]+\.[0-9]+\.[0-9]+.* ]]; then
+            SEM_VER_STR="${{ github.event.inputs.version }}"
+            mvn versions:set -DnewVersion=${SEM_VER_STR}
+          else
+            SEM_VER_STR=`mvn help:evaluate -Dexpression=project.version -q -DforceStdout`
+          fi
+          SEM_VER_NUM=`echo ${SEM_VER_STR} | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/'`
+          REVCOUNT=`git rev-list --count HEAD`
+          echo "::set-output name=semVerStr::${SEM_VER_STR}"
+          echo "::set-output name=semVerNum::${SEM_VER_NUM}"
+          echo "::set-output name=revNum::${REVCOUNT}"
+      - name: Validate Version
+        uses: skymatic/semver-validation-action@v1
+        with:
+          version: ${{ steps.versions.outputs.semVerStr }}
+      - name: Run maven
+        run: mvn -B clean package -Pdependency-check,linux -DskipTests
+      - name: Patch target dir
+        run: |
+          cp LICENSE.txt target
+          cp dist/linux/launcher.sh target
+          cp target/cryptomator-*.jar target/mods
+      - name: Run jlink
+        run: >
+          ${JAVA_HOME}/bin/jlink
+          --verbose
+          --output runtime
+          --module-path "${JAVA_HOME}/jmods"
+          --add-modules java.base,java.desktop,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,jdk.unsupported,jdk.crypto.ec,jdk.accessibility,jdk.management.jfr
+          --no-header-files
+          --no-man-pages
+          --strip-debug
+          --compress=1
+      - name: Run jpackage
+        run: >
+          ${JAVA_HOME}/bin/jpackage
+          --verbose
+          --type app-image
+          --runtime-image runtime
+          --input target/libs
+          --module-path target/mods
+          --module org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator
+          --dest appdir
+          --name Cryptomator
+          --vendor "Skymatic GmbH"
+          --copyright "(C) 2016 - 2022 Skymatic GmbH"
+          --app-version "${{  steps.versions.outputs.semVerNum }}.${{  steps.versions.outputs.revNum }}"
+          --java-options "-Xss5m"
+          --java-options "-Xmx256m"
+          --java-options "-Dcryptomator.appVersion=\"${{  steps.versions.outputs.semVerStr }}\""
+          --java-options "-Dfile.encoding=\"utf-8\""
+          --java-options "-Dcryptomator.logDir=\"~/.local/share/Cryptomator/logs\""
+          --java-options "-Dcryptomator.pluginDir=\"~/.local/share/Cryptomator/plugins\""
+          --java-options "-Dcryptomator.settingsPath=\"~/.config/Cryptomator/settings.json:~/.Cryptomator/settings.json\""
+          --java-options "-Dcryptomator.ipcSocketPath=\"~/.config/Cryptomator/ipc.socket\""
+          --java-options "-Dcryptomator.mountPointsDir=\"~/.local/share/Cryptomator/mnt\""
+          --java-options "-Dcryptomator.showTrayIcon=false"
+          --java-options "-Dcryptomator.buildNumber=\"appimage-${{  steps.versions.outputs.revNum }}\""
+          --resource-dir dist/linux/resources
+      - name: Patch Cryptomator.AppDir
+        run: |
+          mv appdir/Cryptomator Cryptomator.AppDir
+          cp -r dist/linux/appimage/resources/AppDir/* Cryptomator.AppDir/
+          envsubst '${REVISION_NO} ${SEMVER_STR}' < dist/linux/appimage/resources/AppDir/bin/cryptomator.sh > Cryptomator.AppDir/bin/cryptomator.sh
+          cp dist/linux/common/org.cryptomator.Cryptomator256.png Cryptomator.AppDir/usr/share/icons/hicolor/256x256/apps/org.cryptomator.Cryptomator.png
+          cp dist/linux/common/org.cryptomator.Cryptomator512.png Cryptomator.AppDir/usr/share/icons/hicolor/512x512/apps/org.cryptomator.Cryptomator.png
+          cp dist/linux/common/org.cryptomator.Cryptomator.svg Cryptomator.AppDir/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg
+          cp dist/linux/common/org.cryptomator.Cryptomator.metainfo.xml Cryptomator.AppDir/usr/share/metainfo/org.cryptomator.Cryptomator.metainfo.xml
+          cp dist/linux/common/org.cryptomator.Cryptomator.desktop Cryptomator.AppDir/usr/share/applications/org.cryptomator.Cryptomator.desktop
+          cp dist/linux/common/application-vnd.cryptomator.vault.xml Cryptomator.AppDir/usr/share/mime/packages/application-vnd.cryptomator.vault.xml
+          ln -s usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg Cryptomator.AppDir/org.cryptomator.Cryptomator.svg
+          ln -s usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg Cryptomator.AppDir/Cryptomator.svg
+          ln -s usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg Cryptomator.AppDir/.DirIcon
+          ln -s usr/share/applications/org.cryptomator.Cryptomator.desktop Cryptomator.AppDir/Cryptomator.desktop
+          ln -s bin/cryptomator.sh Cryptomator.AppDir/AppRun
+        env:
+          REVISION_NO: ${{  steps.versions.outputs.revNum }}
+          SEMVER_STR: ${{  steps.versions.outputs.semVerStr }}
+      - name: Extract libjffi.so # workaround for https://github.com/cryptomator/cryptomator-linux/issues/27
+        run: |
+          JFFI_NATIVE_JAR=`ls lib/app/ | grep -e 'jffi-[1-9]\.[0-9]\{1,2\}.[0-9]\{1,2\}-native.jar'`
+          ${JAVA_HOME}/bin/jar -xf lib/app/${JFFI_NATIVE_JAR} /jni/x86_64-Linux/
+          mv jni/x86_64-Linux/* lib/app/libjffi.so
+        working-directory: Cryptomator.AppDir
+      - name: Download AppImageKit
+        run: |
+          curl -L https://github.com/AppImage/AppImageKit/releases/download/13/appimagetool-x86_64.AppImage -o appimagetool.AppImage
+          chmod +x appimagetool.AppImage
+          ./appimagetool.AppImage --appimage-extract
+      - name: Prepare GPG-Agent for signing with key 615D449FE6E6A235
+        run: |
+          echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
+          echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --dry-run --sign README.md
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
+          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
+      - name: Build AppImage
+        run: >
+          ./squashfs-root/AppRun Cryptomator.AppDir cryptomator-${{  steps.versions.outputs.semVerStr }}-x86_64.AppImage
+          -u 'gh-releases-zsync|cryptomator|cryptomator|latest|cryptomator-*-x86_64.AppImage.zsync'
+          --sign --sign-key=615D449FE6E6A235 --sign-args="--batch --pinentry-mode loopback"
+      - name: Create detached GPG signatures
+        run: |
+          gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator-*.AppImage
+          gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator-*.AppImage.zsync
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: appimage
+          path: |
+            cryptomator-*.AppImage
+            cryptomator-*.AppImage.zsync
+            cryptomator-*.asc
+          if-no-files-found: error
+      - name: Publish AppImage on GitHub Releases
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v1
+        with:
+          fail_on_unmatched_files: true
+          token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
+          files: |
+            cryptomator-*.AppImage
+            cryptomator-*.zsync
+            cryptomator-*.asc
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,6 +32,7 @@ jobs:
          restore-keys: ${{ runner.os }}-sonar
      - name: Build and Test
        run: >
+          xvfb-run
          mvn -B verify
          jacoco:report
          org.sonarsource.scanner.maven:sonar-maven-plugin:sonar
@@ -42,10 +43,27 @@ jobs:
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-      - name: Upload code coverage report
-        id: codacyCoverageReporter
-        if: "github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'pr:safe')"
-        run: bash <(curl -Ls https://coverage.codacy.com/get.sh)
+      - name: Sign source tarball with key 615D449FE6E6A235
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          git archive --prefix="cryptomator-${{ github.ref_name }}/" -o "cryptomator-${{ github.ref_name }}.tar.gz" ${{ github.ref }}
+          echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
+          echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator-*.tar.gz
        env:
-          CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
-        continue-on-error: true
+          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
+          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
+      - name: Draft a release
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v1
+        with:
+          draft: true
+          discussion_category_name: releases
+          token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
+          generate_release_notes: true
+          files: |
+            cryptomator-*.tar.gz.asc
+          fail_on_unmatched_files: true
+          body: |-
+            :construction: Work in Progress
+            
+            ---
--- a/.github/workflows/debian.yml
+++ b/.github/workflows/debian.yml
@@ -0,0 +1,124 @@
+name: Build Debian Package
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      dput:
+        description: 'Upload to PPA'
+        required: true
+        default: false
+        type: boolean
+      version:
+        description: 'Version'
+        required: false
+
+env:
+  JAVA_VERSION: 17
+
+jobs:
+  build:
+    name: Build Debian Package
+    runs-on: ubuntu-18.04
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Install build tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install debhelper devscripts dput
+      - name: Setup Java
+        uses: actions/setup-java@v2
+        with:
+          distribution: 'temurin'
+          java-version: ${{ env.JAVA_VERSION }}
+          cache: 'maven'
+      - id: versions 
+        name: Apply version information
+        run: |
+          if [[ $GITHUB_REF =~ refs/tags/[0-9]+\.[0-9]+\.[0-9]+.* ]]; then
+            SEM_VER_STR=${GITHUB_REF##*/}
+            mvn versions:set -DnewVersion=${SEM_VER_STR}
+          elif [[ "${{ github.event.inputs.version }}" =~ [0-9]+\.[0-9]+\.[0-9]+.* ]]; then
+            SEM_VER_STR="${{ github.event.inputs.version }}"
+            mvn versions:set -DnewVersion=${SEM_VER_STR}
+          else
+            SEM_VER_STR=`mvn help:evaluate -Dexpression=project.version -q -DforceStdout`
+          fi
+          SEM_VER_NUM=`echo ${SEM_VER_STR} | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/'`
+          REVCOUNT=`git rev-list --count HEAD`
+          echo "::set-output name=semVerStr::${SEM_VER_STR}"
+          echo "::set-output name=semVerNum::${SEM_VER_NUM}"
+          echo "::set-output name=revNum::${REVCOUNT}"
+          echo "::set-output name=ppaVerStr::${SEM_VER_STR/-/\~}-${REVCOUNT}"
+      - name: Validate Version
+        uses: skymatic/semver-validation-action@v1
+        with:
+          version: ${{ steps.versions.outputs.semVerStr }}
+      - name: Run maven
+        run: mvn -B clean package -Pdependency-check,linux -DskipTests
+      - name: Create orig.tar.gz with common/ libs/ mods/
+        run: |
+          mkdir pkgdir
+          cp -r target/libs pkgdir
+          cp -r target/mods pkgdir
+          cp -r dist/linux/common/ pkgdir
+          cp target/cryptomator-*.jar pkgdir/mods
+          tar -cJf cryptomator_${{ steps.versions.outputs.ppaVerStr }}.orig.tar.xz -C pkgdir .
+      - name: Patch and rename pkgdir
+        run: |
+          cp -r dist/linux/debian/ pkgdir
+          export RFC2822_TIMESTAMP=`date --rfc-2822`
+          envsubst '${SEMVER_STR} ${VERSION_NUM} ${REVISION_NUM}' < dist/linux/debian/rules > pkgdir/debian/rules
+          envsubst '${PPA_VERSION} ${RFC2822_TIMESTAMP}' < dist/linux/debian/changelog > pkgdir/debian/changelog
+          find . -name "*.jar" >> pkgdir/debian/source/include-binaries
+          mv pkgdir cryptomator_${{ steps.versions.outputs.ppaVerStr }}
+        env:
+          SEMVER_STR: ${{ steps.versions.outputs.semVerStr }}
+          VERSION_NUM: ${{ steps.versions.outputs.semVerNum }}
+          REVISION_NUM: ${{ steps.versions.outputs.revNum }}
+          PPA_VERSION: ${{ steps.versions.outputs.ppaVerStr }}-0ppa1
+      - name: Prepare GPG-Agent for signing with key 615D449FE6E6A235
+        run: |
+          echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
+          echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --dry-run --sign README.md
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
+          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
+      - name: debuild
+        run: |
+          debuild -S -sa -d
+          debuild -b -sa -d
+        env:
+          DEBSIGN_PROGRAM: gpg --batch --pinentry-mode loopback
+          DEBSIGN_KEYID: 615D449FE6E6A235
+        working-directory: cryptomator_${{ steps.versions.outputs.ppaVerStr }}
+      - name: Create detached GPG signatures
+        run: |
+          gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator_*_amd64.deb
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: linux-deb-package
+          path: |
+            cryptomator_*.dsc
+            cryptomator_*.orig.tar.xz
+            cryptomator_*.debian.tar.xz
+            cryptomator_*_source.buildinfo
+            cryptomator_*_source.changes
+            cryptomator_*_amd64.deb
+            cryptomator_*.asc
+      - name: Publish on PPA
+        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.dput == 'true'
+        run: dput ppa:sebastian-stenzel/cryptomator-beta cryptomator_*_source.changes
+      - name: Publish Debian package on GitHub Releases
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v1
+        with:
+          fail_on_unmatched_files: true
+          token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
+          files: |
+            cryptomator_*_amd64.deb
+            cryptomator_*.asc
--- a/.github/workflows/mac-dmg.yml
+++ b/.github/workflows/mac-dmg.yml
@@ -0,0 +1,239 @@
+name: Build macOS .dmg
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version'
+        required: false
+
+env:
+  JAVA_VERSION: 17
+
+jobs:
+  build:
+    name: Build Cryptomator.app
+    runs-on: macos-11
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Setup Java
+        uses: actions/setup-java@v2
+        with:
+          distribution: 'temurin'
+          java-version: ${{ env.JAVA_VERSION }}
+          cache: 'maven'
+      - id: versions 
+        name: Apply version information
+        run: |
+          if [[ $GITHUB_REF =~ refs/tags/[0-9]+\.[0-9]+\.[0-9]+.* ]]; then
+            SEM_VER_STR=${GITHUB_REF##*/}
+            mvn versions:set -DnewVersion=${SEM_VER_STR}
+          elif [[ "${{ github.event.inputs.version }}" =~ [0-9]+\.[0-9]+\.[0-9]+.* ]]; then
+            SEM_VER_STR="${{ github.event.inputs.version }}"
+            mvn versions:set -DnewVersion=${SEM_VER_STR}
+          else
+            SEM_VER_STR=`mvn help:evaluate -Dexpression=project.version -q -DforceStdout`
+          fi
+          SEM_VER_NUM=`echo ${SEM_VER_STR} | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/'`
+          REVCOUNT=`git rev-list --count HEAD`
+          echo "::set-output name=semVerStr::${SEM_VER_STR}"
+          echo "::set-output name=semVerNum::${SEM_VER_NUM}"
+          echo "::set-output name=revNum::${REVCOUNT}"
+      - name: Validate Version
+        uses: skymatic/semver-validation-action@v1
+        with:
+          version: ${{ steps.versions.outputs.semVerStr }}
+      - name: Run maven
+        run: mvn -B clean package -Pdependency-check,mac -DskipTests
+      - name: Patch target dir
+        run: |
+          cp LICENSE.txt target
+          cp dist/mac/launcher.sh target
+          cp target/cryptomator-*.jar target/mods
+      - name: Run jlink
+        run: >
+          ${JAVA_HOME}/bin/jlink
+          --verbose
+          --output runtime
+          --module-path "${JAVA_HOME}/jmods"
+          --add-modules java.base,java.desktop,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,jdk.unsupported,jdk.crypto.ec,jdk.accessibility,jdk.management.jfr
+          --strip-native-commands
+          --no-header-files
+          --no-man-pages
+          --strip-debug
+          --compress=1
+      - name: Run jpackage
+        run: >
+          ${JAVA_HOME}/bin/jpackage
+          --verbose
+          --type app-image
+          --runtime-image runtime
+          --input target/libs
+          --module-path target/mods
+          --module org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator
+          --dest appdir
+          --name Cryptomator
+          --vendor "Skymatic GmbH"
+          --copyright "(C) 2016 - 2022 Skymatic GmbH"
+          --app-version "${{ steps.versions.outputs.semVerNum }}"
+          --java-options "-Xss5m"
+          --java-options "-Xmx256m"
+          --java-options "-Dcryptomator.appVersion=\"${{ steps.versions.outputs.semVerStr }}\""
+          --java-options "-Dfile.encoding=\"utf-8\""
+          --java-options "-Dapple.awt.enableTemplateImages=true"
+          --java-options "-Dcryptomator.logDir=\"~/Library/Logs/Cryptomator\""
+          --java-options "-Dcryptomator.pluginDir=\"~/Library/Application Support/Cryptomator/Plugins\""
+          --java-options "-Dcryptomator.settingsPath=\"~/Library/Application Support/Cryptomator/settings.json\""
+          --java-options "-Dcryptomator.ipcSocketPath=\"~/Library/Application Support/Cryptomator/ipc.socket\""
+          --java-options "-Dcryptomator.showTrayIcon=true"
+          --java-options "-Dcryptomator.buildNumber=\"dmg-${{ steps.versions.outputs.revNum }}\""
+          --mac-package-identifier org.cryptomator
+          --resource-dir dist/mac/resources
+      - name: Patch Cryptomator.app
+        run: |
+          mv appdir/Cryptomator.app Cryptomator.app
+          mv dist/mac/resources/Cryptomator-Vault.icns Cryptomator.app/Contents/Resources/
+          sed -i '' "s|###BUNDLE_SHORT_VERSION_STRING###|${VERSION_NO}|g" Cryptomator.app/Contents/Info.plist
+          sed -i '' "s|###BUNDLE_VERSION###|${REVISION_NO}|g" Cryptomator.app/Contents/Info.plist
+        env:
+          VERSION_NO: ${{ steps.versions.outputs.semVerNum }}
+          REVISION_NO: ${{ steps.versions.outputs.revNum }}
+      - name: Install codesign certificate
+        run: |
+          # create variables
+          CERTIFICATE_PATH=$RUNNER_TEMP/codesign.p12
+          KEYCHAIN_PATH=$RUNNER_TEMP/codesign.keychain-db
+
+          # import certificate and provisioning profile from secrets
+          echo -n "$CODESIGN_P12_BASE64" | base64 --decode --output $CERTIFICATE_PATH
+
+          # create temporary keychain
+          security create-keychain -p "$CODESIGN_TMP_KEYCHAIN_PW" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 900 $KEYCHAIN_PATH
+          security unlock-keychain -p "$CODESIGN_TMP_KEYCHAIN_PW" $KEYCHAIN_PATH
+
+          # import certificate to keychain
+          security import $CERTIFICATE_PATH -P "$CODESIGN_P12_PW" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+        env:
+          CODESIGN_P12_BASE64: ${{ secrets.MACOS_CODESIGN_P12_BASE64 }}
+          CODESIGN_P12_PW: ${{ secrets.MACOS_CODESIGN_P12_PW }}
+          CODESIGN_TMP_KEYCHAIN_PW: ${{ secrets.MACOS_CODESIGN_TMP_KEYCHAIN_PW }}
+      - name: Codesign
+        run: |
+          find Cryptomator.app/Contents/runtime/Contents/MacOS -name '*.dylib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
+          for JAR_PATH in `find Cryptomator.app -name "*.jar"`; do
+            if [[ `unzip -l ${JAR_PATH} | grep '.dylib\|.jnilib'` ]]; then
+              JAR_FILENAME=$(basename ${JAR_PATH})
+              OUTPUT_PATH=${JAR_PATH%.*}
+              echo "Codesigning libs in ${JAR_FILENAME}..."
+              unzip -q ${JAR_PATH} -d ${OUTPUT_PATH}
+              find ${OUTPUT_PATH} -name '*.dylib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
+              find ${OUTPUT_PATH} -name '*.jnilib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
+              rm ${JAR_PATH}
+              pushd ${OUTPUT_PATH} > /dev/null
+              zip -qr ../${JAR_FILENAME} *
+              popd > /dev/null
+              rm -r ${OUTPUT_PATH}
+            fi
+          done
+          echo "Codesigning Cryptomator.app..."
+          codesign --force --deep --entitlements dist/mac/Cryptomator.entitlements -o runtime -s ${CODESIGN_IDENTITY} Cryptomator.app
+        env:
+          CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }}
+      - name: Prepare .dmg contents
+        run: |
+          mkdir dmg
+          mv Cryptomator.app dmg
+          cp dist/mac/dmg/resources/macFUSE.webloc dmg
+          ls -l dmg
+      - name: Install create-dmg
+        run: |
+          brew install create-dmg
+          create-dmg --help
+      - name: Create .dmg
+        run: >
+          create-dmg
+          --volname Cryptomator
+          --volicon "dist/mac/dmg/resources/Cryptomator-Volume.icns"
+          --background "dist/mac/dmg/resources/Cryptomator-background.tiff"
+          --window-pos 400 100
+          --window-size 640 694
+          --icon-size 128
+          --icon "Cryptomator.app" 128 245
+          --hide-extension "Cryptomator.app"
+          --icon "macFUSE.webloc" 320 501
+          --hide-extension "macFUSE.webloc"
+          --app-drop-link 512 245
+          --eula "dist/mac/dmg/resources/license.rtf"
+          --icon ".background" 128 758
+          --icon ".fseventsd" 320 758
+          --icon ".VolumeIcon.icns" 512 758
+          Cryptomator-${VERSION_NO}.dmg dmg
+        env:
+          VERSION_NO: ${{ steps.versions.outputs.semVerNum }}
+      - name: Install notarization credentials
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          # create temporary keychain
+          KEYCHAIN_PATH=$RUNNER_TEMP/notarization.keychain-db
+          security create-keychain -p "${NOTARIZATION_TMP_KEYCHAIN_PW}" ${KEYCHAIN_PATH}
+          security set-keychain-settings -lut 900 ${KEYCHAIN_PATH}
+          security unlock-keychain -p "${NOTARIZATION_TMP_KEYCHAIN_PW}" ${KEYCHAIN_PATH}
+
+          # import credentials from secrets
+          sudo xcode-select -s /Applications/Xcode_13.0.app
+          xcrun notarytool store-credentials "${NOTARIZATION_KEYCHAIN_PROFILE}" --apple-id "${NOTARIZATION_APPLE_ID}" --password "${NOTARIZATION_PW}" --team-id "${NOTARIZATION_TEAM_ID}" --keychain "${KEYCHAIN_PATH}"
+        env:
+          NOTARIZATION_KEYCHAIN_PROFILE: ${{ secrets.MACOS_NOTARIZATION_KEYCHAIN_PROFILE }}
+          NOTARIZATION_APPLE_ID: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
+          NOTARIZATION_PW: ${{ secrets.MACOS_NOTARIZATION_PW }}
+          NOTARIZATION_TEAM_ID: ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }}
+          NOTARIZATION_TMP_KEYCHAIN_PW: ${{ secrets.MACOS_NOTARIZATION_TMP_KEYCHAIN_PW }}
+      - name: Notarize .dmg
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          KEYCHAIN_PATH=$RUNNER_TEMP/notarization.keychain-db
+          sudo xcode-select -s /Applications/Xcode_13.0.app
+          xcrun notarytool submit Cryptomator-*.dmg --keychain-profile "${NOTARIZATION_KEYCHAIN_PROFILE}" --keychain "${KEYCHAIN_PATH}" --wait
+          xcrun stapler staple Cryptomator-*.dmg
+        env:
+          NOTARIZATION_KEYCHAIN_PROFILE: ${{ secrets.MACOS_NOTARIZATION_KEYCHAIN_PROFILE }}
+      - name: Add possible alpha/beta tags to installer name
+        run: mv Cryptomator-*.dmg Cryptomator-${{ steps.versions.outputs.semVerStr }}.dmg
+      - name: Create detached GPG signature with key 615D449FE6E6A235
+        run: |
+          echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
+          echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a Cryptomator-*.dmg
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
+          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
+      - name: Clean up codesign certificate
+        if: ${{ always() }}
+        run: security delete-keychain $RUNNER_TEMP/codesign.keychain-db
+        continue-on-error: true
+      - name: Clean up notarization credentials
+        if: ${{ always() }}
+        run: security delete-keychain $RUNNER_TEMP/notarization.keychain-db
+        continue-on-error: true
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: dmg
+          path: Cryptomator-*.dmg
+          if-no-files-found: error
+      - name: Publish dmg on GitHub Releases
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v1
+        with:
+          fail_on_unmatched_files: true
+          token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
+          files: |
+            Cryptomator-*.dmg
+            Cryptomator-*.asc
+
+
--- a/.github/workflows/pullrequest.yml
+++ b/.github/workflows/pullrequest.yml
@@ -23,4 +23,4 @@ jobs:
          java-version: ${{ env.JAVA_VERSION }}
          cache: 'maven'
      - name: Build and Test
-        run: mvn -B clean install jacoco:report -Pcoverage,dependency-check
+        run: xvfb-run mvn -B clean install jacoco:report -Pcoverage,dependency-check
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,633 +0,0 @@
-name: Installers and Release
-
-on:
-  workflow_dispatch:
-    inputs:
-      semver:
-        description: 'SemVer'
-        required: true
-        default: '0.99.99-SNAPSHOT'
-  push:
-    tags: # see https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet
-    - '[0-9]+.[0-9]+.[0-9]+'
-    - '[0-9]+.[0-9]+.[0-9]+-*'
-
-env:
-  JAVA_VERSION: 17
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-
-#
-# Buildkit
-#
-  buildkit:
-    name: Build ${{ matrix.profile }}-buildkit
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: true
-      matrix:
-        include:
-        - os: ubuntu-latest
-          profile: linux
-        - os: windows-latest
-          profile: win
-        - os: macos-latest
-          profile: mac
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-java@v2
-        with:
-          distribution: 'temurin'
-          java-version: ${{ env.JAVA_VERSION }}
-          cache: 'maven'
-      - name: Ensure to use tagged version
-        run: mvn versions:set -DnewVersion=${GITHUB_REF##*/} # use shell parameter expansion to strip of 'refs/tags'
-        if: startsWith(github.ref, 'refs/tags/')
-      - name: Build and Test
-        run: mvn -B clean package -Pdependency-check,${{ matrix.profile }}
-      - name: Patch buildkit
-        run: |
-          cp LICENSE.txt target
-          cp dist/${{ matrix.profile }}/launcher* target
-          cp target/cryptomator-*.jar target/mods
-      - name: Upload ${{ matrix.profile }}-buildkit
-        uses: actions/upload-artifact@v2
-        with:
-          name: ${{ matrix.profile }}-buildkit
-          path: |
-            target/libs
-            target/mods
-            target/LICENSE.txt
-            target/launcher*
-          if-no-files-found: error
-
-#
-# Release Metadata
-#
-  metadata:
-    name: Determine Version Metadata
-    runs-on: ubuntu-latest
-    outputs:
-      semVerNum: ${{ steps.versions.outputs.semVerNum }}
-      semVerStr: ${{ steps.versions.outputs.semVerStr }}
-      ppaVerStr: ${{ steps.versions.outputs.ppaVerStr }}
-      revNum: ${{ steps.versions.outputs.revNum }}
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          fetch-depth: 0
-      - id: versions
-        run: |
-          if [[ $GITHUB_REF == refs/tags/* ]]; then
-            SEM_VER_STR=${GITHUB_REF##*/}
-          else
-            SEM_VER_STR=${{ github.event.inputs.semver }}
-          fi
-          SEM_VER_NUM=`echo ${SEM_VER_STR} | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/'`
-          REVCOUNT=`git rev-list --count HEAD`
-          echo "::set-output name=semVerStr::${SEM_VER_STR}"
-          echo "::set-output name=semVerNum::${SEM_VER_NUM}"
-          echo "::set-output name=ppaVerStr::${SEM_VER_STR/-/\~}-${REVCOUNT}"
-          echo "::set-output name=revNum::${REVCOUNT}"
-      - uses: skymatic/semver-validation-action@v1
-        with:
-          version: ${{ steps.versions.outputs.semVerStr }}
-
-#
-# Application Directory
-#
-  appdir:
-    name: Create ${{ matrix.profile }}-appdir
-    needs: [buildkit, metadata]
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: true
-      matrix:
-        include:
-        - os: ubuntu-latest
-          profile: linux
-          jpackageoptions: >
-            --app-version "${{ needs.metadata.outputs.semVerNum }}.${{ needs.metadata.outputs.revNum }}"
-            --java-options "-Dfile.encoding=\"utf-8\""
-            --java-options "-Dcryptomator.logDir=\"~/.local/share/Cryptomator/logs\""
-            --java-options "-Dcryptomator.pluginDir=\"~/.local/share/Cryptomator/plugins\""
-            --java-options "-Dcryptomator.settingsPath=\"~/.config/Cryptomator/settings.json:~/.Cryptomator/settings.json\""
-            --java-options "-Dcryptomator.ipcSocketPath=\"~/.config/Cryptomator/ipc.socket\""
-            --java-options "-Dcryptomator.p12Path=\"~/.config/Cryptomator/key.p12\""
-            --java-options "-Dcryptomator.mountPointsDir=\"~/.local/share/Cryptomator/mnt\""
-            --java-options "-Dcryptomator.showTrayIcon=false"
-            --java-options "-Dcryptomator.buildNumber=\"appimage-${{ needs.metadata.outputs.revNum }}\""
-            --resource-dir dist/linux/resources
-        - os: windows-latest
-          profile: win
-          jpackageoptions: >
-            --app-version "${{ needs.metadata.outputs.semVerNum }}.${{ needs.metadata.outputs.revNum }}"
-            --java-options "-Dfile.encoding=\"utf-8\""
-            --java-options "-Dcryptomator.logDir=\"~/AppData/Roaming/Cryptomator\""
-            --java-options "-Dcryptomator.pluginDir=\"~/AppData/Roaming/Cryptomator/Plugins\""
-            --java-options "-Dcryptomator.settingsPath=\"~/AppData/Roaming/Cryptomator/settings.json\""
-            --java-options "-Dcryptomator.ipcSocketPath=\"~/AppData/Roaming/Cryptomator/ipc.socket\""
-            --java-options "-Dcryptomator.p12Path=\"~/AppData/Roaming/Cryptomator/key.p12\""
-            --java-options "-Dcryptomator.keychainPath=\"~/AppData/Roaming/Cryptomator/keychain.json\""
-            --java-options "-Dcryptomator.mountPointsDir=\"~/Cryptomator\""
-            --java-options "-Dcryptomator.showTrayIcon=true"
-            --java-options "-Dcryptomator.buildNumber=\"msi-${{ needs.metadata.outputs.revNum }}\""
-            --resource-dir dist/win/resources
-            --icon dist/win/resources/Cryptomator.ico
-        - os: macos-latest
-          profile: mac
-          jpackageoptions: >
-            --app-version "${{ needs.metadata.outputs.semVerNum }}"
-            --java-options "-Dfile.encoding=\"utf-8\""
-            --java-options "-Dapple.awt.enableTemplateImages=true"
-            --java-options "-Dcryptomator.logDir=\"~/Library/Logs/Cryptomator\""
-            --java-options "-Dcryptomator.pluginDir=\"~/Library/Application Support/Cryptomator/Plugins\""
-            --java-options "-Dcryptomator.settingsPath=\"~/Library/Application Support/Cryptomator/settings.json\""
-            --java-options "-Dcryptomator.ipcSocketPath=\"~/Library/Application Support/Cryptomator/ipc.socket\""
-            --java-options "-Dcryptomator.p12Path=\"~/Library/Application Support/Cryptomator/key.p12\""
-            --java-options "-Dcryptomator.showTrayIcon=true"
-            --java-options "-Dcryptomator.buildNumber=\"dmg-${{ needs.metadata.outputs.revNum }}\""
-            --mac-package-identifier org.cryptomator
-            --resource-dir dist/mac/resources
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-java@v2
-        with:
-          distribution: 'temurin'
-          java-version: ${{ env.JAVA_VERSION }}
-      - name: Download ${{ matrix.profile }}-buildkit
-        uses: actions/download-artifact@v2
-        with:
-          name: ${{ matrix.profile }}-buildkit
-          path: buildkit
-      - name: Create Runtime Image
-        run: >
-          ${JAVA_HOME}/bin/jlink
-          --verbose
-          --output runtime
-          --module-path "${JAVA_HOME}/jmods"
-          --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,jdk.unsupported,jdk.crypto.ec,jdk.accessibility,jdk.management.jfr
-          --no-header-files
-          --no-man-pages
-          --strip-debug
-          --compress=1
-      - name: Create App Directory
-        run: >
-          ${JAVA_HOME}/bin/jpackage
-          --verbose
-          --type app-image
-          --runtime-image runtime
-          --input buildkit/libs
-          --module-path buildkit/mods
-          --module org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator
-          --dest appdir
-          --name Cryptomator
-          --vendor "Skymatic GmbH"
-          --copyright "(C) 2016 - 2022 Skymatic GmbH"
-          --java-options "-Xss5m"
-          --java-options "-Xmx256m"
-          --java-options "-Dcryptomator.appVersion=\"${{ needs.metadata.outputs.semVerStr }}\""
-          ${{ matrix.jpackageoptions }}
-      - name: Create appdir.tar
-        run: tar -cvf appdir.tar appdir
-      - name: Upload ${{ matrix.profile }}-appdir
-        uses: actions/upload-artifact@v2
-        with:
-          name: ${{ matrix.profile }}-appdir
-          path: appdir.tar
-          if-no-files-found: error
-
-#
-# Linux PPA Source Package
-#
-  ppa:
-    name: Upload source package to PPA
-    needs: [buildkit, metadata]
-    runs-on: ubuntu-18.04
-    steps:
-      - uses: actions/checkout@v2
-      - name: install build tools
-        run: |
-          sudo apt-get update
-          sudo apt-get install debhelper devscripts dput
-      - name: Download linux-buildkit
-        uses: actions/download-artifact@v2
-        with:
-          name: linux-buildkit
-          path: pkgdir
-      - name: create orig.tar.gz
-        run: tar -cJf cryptomator_${{ needs.metadata.outputs.ppaVerStr }}.orig.tar.xz -C pkgdir .
-      - name: patch and rename pkgdir
-        run: |
-          cp -r dist/linux/debian/ pkgdir
-          cp -r dist/linux/resources/ pkgdir
-          export RFC2822_TIMESTAMP=`date --rfc-2822`
-          envsubst '${VERSION_STR} ${VERSION_NUM} ${REVISION_NUM}' < dist/linux/debian/rules > pkgdir/debian/rules
-          envsubst '${VERSION_STR}' < dist/linux/debian/org.cryptomator.Cryptomator.desktop > pkgdir/debian/org.cryptomator.Cryptomator.desktop
-          envsubst '${PPA_VERSION} ${RFC2822_TIMESTAMP}' < dist/linux/debian/changelog > pkgdir/debian/changelog
-          find . -name "*.jar" >> pkgdir/debian/source/include-binaries
-          mv pkgdir cryptomator_${{ needs.metadata.outputs.ppaVerStr }}
-        env:
-          VERSION_STR: ${{ needs.metadata.outputs.semVerStr }}
-          VERSION_NUM: ${{ needs.metadata.outputs.semVerNum }}
-          REVISION_NUM: ${{ needs.metadata.outputs.revNum }}
-          PPA_VERSION: ${{ needs.metadata.outputs.ppaVerStr }}-0ppa1
-      - name: import gpg key 615D449FE6E6A235
-        run: |
-          echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
-          echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --dry-run --sign dist/linux/debian/rules
-        env:
-          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
-          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
-      - name: debuild
-        run: debuild -S -sa -d
-        env:
-          DEBSIGN_PROGRAM: gpg --batch --pinentry-mode loopback
-          DEBSIGN_KEYID: 615D449FE6E6A235
-        working-directory: cryptomator_${{ needs.metadata.outputs.ppaVerStr }}
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v2
-        with:
-          name: linux-deb-source-package
-          path: |
-            cryptomator_*.dsc
-            cryptomator_*.orig.tar.xz
-            cryptomator_*.debian.tar.xz
-            cryptomator_*_source.changes
-            cryptomator_*_source.buildinfo
-      - name: dput to beta repo
-        run: dput ppa:sebastian-stenzel/cryptomator-beta cryptomator_${PPA_VERSION}_source.changes
-        env:
-          PPA_VERSION: ${{ needs.metadata.outputs.ppaVerStr }}-0ppa1
-
-#
-# Linux Cryptomator.AppImage
-# 
-  linux-appimage:
-    name: Build Cryptomator.AppImage
-    runs-on: ubuntu-latest
-    needs: [appdir, metadata]
-    steps:
-      - uses: actions/checkout@v2
-      - name: Download linux-appdir
-        uses: actions/download-artifact@v2
-        with:
-          name: linux-appdir
-      - name: Untar appdir.tar
-        run: |
-          tar -xvf appdir.tar
-      - name: Patch Cryptomator.AppDir
-        run: |
-          mv appdir/Cryptomator Cryptomator.AppDir
-          cp -r dist/linux/appimage/resources/AppDir/* Cryptomator.AppDir/
-          envsubst '${REVISION_NO} ${SEMVER_STR}' < dist/linux/appimage/resources/AppDir/bin/cryptomator.sh > Cryptomator.AppDir/bin/cryptomator.sh
-          ln -s usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg Cryptomator.AppDir/org.cryptomator.Cryptomator.svg
-          ln -s usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg Cryptomator.AppDir/Cryptomator.svg
-          ln -s usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg Cryptomator.AppDir/.DirIcon
-          ln -s usr/share/applications/org.cryptomator.Cryptomator.desktop Cryptomator.AppDir/Cryptomator.desktop
-          ln -s bin/cryptomator.sh Cryptomator.AppDir/AppRun
-        env:
-          REVISION_NO: ${{ needs.metadata.outputs.revNum }}
-          SEMVER_STR: ${{ needs.metadata.outputs.semVerStr }}
-      - name: Extract libjffi.so # workaround for https://github.com/cryptomator/cryptomator-linux/issues/27
-        run: |
-          JFFI_NATIVE_JAR=`ls lib/app/ | grep -e 'jffi-[1-9]\.[0-9]\{1,2\}.[0-9]\{1,2\}-native.jar'`
-          ${JAVA_HOME}/bin/jar -xf lib/app/${JFFI_NATIVE_JAR} /jni/x86_64-Linux/
-          mv jni/x86_64-Linux/* lib/app/libjffi.so
-        working-directory: Cryptomator.AppDir
-      - name: Download AppImageKit
-        run: |
-          curl -L https://github.com/AppImage/AppImageKit/releases/download/13/appimagetool-x86_64.AppImage -o appimagetool.AppImage
-          chmod +x appimagetool.AppImage
-          ./appimagetool.AppImage --appimage-extract
-      - name: Prepare GPG-Agent for signing with key 615D449FE6E6A235
-        run: |
-          echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
-          echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --dry-run --sign Cryptomator.AppDir/AppRun
-        env:
-          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
-          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
-      - name: Build AppImage
-        run: >
-          ./squashfs-root/AppRun Cryptomator.AppDir cryptomator-${{ needs.metadata.outputs.semVerStr }}-x86_64.AppImage
-          -u 'gh-releases-zsync|cryptomator|cryptomator|latest|cryptomator-*-x86_64.AppImage.zsync'
-          --sign --sign-key=615D449FE6E6A235 --sign-args="--batch --pinentry-mode loopback"
-      - name: Upload AppImage
-        uses: actions/upload-artifact@v2
-        with:
-          name: linux-appimage
-          path: |
-            cryptomator-*.AppImage
-            cryptomator-*.AppImage.zsync
-          if-no-files-found: error
-
-#
-# macOS Cryptomator.app
-# 
-  mac-app:
-    name: Build Cryptomator.app
-    runs-on: macos-latest
-    needs: [appdir, metadata]
-    steps:
-      - uses: actions/checkout@v2
-      - name: Download mac-appdir
-        uses: actions/download-artifact@v2
-        with:
-          name: mac-appdir
-      - name: Untar appdir.tar
-        run: tar -xvf appdir.tar
-      - name: Patch Cryptomator.app
-        run: |
-          mv appdir/Cryptomator.app Cryptomator.app
-          mv dist/mac/resources/Cryptomator-Vault.icns Cryptomator.app/Contents/Resources/
-          sed -i '' "s|###BUNDLE_SHORT_VERSION_STRING###|${VERSION_NO}|g" Cryptomator.app/Contents/Info.plist
-          sed -i '' "s|###BUNDLE_VERSION###|${REVISION_NO}|g" Cryptomator.app/Contents/Info.plist
-        env:
-          VERSION_NO: ${{ needs.metadata.outputs.semVerNum }}
-          REVISION_NO: ${{ needs.metadata.outputs.revNum }}
-      - name: Install codesign certificate
-        env:
-          CODESIGN_P12_BASE64: ${{ secrets.MACOS_CODESIGN_P12_BASE64 }}
-          CODESIGN_P12_PW: ${{ secrets.MACOS_CODESIGN_P12_PW }}
-          CODESIGN_TMP_KEYCHAIN_PW: ${{ secrets.MACOS_CODESIGN_TMP_KEYCHAIN_PW }}
-        run: |
-          # create variables
-          CERTIFICATE_PATH=$RUNNER_TEMP/codesign.p12
-          KEYCHAIN_PATH=$RUNNER_TEMP/codesign.keychain-db
-
-          # import certificate and provisioning profile from secrets
-          echo -n "$CODESIGN_P12_BASE64" | base64 --decode --output $CERTIFICATE_PATH
-
-          # create temporary keychain
-          security create-keychain -p "$CODESIGN_TMP_KEYCHAIN_PW" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 900 $KEYCHAIN_PATH
-          security unlock-keychain -p "$CODESIGN_TMP_KEYCHAIN_PW" $KEYCHAIN_PATH
-
-          # import certificate to keychain
-          security import $CERTIFICATE_PATH -P "$CODESIGN_P12_PW" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-      - name: Codesign
-        env:
-          CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }}
-        run: |
-          find Cryptomator.app/Contents/runtime/Contents/MacOS -name '*.dylib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
-          for JAR_PATH in `find Cryptomator.app -name "*.jar"`; do
-            if [[ `unzip -l ${JAR_PATH} | grep '.dylib\|.jnilib'` ]]; then
-              JAR_FILENAME=$(basename ${JAR_PATH})
-              OUTPUT_PATH=${JAR_PATH%.*}
-              echo "Codesigning libs in ${JAR_FILENAME}..."
-              unzip -q ${JAR_PATH} -d ${OUTPUT_PATH}
-              find ${OUTPUT_PATH} -name '*.dylib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
-              find ${OUTPUT_PATH} -name '*.jnilib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
-              rm ${JAR_PATH}
-              pushd ${OUTPUT_PATH} > /dev/null
-              zip -qr ../${JAR_FILENAME} *
-              popd > /dev/null
-              rm -r ${OUTPUT_PATH}
-            fi
-          done
-          echo "Codesigning Cryptomator.app..."
-          codesign --force --deep --entitlements dist/mac/Cryptomator.entitlements -o runtime -s ${CODESIGN_IDENTITY} Cryptomator.app
-      - name: Clean up codesign certificate
-        if: ${{ always() }}
-        run: security delete-keychain $RUNNER_TEMP/codesign.keychain-db
-      - name: Create app.tar
-        run: tar -cvf app.tar Cryptomator.app
-      - name: Upload mac-app
-        uses: actions/upload-artifact@v2
-        with:
-          name: mac-app
-          path: app.tar
-          if-no-files-found: error
-
-#
-# macOS Cryptomator.dmg
-#
-  mac-dmg:
-    name: Build Cryptomator.dmg
-    runs-on: macos-11
-    needs: [mac-app, metadata]
-    steps:
-      - uses: actions/checkout@v2
-      - name: Download mac-appdir
-        uses: actions/download-artifact@v2
-        with:
-          name: mac-app
-      - name: Untar app.tar
-        run: tar -xvf app.tar
-      - name: Prepare .dmg contents
-        run: |
-          mkdir dmg
-          mv Cryptomator.app dmg
-          cp dist/mac/dmg/resources/macFUSE.webloc dmg
-          ls -l dmg
-      - name: Install create-dmg
-        run: |
-          brew install create-dmg
-          create-dmg --help
-      - name: Create .dmg
-        run: >
-          create-dmg
-          --volname Cryptomator
-          --volicon "dist/mac/dmg/resources/Cryptomator-Volume.icns"
-          --background "dist/mac/dmg/resources/Cryptomator-background.tiff"
-          --window-pos 400 100
-          --window-size 640 694
-          --icon-size 128
-          --icon "Cryptomator.app" 128 245
-          --hide-extension "Cryptomator.app"
-          --icon "macFUSE.webloc" 320 501
-          --hide-extension "macFUSE.webloc"
-          --app-drop-link 512 245
-          --eula "dist/mac/dmg/resources/license.rtf"
-          --icon ".background" 128 758
-          --icon ".fseventsd" 320 758
-          --icon ".VolumeIcon.icns" 512 758
-          Cryptomator-${VERSION_NO}.dmg dmg
-        env:
-          VERSION_NO: ${{ needs.metadata.outputs.semVerNum }}
-      - name: Install notarization credentials
-        env:
-          NOTARIZATION_KEYCHAIN_PROFILE: ${{ secrets.MACOS_NOTARIZATION_KEYCHAIN_PROFILE }}
-          NOTARIZATION_APPLE_ID: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
-          NOTARIZATION_PW: ${{ secrets.MACOS_NOTARIZATION_PW }}
-          NOTARIZATION_TEAM_ID: ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }}
-          NOTARIZATION_TMP_KEYCHAIN_PW: ${{ secrets.MACOS_NOTARIZATION_TMP_KEYCHAIN_PW }}
-        run: |
-          # create temporary keychain
-          KEYCHAIN_PATH=$RUNNER_TEMP/notarization.keychain-db
-          security create-keychain -p "${NOTARIZATION_TMP_KEYCHAIN_PW}" ${KEYCHAIN_PATH}
-          security set-keychain-settings -lut 900 ${KEYCHAIN_PATH}
-          security unlock-keychain -p "${NOTARIZATION_TMP_KEYCHAIN_PW}" ${KEYCHAIN_PATH}
-
-          # import credentials from secrets
-          sudo xcode-select -s /Applications/Xcode_13.0.app
-          xcrun notarytool store-credentials "${NOTARIZATION_KEYCHAIN_PROFILE}" --apple-id "${NOTARIZATION_APPLE_ID}" --password "${NOTARIZATION_PW}" --team-id "${NOTARIZATION_TEAM_ID}" --keychain "${KEYCHAIN_PATH}"
-      - name: Notarize .dmg
-        env:
-          NOTARIZATION_KEYCHAIN_PROFILE: ${{ secrets.MACOS_NOTARIZATION_KEYCHAIN_PROFILE }}
-        run: |
-          KEYCHAIN_PATH=$RUNNER_TEMP/notarization.keychain-db
-          sudo xcode-select -s /Applications/Xcode_13.0.app
-          xcrun notarytool submit Cryptomator-*.dmg --keychain-profile "${NOTARIZATION_KEYCHAIN_PROFILE}" --keychain "${KEYCHAIN_PATH}" --wait
-          xcrun stapler staple Cryptomator-*.dmg
-      - name: Clean up notarization credentials
-        if: ${{ always() }}
-        run: security delete-keychain $RUNNER_TEMP/notarization.keychain-db
-      - name: Add possible alpha/beta tags to installer name
-        run: mv Cryptomator-*.dmg Cryptomator-${{ needs.metadata.outputs.semVerStr }}.dmg
-      - name: Upload mac-dmg
-        uses: actions/upload-artifact@v2
-        with:
-          name: mac-dmg
-          path: Cryptomator-*.dmg
-          if-no-files-found: error
-
-#
-# MSI package
-#
-  win-msi:
-    name: Build Cryptomator.msi
-    runs-on: windows-latest
-    needs: [appdir, metadata]
-    steps:
-      - uses: actions/checkout@v2
-      - name: Download win-appdir
-        uses: actions/download-artifact@v2
-        with:
-          name: win-appdir
-      - name: Untar appdir.tar
-        run: tar -xvf appdir.tar
-      - uses: actions/setup-java@v2
-        with:
-          distribution: 'temurin'
-          java-version: ${{ env.JAVA_VERSION }}
-      - name: Patch Application Directory
-        run: |
-          cp dist/win/contrib/* appdir/Cryptomator
-      - name: Fix permissions
-        run: attrib -r appdir/Cryptomator/Cryptomator.exe
-        shell: pwsh
-      - name: Codesign
-        uses: skymatic/code-sign-action@v1
-        with:
-          certificate: ${{ secrets.WIN_CODESIGN_P12_BASE64 }}
-          password: ${{ secrets.WIN_CODESIGN_P12_PW }}
-          certificatesha1: FF52240075AD7D14AF25629FDF69635357C7D14B
-          description: Cryptomator
-          timestampUrl: 'http://timestamp.digicert.com'
-          folder: appdir/Cryptomator
-          recursive: true
-      - name: Create MSI
-        run: >
-          ${JAVA_HOME}/bin/jpackage
-          --verbose
-          --type msi
-          --win-upgrade-uuid bda45523-42b1-4cae-9354-a45475ed4775
-          --app-image appdir/Cryptomator
-          --dest installer
-          --name Cryptomator
-          --vendor "Skymatic GmbH"
-          --copyright "(C) 2016 - 2022 Skymatic GmbH"
-          --app-version "${{ needs.metadata.outputs.semVerNum }}"
-          --win-menu
-          --win-dir-chooser
-          --win-shortcut-prompt
-          --win-update-url "https:\\cryptomator.org"
-          --win-menu-group Cryptomator
-          --resource-dir dist/win/resources
-          --license-file dist/win/resources/license.rtf
-          --file-associations dist/win/resources/FAvaultFile.properties
-        env:
-          JP_WIXWIZARD_RESOURCES: ${{ github.workspace }}/dist/win/resources # requires abs path, used in resources/main.wxs
-      - name: Codesign MSI
-        uses: skymatic/code-sign-action@v1
-        with:
-          certificate: ${{ secrets.WIN_CODESIGN_P12_BASE64 }}
-          password: ${{ secrets.WIN_CODESIGN_P12_PW }}
-          certificatesha1: FF52240075AD7D14AF25629FDF69635357C7D14B
-          description: Cryptomator Installer
-          timestampUrl: 'http://timestamp.digicert.com'
-          folder: installer
-      - name: Add possible alpha/beta tags to installer name
-        run: mv installer/Cryptomator-*.msi installer/Cryptomator-${{ needs.metadata.outputs.semVerStr }}-x64.msi
-      - name: Upload win-msi
-        uses: actions/upload-artifact@v2
-        with:
-          name: win-msi
-          path: installer/*.msi
-          if-no-files-found: error
-
-#
-# Release
-#
-  release:
-    name: Draft a release on Github
-    runs-on: ubuntu-latest
-    needs: [metadata,linux-appimage,mac-dmg,win-msi,ppa]
-    if: startsWith(github.ref, 'refs/tags/') && github.repository == 'cryptomator/cryptomator'
-    steps:
-      - uses: actions/checkout@v2
-      - name: Create tarball
-        run: git archive --prefix="cryptomator-${{ needs.metadata.outputs.semVerStr }}/" -o "cryptomator-${{ needs.metadata.outputs.semVerStr }}.tar.gz" ${{ github.ref }}
-      - name: Download linux appimage
-        uses: actions/download-artifact@v2
-        with:
-          name: linux-appimage
-      - name: Download macOS dmg
-        uses: actions/download-artifact@v2
-        with:
-          name: mac-dmg
-      - name: Download Windows msi
-        uses: actions/download-artifact@v2
-        with:
-          name: win-msi
-      - name: Create detached GPG signature for all release files with key 615D449FE6E6A235
-        run: |
-          echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
-          for FILE in `find . -name "*.AppImage" -o -name "*.dmg" -o -name "*.msi" -o -name "*.zsync" -o -name "*.tar.gz"`; do
-            echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a ${FILE}
-          done
-        env:
-          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
-          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
-      - name: Compute SHA256 checksums of release artifacts
-        run: |
-          SHA256_SUMS=`find . -name "*.AppImage" -o -name "*.dmg" -o -name "*.msi" -o -name "*.tar.gz" | xargs sha256sum`
-          echo "SHA256_SUMS<<EOF" >> $GITHUB_ENV
-          echo "${SHA256_SUMS}" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
-        continue-on-error: true
-      - name: Create release draft
-        uses: softprops/action-gh-release@v1
-        with:
-          draft: true
-          fail_on_unmatched_files: true
-          discussion_category_name: releases
-          token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
-          files: |
-            *.AppImage
-            *.zsync
-            *.asc
-            *.dmg
-            *.msi
-          body: |-
-            :construction: Work in Progress
-            ## What's New
-            ## Bugfixes
-            ## Misc
-            
-            ---
-            
-            :scroll: A complete list of closed issues is available [here](LINK).
-            
-            ---
-            
-            :floppy_disk: SHA-256 checksums of release artifacts:
-            ```
-            ${{ env.SHA256_SUMS }}
-            ```
--- a/.github/workflows/win-exe.yml
+++ b/.github/workflows/win-exe.yml
@@ -0,0 +1,322 @@
+name: Build Windows Installer
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version'
+        required: false
+
+env:
+  JAVA_VERSION: 17
+  WINFSP_MSI: https://github.com/winfsp/winfsp/releases/download/v1.10/winfsp-1.10.22006.msi
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build-msi:
+    name: Build .msi Installer
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Setup Java
+        uses: actions/setup-java@v2
+        with:
+          distribution: 'temurin'
+          java-version: ${{ env.JAVA_VERSION }}
+          cache: 'maven'
+      - id: versions 
+        name: Apply version information
+        run: |
+          if [[ $GITHUB_REF =~ refs/tags/[0-9]+\.[0-9]+\.[0-9]+.* ]]; then
+            SEM_VER_STR=${GITHUB_REF##*/}
+            mvn versions:set -DnewVersion=${SEM_VER_STR}
+          elif [[ "${{ github.event.inputs.version }}" =~ [0-9]+\.[0-9]+\.[0-9]+.* ]]; then
+            SEM_VER_STR="${{ github.event.inputs.version }}"
+            mvn versions:set -DnewVersion=${SEM_VER_STR}
+          else
+            SEM_VER_STR=`mvn help:evaluate -Dexpression=project.version -q -DforceStdout`
+          fi
+          SEM_VER_NUM=`echo ${SEM_VER_STR} | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/'`
+          REVCOUNT=`git rev-list --count HEAD`
+          echo "::set-output name=semVerStr::${SEM_VER_STR}"
+          echo "::set-output name=semVerNum::${SEM_VER_NUM}"
+          echo "::set-output name=revNum::${REVCOUNT}"
+      - name: Validate Version
+        uses: skymatic/semver-validation-action@v1
+        with:
+          version: ${{ steps.versions.outputs.semVerStr }}
+      - name: Run maven
+        run: mvn -B clean package -Pdependency-check,win -DskipTests
+      - name: Patch target dir
+        run: |
+          cp LICENSE.txt target
+          cp dist/linux/launcher.sh target
+          cp target/cryptomator-*.jar target/mods
+      - name: Run jlink
+        run: >
+          ${JAVA_HOME}/bin/jlink
+          --verbose
+          --output runtime
+          --module-path "${JAVA_HOME}/jmods"
+          --add-modules java.base,java.desktop,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,jdk.unsupported,jdk.crypto.ec,jdk.accessibility,jdk.management.jfr
+          --strip-native-commands
+          --no-header-files
+          --no-man-pages
+          --strip-debug
+          --compress=1
+      - name: Run jpackage
+        run: >
+          ${JAVA_HOME}/bin/jpackage
+          --verbose
+          --type app-image
+          --runtime-image runtime
+          --input target/libs
+          --module-path target/mods
+          --module org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator
+          --dest appdir
+          --name Cryptomator
+          --vendor "Skymatic GmbH"
+          --copyright "(C) 2016 - 2022 Skymatic GmbH"
+          --app-version "${{ steps.versions.outputs.semVerNum }}.${{ steps.versions.outputs.revNum }}"
+          --java-options "-Xss5m"
+          --java-options "-Xmx256m"
+          --java-options "-Dcryptomator.appVersion=\"${{ steps.versions.outputs.semVerStr }}\""
+          --java-options "-Dfile.encoding=\"utf-8\""
+          --java-options "-Dcryptomator.logDir=\"~/AppData/Roaming/Cryptomator\""
+          --java-options "-Dcryptomator.pluginDir=\"~/AppData/Roaming/Cryptomator/Plugins\""
+          --java-options "-Dcryptomator.settingsPath=\"~/AppData/Roaming/Cryptomator/settings.json\""
+          --java-options "-Dcryptomator.ipcSocketPath=\"~/AppData/Roaming/Cryptomator/ipc.socket\""
+          --java-options "-Dcryptomator.keychainPath=\"~/AppData/Roaming/Cryptomator/keychain.json\""
+          --java-options "-Dcryptomator.mountPointsDir=\"~/Cryptomator\""
+          --java-options "-Dcryptomator.showTrayIcon=true"
+          --java-options "-Dcryptomator.buildNumber=\"msi-${{ steps.versions.outputs.revNum }}\""
+          --resource-dir dist/win/resources
+          --icon dist/win/resources/Cryptomator.ico
+      - name: Patch Application Directory
+        run: |
+          cp dist/win/contrib/* appdir/Cryptomator
+      - name: Fix permissions
+        run: attrib -r appdir/Cryptomator/Cryptomator.exe
+        shell: pwsh
+      - name: Codesign
+        uses: skymatic/code-sign-action@v1
+        with:
+          certificate: ${{ secrets.WIN_CODESIGN_P12_BASE64 }}
+          password: ${{ secrets.WIN_CODESIGN_P12_PW }}
+          certificatesha1: FF52240075AD7D14AF25629FDF69635357C7D14B
+          description: Cryptomator
+          timestampUrl: 'http://timestamp.digicert.com'
+          folder: appdir/Cryptomator
+          recursive: true
+      - name: Generate license
+        run: >
+          mvn -B license:add-third-party
+          "-Dlicense.thirdPartyFilename=license.rtf"
+          "-Dlicense.fileTemplate=dist/win/resources/licenseTemplate.ftl"
+          "-Dlicense.outputDirectory=dist/win/resources"
+      - name: Create MSI
+        run: >
+          ${JAVA_HOME}/bin/jpackage
+          --verbose
+          --type msi
+          --win-upgrade-uuid bda45523-42b1-4cae-9354-a45475ed4775
+          --app-image appdir/Cryptomator
+          --dest installer
+          --name Cryptomator
+          --vendor "Skymatic GmbH"
+          --copyright "(C) 2016 - 2022 Skymatic GmbH"
+          --app-version "${{ steps.versions.outputs.semVerNum }}"
+          --win-menu
+          --win-dir-chooser
+          --win-shortcut-prompt
+          --win-update-url "https:\\cryptomator.org"
+          --win-menu-group Cryptomator
+          --resource-dir dist/win/resources
+          --license-file dist/win/resources/license.rtf
+          --file-associations dist/win/resources/FAvaultFile.properties
+        env:
+          JP_WIXWIZARD_RESOURCES: ${{ github.workspace }}/dist/win/resources # requires abs path, used in resources/main.wxs
+      - name: Codesign MSI
+        uses: skymatic/code-sign-action@v1
+        with:
+          certificate: ${{ secrets.WIN_CODESIGN_P12_BASE64 }}
+          password: ${{ secrets.WIN_CODESIGN_P12_PW }}
+          certificatesha1: FF52240075AD7D14AF25629FDF69635357C7D14B
+          description: Cryptomator Installer
+          timestampUrl: 'http://timestamp.digicert.com'
+          folder: installer
+      - name: Add possible alpha/beta tags to installer name
+        run: mv installer/Cryptomator-*.msi Cryptomator-${{ steps.versions.outputs.semVerStr }}-x64.msi
+      - name: Create detached GPG signature with key 615D449FE6E6A235
+        run: |
+          echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
+          echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a Cryptomator-*.msi
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
+          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: msi
+          path: |
+            Cryptomator-*.msi
+            Cryptomator-*.asc
+          if-no-files-found: error
+      - name: Publish .msi on GitHub Releases
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v1
+        with:
+          fail_on_unmatched_files: true
+          token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
+          files: |
+            *.msi
+            *.asc
+    outputs:
+      semVerNum: ${{ steps.versions.outputs.semVerNum }}
+      semVerStr: ${{ steps.versions.outputs.semVerStr }}
+      revNum: ${{ steps.versions.outputs.revNum }}
+
+  build-exe:
+    name: Build .exe installer
+    runs-on: windows-latest
+    needs: [build-msi]
+    steps:
+      - uses: actions/checkout@v2
+      - name: Download .msi
+        uses: actions/download-artifact@v2
+        with:
+          name: msi
+          path: dist/win/bundle/resources
+      - name: Strip version info from msi file name
+        run: mv dist/win/bundle/resources/Cryptomator*.msi dist/win/bundle/resources/Cryptomator.msi
+      - uses: actions/setup-java@v2
+        with:
+          distribution: 'temurin'
+          java-version: ${{ env.JAVA_VERSION }}
+          cache: 'maven'
+      - name: Generate license
+        run: >
+          mvn -B license:add-third-party
+          "-Dlicense.thirdPartyFilename=license.rtf"
+          "-Dlicense.fileTemplate=dist/win/bundle/resources/licenseTemplate.ftl"
+          "-Dlicense.outputDirectory=dist/win/bundle/resources"
+      - name: Download WinFsp
+        run:
+          curl --output dist/win/bundle/resources/winfsp.msi -L ${{ env.WINFSP_MSI }}
+      - name: Compile to wixObj file
+        run: >
+          "${WIX}/bin/candle.exe" dist/win/bundle/bundleWithWinfsp.wxs
+          -ext WixBalExtension
+          -out dist/win/bundle/
+          -dBundleVersion="${{ needs.build-msi.outputs.semVerNum }}.${{ needs.build-msi.outputs.revNum }}"
+          -dBundleVendor="Skymatic GmbH"
+          -dBundleCopyright="(C) 2016 - 2022 Skymatic GmbH"
+          -dAboutUrl="https://cryptomator.org"
+          -dHelpUrl="https://cryptomator.org/contact"
+          -dUpdateUrl="https://cryptomator.org/downloads/"
+      - name: Create executable with linker
+        run: >
+          "${WIX}/bin/light.exe" -b dist/win/ dist/win/bundle/bundleWithWinfsp.wixobj
+          -ext WixBalExtension
+          -out installer/unsigned/Cryptomator-Installer.exe
+      - name: Detach burn engine in preparation to sign
+        run: >
+          "${WIX}/bin/insignia.exe"
+          -ib installer/unsigned/Cryptomator-Installer.exe
+          -o tmp/engine.exe
+      - name: Codesign burn engine
+        uses: skymatic/code-sign-action@v1
+        with:
+          certificate: ${{ secrets.WIN_CODESIGN_P12_BASE64 }}
+          password: ${{ secrets.WIN_CODESIGN_P12_PW }}
+          certificatesha1: FF52240075AD7D14AF25629FDF69635357C7D14B
+          description: Cryptomator Installer
+          timestampUrl: 'http://timestamp.digicert.com'
+          folder: tmp
+      - name: Reattach signed burn engine to installer
+        run : >
+          "${WIX}/bin/insignia.exe"
+          -ab tmp/engine.exe installer/unsigned/Cryptomator-Installer.exe
+          -o installer/Cryptomator-Installer.exe
+      - name: Codesign EXE
+        uses: skymatic/code-sign-action@v1
+        with:
+          certificate: ${{ secrets.WIN_CODESIGN_P12_BASE64 }}
+          password: ${{ secrets.WIN_CODESIGN_P12_PW }}
+          certificatesha1: FF52240075AD7D14AF25629FDF69635357C7D14B
+          description: Cryptomator Installer
+          timestampUrl: 'http://timestamp.digicert.com'
+          folder: installer
+      - name: Add possible alpha/beta tags to installer name
+        run: mv installer/Cryptomator-Installer.exe Cryptomator-${{ needs.build-msi.outputs.semVerStr }}-x64.exe
+      - name: Create detached GPG signature with key 615D449FE6E6A235
+        run: |
+          echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
+          echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a Cryptomator-*.exe
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
+          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: exe
+          path: |
+            Cryptomator-*.exe
+            Cryptomator-*.asc
+          if-no-files-found: error
+      - name: Publish .msi on GitHub Releases
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v1
+        with:
+          fail_on_unmatched_files: true
+          token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
+          files: |
+            Cryptomator-*.exe
+            Cryptomator-*.asc
+
+  allowlist:
+    name: Anti Virus Allowlisting
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    needs: [build-msi, build-exe]
+    steps:
+      - name: Download .msi
+        uses: actions/download-artifact@v2
+        with:
+          name: msi
+          path: msi
+      - name: Download .exe
+        uses: actions/download-artifact@v2
+        with:
+          name: exe
+          path: exe
+      - name: Collect files
+        run: |
+          mkdir files
+          cp msi/*.msi files
+          cp exe/*.exe files
+      - name: Upload to Kaspersky
+        uses: SamKirkland/FTP-Deploy-Action@4.3.0
+        with:
+          protocol: ftps
+          server: allowlist.kaspersky-labs.com
+          port: 990
+          username: ${{ secrets.ALLOWLIST_KASPERSKY_USERNAME }}
+          password: ${{ secrets.ALLOWLIST_KASPERSKY_PASSWORD }}
+          local-dir: files/
+      - name: Upload to Avast
+        uses: SamKirkland/FTP-Deploy-Action@4.3.0
+        with:
+          protocol: ftp
+          server: whitelisting.avast.com
+          port: 21
+          username: ${{ secrets.ALLOWLIST_AVAST_USERNAME }}
+          password: ${{ secrets.ALLOWLIST_AVAST_PASSWORD }}
+          local-dir: files/
--- a/.gitignore
+++ b/.gitignore
@@ -21,7 +21,6 @@ pom.xml.versionsBackup
 .idea/dictionaries/**
 !.idea/dictionaries/dict_*
 .idea/compiler.xml
-.idea/encodings.xml
 .idea/jarRepositories.xml
 .idea/uiDesigner.xml
 .idea/**/libraries/
--- a/.idea/encodings.xml
+++ b/.idea/encodings.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="Encoding" defaultCharsetForPropertiesFiles="UTF-8">
+    <file url="file://$PROJECT_DIR$/src/main/java" charset="UTF-8" />
+    <file url="file://$PROJECT_DIR$/src/main/resources" charset="UTF-8" />
+    <file url="PROJECT" charset="UTF-8" />
+  </component>
+</project>
--- a/.idea/runConfigurations/Cryptomator_Linux.xml
+++ b/.idea/runConfigurations/Cryptomator_Linux.xml
@@ -2,7 +2,7 @@
  <configuration default="false" name="Cryptomator Linux" type="Application" factoryName="Application">
    <option name="MAIN_CLASS_NAME" value="org.cryptomator.launcher.Cryptomator" />
    <module name="cryptomator" />
-    <option name="VM_PARAMETERS" value="-Djdk.gtk.version=2 -Duser.language=en -Dcryptomator.settingsPath=&quot;~/.config/Cryptomator/settings.json&quot; -Dcryptomator.p12Path=&quot;~/.config/Cryptomator/key.p12&quot; -Dcryptomator.ipcSocketPath=&quot;~/.config/Cryptomator/ipc.socket&quot; -Dcryptomator.logDir=&quot;~/.local/share/Cryptomator/logs&quot; -Dcryptomator.pluginDir=&quot;~/.local/share/Cryptomator/plugins&quot; -Dcryptomator.mountPointsDir=&quot;~/.local/share/Cryptomator/mnt&quot; -Dcryptomator.showTrayIcon=true -Xss20m -Xmx512m" />
+    <option name="VM_PARAMETERS" value="-Dcryptomator.settingsPath=&quot;~/.config/Cryptomator/settings.json&quot; -Dcryptomator.p12Path=&quot;~/.config/Cryptomator/key.p12&quot; -Dcryptomator.ipcSocketPath=&quot;~/.config/Cryptomator/ipc.socket&quot; -Dcryptomator.logDir=&quot;~/.local/share/Cryptomator/logs&quot; -Dcryptomator.pluginDir=&quot;~/.local/share/Cryptomator/plugins&quot; -Dcryptomator.mountPointsDir=&quot;~/.local/share/Cryptomator/mnt&quot; -Dcryptomator.showTrayIcon=true -Xss20m -Xmx512m" />
    <method v="2">
      <option name="Make" enabled="true" />
    </method>
--- a/.idea/runConfigurations/Cryptomator_Linux_Dev.xml
+++ b/.idea/runConfigurations/Cryptomator_Linux_Dev.xml
@@ -2,7 +2,7 @@
  <configuration default="false" name="Cryptomator Linux Dev" type="Application" factoryName="Application">
    <option name="MAIN_CLASS_NAME" value="org.cryptomator.launcher.Cryptomator" />
    <module name="cryptomator" />
-    <option name="VM_PARAMETERS" value="-Djdk.gtk.version=2 -Duser.language=en -Dcryptomator.settingsPath=&quot;~/.config/Cryptomator-Dev/settings.json&quot; -Dcryptomator.p12Path=&quot;~/.config/Cryptomator-Dev/key.p12&quot; -Dcryptomator.ipcSocketPath=&quot;~/.config/Cryptomator-Dev/ipc.socket&quot; -Dcryptomator.logDir=&quot;~/.local/share/Cryptomator-Dev/logs&quot; -Dcryptomator.pluginDir=&quot;~/.local/share/Cryptomator-Dev/plugins&quot; -Dcryptomator.mountPointsDir=&quot;~/.local/share/Cryptomator-Dev/mnt&quot; -Dcryptomator.showTrayIcon=true -Dfuse.experimental=&quot;true&quot; -Xss20m -Xmx512m" />
+    <option name="VM_PARAMETERS" value="-Dcryptomator.settingsPath=&quot;~/.config/Cryptomator-Dev/settings.json&quot; -Dcryptomator.p12Path=&quot;~/.config/Cryptomator-Dev/key.p12&quot; -Dcryptomator.ipcSocketPath=&quot;~/.config/Cryptomator-Dev/ipc.socket&quot; -Dcryptomator.logDir=&quot;~/.local/share/Cryptomator-Dev/logs&quot; -Dcryptomator.pluginDir=&quot;~/.local/share/Cryptomator-Dev/plugins&quot; -Dcryptomator.mountPointsDir=&quot;~/.local/share/Cryptomator-Dev/mnt&quot; -Dcryptomator.showTrayIcon=true -Dfuse.experimental=&quot;true&quot; -Xss20m -Xmx512m" />
    <method v="2">
      <option name="Make" enabled="true" />
    </method>
--- a/.idea/runConfigurations/Cryptomator_Windows.xml
+++ b/.idea/runConfigurations/Cryptomator_Windows.xml
@@ -2,7 +2,7 @@
  <configuration default="false" name="Cryptomator Windows" type="Application" factoryName="Application">
    <option name="MAIN_CLASS_NAME" value="org.cryptomator.launcher.Cryptomator" />
    <module name="cryptomator" />
-    <option name="VM_PARAMETERS" value="-Duser.language=en -Dcryptomator.settingsPath=&quot;~/AppData/Roaming/Cryptomator/settings.json&quot; -Dcryptomator.p12Path=&quot;~/AppData/Roaming/Cryptomator/key.p12&quot; -Dcryptomator.ipcSocketPath=&quot;~/AppData/Roaming/Cryptomator/ipc.socket&quot; -Dcryptomator.logDir=&quot;~/AppData/Roaming/Cryptomator&quot; -Dcryptomator.pluginDir=&quot;~/AppData/Roaming/Cryptomator/Plugins&quot; -Dcryptomator.keychainPath=&quot;~/AppData/Roaming/Cryptomator/keychain.json&quot; -Dcryptomator.mountPointsDir=&quot;~/Cryptomator&quot; -Dcryptomator.showTrayIcon=true -Xss2m -Xmx512m" />
+    <option name="VM_PARAMETERS" value="-Dcryptomator.settingsPath=&quot;~/AppData/Roaming/Cryptomator/settings.json&quot; -Dcryptomator.p12Path=&quot;~/AppData/Roaming/Cryptomator/key.p12&quot; -Dcryptomator.ipcSocketPath=&quot;~/AppData/Roaming/Cryptomator/ipc.socket&quot; -Dcryptomator.logDir=&quot;~/AppData/Roaming/Cryptomator&quot; -Dcryptomator.pluginDir=&quot;~/AppData/Roaming/Cryptomator/Plugins&quot; -Dcryptomator.keychainPath=&quot;~/AppData/Roaming/Cryptomator/keychain.json&quot; -Dcryptomator.mountPointsDir=&quot;~/Cryptomator&quot; -Dcryptomator.showTrayIcon=true -Xss2m -Xmx512m" />
    <method v="2">
      <option name="Make" enabled="true" />
    </method>
--- a/.idea/runConfigurations/Cryptomator_Windows_Dev.xml
+++ b/.idea/runConfigurations/Cryptomator_Windows_Dev.xml
@@ -2,7 +2,7 @@
  <configuration default="false" name="Cryptomator Windows Dev" type="Application" factoryName="Application">
    <option name="MAIN_CLASS_NAME" value="org.cryptomator.launcher.Cryptomator" />
    <module name="cryptomator" />
-    <option name="VM_PARAMETERS" value="-Duser.language=en -Dcryptomator.settingsPath=&quot;~/AppData/Roaming/Cryptomator-Dev/settings.json&quot; -Dcryptomator.p12Path=&quot;~/AppData/Roaming/Cryptomator-Dev/key.p12&quot; -Dcryptomator.ipcSocketPath=&quot;~/AppData/Roaming/Cryptomator-Dev/ipc.socket&quot; -Dcryptomator.logDir=&quot;~/AppData/Roaming/Cryptomator-Dev&quot; -Dcryptomator.pluginDir=&quot;~/AppData/Roaming/Cryptomator-Dev/Plugins&quot; -Dcryptomator.keychainPath=&quot;~/AppData/Roaming/Cryptomator-Dev/keychain.json&quot; -Dcryptomator.mountPointsDir=&quot;~/Cryptomator-Dev&quot; -Dfuse.experimental=&quot;true&quot; -Dcryptomator.showTrayIcon=true -Xss2m -Xmx512m" />
+    <option name="VM_PARAMETERS" value="-Dcryptomator.settingsPath=&quot;~/AppData/Roaming/Cryptomator-Dev/settings.json&quot; -Dcryptomator.p12Path=&quot;~/AppData/Roaming/Cryptomator-Dev/key.p12&quot; -Dcryptomator.ipcSocketPath=&quot;~/AppData/Roaming/Cryptomator-Dev/ipc.socket&quot; -Dcryptomator.logDir=&quot;~/AppData/Roaming/Cryptomator-Dev&quot; -Dcryptomator.pluginDir=&quot;~/AppData/Roaming/Cryptomator-Dev/Plugins&quot; -Dcryptomator.keychainPath=&quot;~/AppData/Roaming/Cryptomator-Dev/keychain.json&quot; -Dcryptomator.mountPointsDir=&quot;~/Cryptomator-Dev&quot; -Dcryptomator.showTrayIcon=true -Xss2m -Xmx512m" />
    <method v="2">
      <option name="Make" enabled="true" />
    </method>
--- a/.idea/runConfigurations/Cryptomator_macOS.xml
+++ b/.idea/runConfigurations/Cryptomator_macOS.xml
@@ -5,7 +5,7 @@
    </envs>
    <option name="MAIN_CLASS_NAME" value="org.cryptomator.launcher.Cryptomator" />
    <module name="cryptomator" />
-    <option name="VM_PARAMETERS" value="-Duser.language=en -Dcryptomator.settingsPath=&quot;~/Library/Application Support/Cryptomator/settings.json&quot; -Dcryptomator.p12Path=&quot;~/Library/Application Support/Cryptomator/key.p12&quot; -Dcryptomator.ipcSocketPath=&quot;~/Library/Application Support/Cryptomator/ipc.socket&quot; -Dcryptomator.logDir=&quot;~/Library/Logs/Cryptomator&quot; -Dcryptomator.pluginDir=&quot;~/Library/Application Support/Cryptomator/Plugins&quot; -Dcryptomator.showTrayIcon=true -Xss2m -Xmx512m -ea" />
+    <option name="VM_PARAMETERS" value="-Dapple.awt.enableTemplateImages=true -Dcryptomator.settingsPath=&quot;~/Library/Application Support/Cryptomator/settings.json&quot; -Dcryptomator.p12Path=&quot;~/Library/Application Support/Cryptomator/key.p12&quot; -Dcryptomator.ipcSocketPath=&quot;~/Library/Application Support/Cryptomator/ipc.socket&quot; -Dcryptomator.logDir=&quot;~/Library/Logs/Cryptomator&quot; -Dcryptomator.pluginDir=&quot;~/Library/Application Support/Cryptomator/Plugins&quot; -Dcryptomator.showTrayIcon=true -Xss2m -Xmx512m -ea" />
    <method v="2">
      <option name="Make" enabled="true" />
    </method>
--- a/.idea/runConfigurations/Cryptomator_macOS_Dev.xml
+++ b/.idea/runConfigurations/Cryptomator_macOS_Dev.xml
@@ -5,7 +5,7 @@
    </envs>
    <option name="MAIN_CLASS_NAME" value="org.cryptomator.launcher.Cryptomator" />
    <module name="cryptomator" />
-    <option name="VM_PARAMETERS" value="-Duser.language=en -Dcryptomator.settingsPath=&quot;~/Library/Application Support/Cryptomator-Dev/settings.json&quot; -Dcryptomator.p12Path=&quot;~/Library/Application Support/Cryptomator-Dev/key.p12&quot; -Dcryptomator.ipcSocketPath=&quot;~/Library/Application Support/Cryptomator-Dev/ipc.socket&quot; -Dcryptomator.logDir=&quot;~/Library/Logs/Cryptomator-Dev&quot; -Dcryptomator.pluginDir=&quot;~/Library/Application Support/Cryptomator-Dev/Plugins&quot; -Dcryptomator.showTrayIcon=true -Xss2m -Xmx512m -ea" />
+    <option name="VM_PARAMETERS" value="-Dapple.awt.enableTemplateImages=true -Dcryptomator.settingsPath=&quot;~/Library/Application Support/Cryptomator-Dev/settings.json&quot; -Dcryptomator.p12Path=&quot;~/Library/Application Support/Cryptomator-Dev/key.p12&quot; -Dcryptomator.ipcSocketPath=&quot;~/Library/Application Support/Cryptomator-Dev/ipc.socket&quot; -Dcryptomator.logDir=&quot;~/Library/Logs/Cryptomator-Dev&quot; -Dcryptomator.pluginDir=&quot;~/Library/Application Support/Cryptomator-Dev/Plugins&quot; -Dcryptomator.showTrayIcon=true -Xss2m -Xmx512m -ea" />
    <method v="2">
      <option name="Make" enabled="true" />
    </method>
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@

 [![Build](https://github.com/cryptomator/cryptomator/workflows/Build/badge.svg)](https://github.com/cryptomator/cryptomator/actions?query=workflow%3ABuild)
 [![Known Vulnerabilities](https://snyk.io/test/github/cryptomator/cryptomator/badge.svg)](https://snyk.io/test/github/cryptomator/cryptomator)
-[![Codacy Badge](https://app.codacy.com/project/badge/Grade/2a0adf3cec6a4143b91035d3924178f1)](https://www.codacy.com/gh/cryptomator/cryptomator/dashboard)
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=cryptomator_cryptomator&metric=alert_status)](https://sonarcloud.io/dashboard?id=cryptomator_cryptomator)
 [![Twitter](https://img.shields.io/badge/twitter-@Cryptomator-blue.svg?style=flat)](http://twitter.com/Cryptomator)
 [![Crowdin](https://badges.crowdin.net/cryptomator/localized.svg)](https://translate.cryptomator.org/)
 [![Latest Release](https://img.shields.io/github/release/cryptomator/cryptomator.svg)](https://github.com/cryptomator/cryptomator/releases/latest)
--- a/dist/linux/appimage/build.sh
+++ b/dist/linux/appimage/build.sh
@@ -9,6 +9,7 @@ command -v mvn >/dev/null 2>&1 || { echo >&2 "mvn not found."; exit 1; }
 command -v curl >/dev/null 2>&1 || { echo >&2 "curl not found."; exit 1; }

 VERSION=$(mvn -f ../../../pom.xml help:evaluate -Dexpression=project.version -q -DforceStdout)
+SEMVER_STR=${VERSION}

 # compile
 mvn -B -f ../../../pom.xml clean package -DskipTests -Plinux
@@ -54,6 +55,12 @@ mv Cryptomator Cryptomator.AppDir
 cp -r resources/AppDir/* Cryptomator.AppDir/
 chmod +x Cryptomator.AppDir/lib/runtime/bin/java
 envsubst '${REVISION_NO}' < resources/AppDir/bin/cryptomator.sh > Cryptomator.AppDir/bin/cryptomator.sh
+cp ../common/org.cryptomator.Cryptomator256.png Cryptomator.AppDir/usr/share/icons/hicolor/256x256/apps/org.cryptomator.Cryptomator.png
+cp ../common/org.cryptomator.Cryptomator512.png Cryptomator.AppDir/usr/share/icons/hicolor/512x512/apps/org.cryptomator.Cryptomator.png
+cp ../common/org.cryptomator.Cryptomator.svg Cryptomator.AppDir/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg
+cp ../common/org.cryptomator.Cryptomator.desktop Cryptomator.AppDir/usr/share/applications/org.cryptomator.Cryptomator.desktop
+cp ../common/org.cryptomator.Cryptomator.metainfo.xml Cryptomator.AppDir/usr/share/metainfo/org.cryptomator.Cryptomator.metainfo.xml
+cp ../common/application-vnd.cryptomator.vault.xml Cryptomator.AppDir/usr/share/mime/packages/application-vnd.cryptomator.vault.xml
 ln -s usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg Cryptomator.AppDir/org.cryptomator.Cryptomator.svg
 ln -s usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg Cryptomator.AppDir/Cryptomator.svg
 ln -s usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg Cryptomator.AppDir/.DirIcon
--- a/dist/linux/appimage/resources/AppDir/usr/share/applications/.gitkeep
+++ b/dist/linux/appimage/resources/AppDir/usr/share/applications/.gitkeep
--- a/dist/linux/appimage/resources/AppDir/usr/share/icons/hicolor/256x256/apps/.gitkeep
+++ b/dist/linux/appimage/resources/AppDir/usr/share/icons/hicolor/256x256/apps/.gitkeep
--- a/dist/linux/appimage/resources/AppDir/usr/share/icons/hicolor/512x512/apps/.gitkeep
+++ b/dist/linux/appimage/resources/AppDir/usr/share/icons/hicolor/512x512/apps/.gitkeep
--- a/dist/linux/appimage/resources/AppDir/usr/share/icons/hicolor/scalable/apps/.gitkeep
+++ b/dist/linux/appimage/resources/AppDir/usr/share/icons/hicolor/scalable/apps/.gitkeep
--- a/dist/linux/appimage/resources/AppDir/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg
+++ b/dist/linux/appimage/resources/AppDir/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg
@@ -1 +0,0 @@
-<svg width="512" height="512" viewBox="0 0 512 512" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg"><path d="m255.4 42.2c-76.9 0-119.4 65.3-119.4 129h238.7c.1-63.8-47.9-129-119.3-129z" fill="#cfcfcf"/><path d="m255.4 66.4c-62.5 0-97 53-97 104.8l97 11 97-11c0-51.8-39-104.8-97-104.8z" fill="#585e62"/><path d="m44.8 378.5c-5 0-9.1-4.1-9.1-9.1 0-4.6 3.5-8.6 8.1-9.1 10.7-1.2 18.4-10.8 17.2-21.5s-10.8-18.4-21.5-17.2-18.4 10.8-17.2 21.5c.3 2.5 1.1 5 2.3 7.3 2.3 4.5.5 10-4 12.2-4.3 2.1-9.4.6-11.9-3.4-10.1-18.2-3.4-41.1 14.8-51.2s41.1-3.4 51.2 14.8 3.4 41.2-14.8 51.2c-4.3 2.4-9.1 3.9-14 4.5-.4 0-.7 0-1.1 0z" fill="#585e62"/><path d="m82.6 258 2.4 1.2c11.1 5.7 15.4 19.2 9.8 30.2l-9.4 18.4c-5.7 11.1-19.2 15.4-30.2 9.8l-2.4-1.2c-11.1-5.7-15.4-19.2-9.8-30.2l9.4-18.4c5.6-11 19.2-15.4 30.2-9.8z" fill="#cfcfcf"/><path d="m86.6 221.3 25.4 13-19.6 38.3c-3.6 7-12.2 9.8-19.2 6.2-7-3.6-9.8-12.2-6.2-19.2z" fill="#585e62"/><circle cx="105.2" cy="218.4" fill="#cfcfcf" r="34.1"/><path d="m121.4 188.5c-13.7-7.6-30.8-4.8-41.5 6.7 18.8.9 33.4 16.8 32.5 35.7-.4 8.1-3.6 15.8-9.1 21.7 18.8.8 34.8-13.7 35.6-32.6.7-13-6.1-25.2-17.5-31.5z" fill="#b1b1b1"/><path d="m467.2 378.5c-.3 0-.7 0-1-.1-20.7-2.3-35.5-21-33.2-41.6 2.3-20.7 21-35.5 41.6-33.2 20.7 2.3 35.5 21 33.2 41.6-.6 4.9-2.1 9.7-4.5 14-2.3 4.5-7.7 6.3-12.2 4s-6.3-7.7-4-12.2c.1-.2.2-.4.3-.6 5.2-9.4 1.8-21.3-7.6-26.5s-21.3-1.8-26.5 7.6-1.8 21.3 7.6 26.5c2.2 1.2 4.7 2 7.2 2.3 5 .5 8.6 5 8 10-.4 4.8-4.3 8.3-8.9 8.2z" fill="#585e62"/><path d="m459.3 316.4-2.4 1.2c-11.1 5.7-24.6 1.3-30.2-9.8l-9.4-18.4c-5.7-11.1-1.3-24.6 9.8-30.2l2.4-1.2c11.1-5.7 24.6-1.3 30.2 9.8l9.4 18.4c5.6 11 1.2 24.6-9.8 30.2z" fill="#cfcfcf"/><path d="m438.8 278.9c-7 3.6-15.6.8-19.2-6.2l-19.6-38.3 25.4-13 19.6 38.3c3.6 7 .8 15.6-6.2 19.2z" fill="#585e62"/><circle cx="406.8" cy="218.4" fill="#cfcfcf" r="34.1"/><path d="m390.6 188.5c13.7-7.6 30.8-4.8 41.5 6.7-18.8.9-33.4 16.8-32.5 35.7.4 8.1 3.6 15.7 9.1 21.7-18.8.9-34.8-13.7-35.7-32.5-.6-13.1 6.2-25.3 17.6-31.6z" fill="#b1b1b1"/><path d="m117.2 469.8c-16.7 0-30.5-18.1-34.3-45.1-2.1-14.5-1-29.7 2.9-42.8 4.3-14.1 11.6-24.4 20.6-29 3.3-1.7 7-2.6 10.8-2.7h47.1v119.5z" fill="#585e62"/><path d="m163.8 469.8c-9.7 0-17.7-18.1-19.9-45.1-1.2-14.5-.6-29.7 1.7-42.8 2.5-14.1 6.7-24.4 11.9-29 2-1.8 4.1-2.7 6.2-2.7 2.2 0 4.2.9 6.3 2.6l22.6 19.9c7.9 7 10.6 29.1 9.2 46.4-1.1 13.3-4.5 23.7-9.2 27.9l-22.6 19.9c-1.9 2-4 2.9-6.2 2.9z" fill="#585e62"/><path d="m168 360.1 22.6 19.9c5.1 4.5 8.1 21.6 6.7 38.2-.9 11-3.6 19.1-6.7 21.9l-22.6 19.9c-8.5 7.5-17.2-8.8-19.5-36.4s2.7-56 11.2-63.5c2.8-2.4 5.7-2.3 8.3 0z" fill="#35393b"/><path d="m390.9 469.8c16.7 0 30.5-18.1 34.3-45.1 2.1-14.5 1-29.7-2.9-42.8-4.3-14.1-11.6-24.4-20.6-29-3.3-1.7-7-2.6-10.8-2.7h-47.1v119.5z" fill="#585e62"/><path d="m344.3 469.8c9.7 0 17.7-18.1 19.9-45.1 1.2-14.5.6-29.7-1.7-42.8-2.5-14.1-6.7-24.4-11.9-29-2-1.8-4.1-2.7-6.2-2.7s-4.2.9-6.3 2.6l-22.6 19.9c-7.9 7-10.6 29.1-9.2 46.4 1.1 13.3 4.5 23.7 9.2 27.9l22.6 19.9c1.9 2 4 2.9 6.2 2.9z" fill="#585e62"/><path d="m340.1 360.1-22.6 19.9c-5.1 4.5-8.1 21.6-6.7 38.1.9 11 3.6 19.1 6.7 21.9l22.6 19.9c8.5 7.5 17.2-8.8 19.5-36.4s-2.7-56-11.2-63.5c-2.8-2.3-5.7-2.2-8.3.1z" fill="#35393b"/><path d="m390 247.5c-2-6.8-2.1-13.9-.3-20.7 6.7-24.2 2.3-50.8 2.3-50.8-84.2-26.3-136.5-.2-136.5-.2s-52.2-26.2-136.5-.2c0 0-4.5 26.7 2.1 50.9 1.8 6.8 1.7 14-.3 20.7-2.3 8-4.9 20.2-4.9 35.8-.2 113.3 139.2 148.3 139.2 148.3s139.4-34.6 139.6-147.9c.1-15.7-2.4-27.9-4.7-35.9z" fill="#cfcfcf"/><path d="m255.2 410.1c-23.1-7.2-119-42.4-118.9-127.1 0-13.5 2.2-23.8 4.1-30.2 3.1-10.4 3.2-21.4.4-31.8-2.8-10.3-3.1-21.4-2.8-29.7 18.4-4.7 36.5-7 53.9-7 34.4.1 54.5 9.6 54.7 9.6l9.3 4.7 8.8-4.7c.1 0 20.2-9.4 54.6-9.4 17.4 0 35.4 2.4 53.8 7.1.3 8.3 0 19.4-2.9 29.7-2.8 10.4-2.7 21.5.3 31.8 1.8 6.3 4 16.7 4 30.2-.2 85.1-96.1 119.7-119.3 126.8z" fill="#49b04a"/><path d="m281.5 259.9c0-14.4-11.6-26.2-26.1-26.2s-26.2 11.6-26.2 26.1c0 12.2 8.4 22.8 20.4 25.5l-14.7 61.7 20.3 5.8 20.3-5.8-14.5-61.7c12-2.6 20.5-13.1 20.5-25.4z" fill="#35393b"/><g fill="#49b04a"><path d="m210.9 101.8c-15.2 0-27.6 12.3-27.6 27.6h55.2c0-15.2-12.3-27.6-27.6-27.6z"/><path d="m296.2 101.8c-15.2 0-27.6 12.3-27.6 27.6h55.2c0-15.2-12.4-27.6-27.6-27.6z"/><circle cx="223.8" cy="146.5" r="5.2"/><circle cx="244.4" cy="146.5" r="5.2"/><circle cx="265" cy="146.5" r="5.2"/><circle cx="285.6" cy="146.5" r="5.2"/></g></svg>
--- a/dist/linux/appimage/resources/AppDir/usr/share/metainfo/.gitkeep
+++ b/dist/linux/appimage/resources/AppDir/usr/share/metainfo/.gitkeep
--- a/dist/linux/appimage/resources/AppDir/usr/share/metainfo/org.cryptomator.Cryptomator.appdata.xml
+++ b/dist/linux/appimage/resources/AppDir/usr/share/metainfo/org.cryptomator.Cryptomator.appdata.xml
@@ -1,69 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- Copyright 2018 Armin Schrenk <armin.schrenk@zoho.eu> -->
-<component type="desktop-application">
-  <id>org.cryptomator.Cryptomator</id>
-  <metadata_license>FSFAP</metadata_license>
-  <project_license>GPL-3.0-or-later</project_license>
-  <name>Cryptomator</name>
-  <summary>Multi-platform client-side encryption tool optimized for cloud storages</summary>
-  <description>
-    <p>
-      Cryptomator offers multi-platform transparent client-side encryption of your files in the cloud.
-    </p>
-    <p>
-      Features:
-      <ul>
-        <li>Works with Dropbox, Google Drive, OneDrive, ownCloud, Nextcloud and any other cloud storage service which synchronizes with a local directory</li>
-        <li>Open Source means: No backdoors, control is better than trust</li>
-        <li>Client-side: No accounts, no data shared with any online service</li>
-        <li>Totally transparent: Just work on the virtual drive as if it were a USB flash drive</li>
-        <li>AES encryption with 256-bit key length</li>
-        <li>File names get encrypted</li>
-        <li>Folder structure gets obfuscated</li>
-        <li>Use as many vaults in your Dropbox as you want, each having individual passwords</li>
-        <li>One thousand commits for the security of your data!! :tada:</li>
-      </ul>
-    </p>
-    <p>
-      Privacy:
-      <ul>
-        <li>256-bit keys (unlimited strength policy bundled with native binaries)</li>
-        <li>Scrypt key derivation</li>
-        <li>Cryptographically secure random numbers for salts, IVs and the masterkey of course</li>
-        <li>Sensitive data is wiped from the heap asap</li>
-        <li>Lightweight: Complexity kills security</li>
-      </ul>
-    </p>
-    <p>
-      Consistency:
-      <ul>
-        <li>HMAC over file contents to recognize changed ciphertext before decryption</li>
-        <li>I/O operations are transactional and atomic, if the filesystems support it</li>
-        <li>Each file contains all information needed for decryption (except for the key of course), no common metadata means no Single Point of Failure</li>
-      </ul>
-    </p>
-  </description>
-  <categories>
-      <category>Office</category>
-      <category>Security</category>
-      <category>FileTools</category>
-      <category>Java</category>
-  </categories>
-  <url type="homepage">http://cryptomator.org</url>
-  <url type="bugtracker">https://github.com/cryptomator/cryptomator/issues</url>
-  <url type="faq">https://community.cryptomator.org/c/kb/faq</url>
-  <url type="help">https://community.cryptomator.org/</url>
-  <url type="donation">https://cryptomator.org/</url>
-  <content_rating type="oars-1.0">
-    <content_attribute id="violence-cartoon">none</content_attribute>
-    <content_attribute id="drugs-alcohol">none</content_attribute>
-    <content_attribute id="sex-nudity">none</content_attribute>
-    <content_attribute id="language-profanity">none</content_attribute>
-    <content_attribute id="social-info">mild</content_attribute> <!-- update checker conencts to https://api.cryptomator.org/updates/latestVersion.json -->
-  </content_rating>
-  <project_group>Cryptomator</project_group>
-  <provides>
-    <binary>cryptomator</binary>
-  </provides>
-  <launchable type="desktop-id">org.cryptomator.Cryptomator.desktop</launchable>
-</component>
--- a/dist/linux/appimage/resources/AppDir/usr/share/mime/packages/.gitkeep
+++ b/dist/linux/appimage/resources/AppDir/usr/share/mime/packages/.gitkeep
--- a/dist/linux/common/application-vnd.cryptomator.vault.xml
+++ b/dist/linux/common/application-vnd.cryptomator.vault.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <mime-info xmlns="http://www.freedesktop.org/standards/shared-mime-info">
-  <mime-type type="application/x-vnd.cryptomator-vault-metadata">
+  <mime-type type="application/vnd.cryptomator.vault">
    <comment>Cryptomator Vault Metadata</comment>
    <glob pattern="*.cryptomator"/>
  </mime-type>
--- a/dist/linux/appimage/resources/AppDir/usr/share/applications/org.cryptomator.Cryptomator.desktop
+++ b/dist/linux/appimage/resources/AppDir/usr/share/applications/org.cryptomator.Cryptomator.desktop
@@ -6,5 +6,6 @@ Icon=org.cryptomator.Cryptomator
 Terminal=false
 Type=Application
 Categories=Utility;Security;FileTools;
-StartupWMClass=org.cryptomator.launcher.Cryptomator
-MimeType=application/vnd.cryptomator.encrypted;application/x-vnd.cryptomator.vault-metadata;
+StartupNotify=true
+StartupWMClass=org.cryptomator.launcher.Cryptomator$MainApp
+MimeType=application/vnd.cryptomator.encrypted;application/vnd.cryptomator.vault;
--- a/dist/linux/common/org.cryptomator.Cryptomator.metainfo.xml
+++ b/dist/linux/common/org.cryptomator.Cryptomator.metainfo.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Copyright 2018 Armin Schrenk <armin.schrenk@zoho.eu> -->
+<component type="desktop-application">
+	<id>org.cryptomator.Cryptomator</id>
+	<metadata_license>FSFAP</metadata_license>
+	<project_license>GPL-3.0-or-later</project_license>
+	<name>Cryptomator</name>
+	<summary>Multi-platform client-side encryption tool optimized for cloud storages</summary>
+
+	<description>
+		<p>
+			Cryptomator provides transparent, client-side encryption for your cloud. Protect your documents from unauthorized
+			access. Cryptomator is free and open source software, so you can rest assured there are no backdoors.
+		</p>
+		<p>
+			Cryptomator encrypts file contents and names using AES. Your passphrase is protected against bruteforcing attempts
+			using scrypt. Directory structures get obfuscated. The only thing which cannot be encrypted without breaking your
+			cloud synchronization is the modification date of your files.
+		</p>
+		<p>
+			Cryptomator is a free and open source software licensed under the GPLv3. This allows anyone to check our code. It
+			is impossible to introduce backdoors for third parties. Also we cannot hide vulnerabilities. And the best thing
+			is: There is no need to trust us, as you can control us!
+		</p>
+		<p>
+			Vendor lock-ins are impossible. Even if we decided to stop development: The source code is already cloned by
+			hundreds of other developers. As you don't need an account, you will never stand in front of locked doors.
+		</p>
+	</description>
+
+	<categories>
+		<category>Office</category>
+		<category>Security</category>
+		<category>FileTools</category>
+	</categories>
+
+	<launchable type="desktop-id">org.cryptomator.Cryptomator.desktop</launchable>
+	<provides>
+		<binary>cryptomator</binary>
+		<mediatype>application/vnd.cryptomator.vault</mediatype>
+		<mediatype>application/vnd.cryptomator.encrypted</mediatype>
+	</provides>
+
+	<screenshots>
+		<screenshot>
+			<caption>Light theme</caption>
+			<image>https://user-images.githubusercontent.com/11858409/156986109-6e58f59c-8b8c-4501-b33b-bb1e33007cea.png</image>
+		</screenshot>
+		<screenshot>
+			<caption>Dark theme</caption>
+			<image>https://user-images.githubusercontent.com/11858409/156986113-6c5d7801-86e0-4643-bc2f-aff9d95d3ce0.png</image>
+		</screenshot>
+	</screenshots>
+
+	<url type="homepage">https://cryptomator.org/</url>
+	<url type="bugtracker">https://github.com/cryptomator/cryptomator/issues/</url>
+	<url type="donation">https://cryptomator.org/donate</url>
+	<url type="faq">https://community.cryptomator.org/c/kb/faq</url>
+	<url type="help">https://community.cryptomator.org/</url>
+	<url type="translate">https://translate.cryptomator.org</url>
+
+	<developer_name>Skymatic GmbH</developer_name>
+
+	<content_rating type="oars-1.1">
+		<content_attribute id="social-info">mild</content_attribute> <!-- update checker connects to https://api.cryptomator.org/updates/latestVersion.json -->
+	</content_rating>
+
+	<releases>
+		<release date="2022-03-30" version="1.6.8"/>
+		<release date="2021-12-16" version="1.6.5"/>
+	</releases>
+</component>
--- a/dist/linux/common/org.cryptomator.Cryptomator.svg
+++ b/dist/linux/common/org.cryptomator.Cryptomator.svg
@@ -1 +1 @@
-<svg width="1110" height="1110" viewBox="0 0 1108.12 940.2" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg"><path d="m552.69 0c-169.1 0-262.45 143.46-262.45 283.52h524.9c0-140.06-105.33-283.52-262.45-283.52z" fill="#cfcfcf"/><path d="m552.69 53.2c-137.37 0-213.21 116.54-213.21 230.32l213.21 24.18 213.21-24.18c0-113.78-85.57-230.32-213.21-230.32z" fill="#585e62"/><path d="m89.8 739.52a20 20 0 0 1 -2.23-39.88 42.8 42.8 0 1 0 -42.22-21.82 20 20 0 0 1 -35 19.31 82.79 82.79 0 1 1 81.76 42.26 21.78 21.78 0 0 1 -2.31.13z" fill="#585e62"/><rect fill="#cfcfcf" height="144.19" rx="49.42" transform="matrix(.8902923 .45538953 -.45538953 .8902923 261.57 -5.69)" width="104.68" x="90.27" y="467.98"/><path d="m149.47 401.27h62.8a0 0 0 0 1 0 0v94.55a31.4 31.4 0 0 1 -31.4 31.4 31.4 31.4 0 0 1 -31.4-31.4v-94.55a0 0 0 0 1 0 0z" fill="#585e62" transform="matrix(.8902923 .45538953 -.45538953 .8902923 231.23 -31.44)"/><circle cx="222.59" cy="387.53" fill="#cfcfcf" r="75.05"/><path d="m258.09 321.8a75.09 75.09 0 0 0 -91.23 14.64 75.06 75.06 0 0 1 51.58 126.06 75.06 75.06 0 0 0 39.65-140.7z" fill="#b1b1b1"/><path d="m1018.31 739.52a22.09 22.09 0 0 1 -2.28-.13 82.8 82.8 0 1 1 81.77-42.26 20 20 0 1 1 -35-19.31 42.8 42.8 0 1 0 -42.23 21.82 20 20 0 0 1 -2.23 39.88z" fill="#585e62"/><rect fill="#cfcfcf" height="144.19" rx="49.42" transform="matrix(-.8902923 .45538953 -.45538953 -.8902923 2071.05 581.27)" width="104.68" x="913.18" y="467.98"/><path d="m927.25 401.27a31.4 31.4 0 0 1 31.4 31.4v94.55a0 0 0 0 1 0 0h-62.8a0 0 0 0 1 0 0v-94.55a31.4 31.4 0 0 1 31.4-31.4z" fill="#585e62" transform="matrix(-.8902923 .45538953 -.45538953 -.8902923 1964.18 455.35)"/><circle cx="885.53" cy="387.53" fill="#cfcfcf" r="75.05"/><path d="m850 321.8a75.08 75.08 0 0 1 91.22 14.64 75.06 75.06 0 0 0 -51.54 126.06 75.05 75.05 0 0 1 -39.68-140.7z" fill="#b1b1b1"/><path d="m248.78 940.2c-36.67 0-67-39.85-75.51-99.15-4.56-31.83-2.26-65.19 6.48-94 9.41-31 25.51-53.59 45.32-63.72a51.72 51.72 0 0 1 23.69-5.84h103.52v262.71z" fill="#585e62"/><path d="m351.43 940.2c-21.26 0-38.85-39.85-43.78-99.15-2.64-31.83-1.31-65.19 3.76-94 5.45-31 14.78-53.59 26.27-63.72 4.39-3.87 9-5.84 13.73-5.84s9.34 2 13.75 5.8l49.7 43.83c17.37 15.32 23.39 64 20.23 102-2.43 29.28-10 52.18-20.19 61.28l-49.69 43.82c-4.44 3.99-9.08 5.98-13.78 5.98z" fill="#585e62"/><path d="m360.57 699 49.65 43.79c11.18 9.9 17.78 47.45 14.78 83.91-2 24.27-7.83 41.95-14.77 48.13l-49.65 43.79c-18.58 16.38-37.79-19.43-42.83-80.07s6-123.1 24.58-139.51c6.15-5.42 12.5-5.04 18.24-.04z" fill="#35393b"/><path d="m850.73 940.2c36.66 0 67-39.85 75.51-99.15 4.56-31.83 2.26-65.19-6.48-94-9.41-31-25.51-53.59-45.32-63.72a51.72 51.72 0 0 0 -23.69-5.84h-103.53v262.71z" fill="#585e62"/><path d="m748.08 940.2c21.26 0 38.85-39.85 43.78-99.15 2.64-31.83 1.31-65.19-3.76-94-5.45-31-14.79-53.59-26.27-63.72-4.4-3.87-9-5.84-13.73-5.84s-9.34 2-13.76 5.8l-49.69 43.83c-17.38 15.32-23.39 64-20.23 102 2.43 29.28 10 52.18 20.19 61.28l49.68 43.82c4.45 3.99 9.09 5.98 13.79 5.98z" fill="#585e62"/><path d="m738.94 699-49.65 43.79c-11.19 9.86-17.8 47.41-14.77 83.87 2 24.27 7.83 41.95 14.77 48.13l49.65 43.79c18.61 16.41 37.78-19.43 42.82-80.07s-6-123.1-24.58-139.51c-6.18-5.38-12.5-5-18.24 0z" fill="#35393b"/><path d="m848.63 451.38a83.62 83.62 0 0 1 -.56-45.6c14.74-53.13 5.06-111.78 5.06-111.78-185.07-57.77-300.13-.48-300.13-.48s-114.79-57.64-300-.45c0 0-9.86 58.64 4.72 111.83a83.69 83.69 0 0 1 -.69 45.59c-5.14 17.57-10.72 44.5-10.77 78.8-.37 249 306 326.08 306 326.08s306.58-76.15 306.95-325.16c0-34.3-5.49-61.21-10.58-78.83z" fill="#cfcfcf"/><path d="m552.34 808.87c-50.72-15.87-261.7-93.25-261.42-279.51 0-29.65 4.89-52.42 9-66.31a128.3 128.3 0 0 0 .91-70c-6.2-22.58-6.9-47.13-6.17-65.29 40.48-10.23 80.2-15.37 118.41-15.32 75.66.12 119.86 21 120.3 21.17l20.39 10.23 19.24-10.32c.11 0 44.36-20.75 120-20.64 38.21.06 77.91 5.32 118.37 15.68.67 18.14-.1 42.71-6.37 65.27a128.33 128.33 0 0 0 .69 70c4 13.91 8.82 36.69 8.77 66.35-.28 187.06-211.26 263.09-262.12 278.69z" fill="#49b04a"/><path d="m610.15 478.76a57.46 57.46 0 1 0 -70.15 55.92l-32.29 135.47 44.67 12.85 44.71-12.71-31.84-135.57a57.46 57.46 0 0 0 44.9-55.96z" fill="#35393b"/><g fill="#49b04a"><path d="m454.94 131.08a60.64 60.64 0 0 0 -60.64 60.64h121.28a60.64 60.64 0 0 0 -60.64-60.64z"/><path d="m642.38 131.08a60.64 60.64 0 0 0 -60.64 60.64h121.26a60.64 60.64 0 0 0 -60.62-60.64z"/><circle cx="483.23" cy="229.43" r="11.52"/><circle cx="528.52" cy="229.43" r="11.52"/><circle cx="573.8" cy="229.43" r="11.52"/><circle cx="619.09" cy="229.43" r="11.52"/></g></svg>
+<svg width="1110" height="1110" viewBox="0 0 1108.12 940.2" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg"><path d="m552.69 0c-169.1 0-262.45 143.46-262.45 283.52h524.9c0-140.06-105.33-283.52-262.45-283.52z" fill="#cfcfcf"/><path d="m552.69 53.2c-137.37 0-213.21 116.54-213.21 230.32l213.21 24.18 213.21-24.18c0-113.78-85.57-230.32-213.21-230.32z" fill="#585e62"/><path d="m89.8 739.52a20 20 0 0 1 -2.23-39.88 42.8 42.8 0 1 0 -42.22-21.82 20 20 0 0 1 -35 19.31 82.79 82.79 0 1 1 81.76 42.26 21.78 21.78 0 0 1 -2.31.13z" fill="#585e62"/><rect fill="#cfcfcf" height="144.19" rx="49.42" transform="matrix(.8902923 .45538953 -.45538953 .8902923 261.57 -5.69)" width="104.68" x="90.27" y="467.98"/><path d="m149.47 401.27h62.8a0 0 0 0 1 0 0v94.55a31.4 31.4 0 0 1 -31.4 31.4 31.4 31.4 0 0 1 -31.4-31.4v-94.55a0 0 0 0 1 0 0z" fill="#585e62" transform="matrix(.8902923 .45538953 -.45538953 .8902923 231.23 -31.44)"/><circle cx="222.59" cy="387.53" fill="#cfcfcf" r="75.05"/><path d="m258.09 321.8a75.09 75.09 0 0 0 -91.23 14.64 75.06 75.06 0 0 1 51.58 126.06 75.06 75.06 0 0 0 39.65-140.7z" fill="#b1b1b1"/><path d="m1018.31 739.52a22.09 22.09 0 0 1 -2.28-.13 82.8 82.8 0 1 1 81.77-42.26 20 20 0 1 1 -35-19.31 42.8 42.8 0 1 0 -42.23 21.82 20 20 0 0 1 -2.23 39.88z" fill="#585e62"/><rect fill="#cfcfcf" height="144.19" rx="49.42" transform="matrix(-.8902923 .45538953 -.45538953 -.8902923 2071.05 581.27)" width="104.68" x="913.18" y="467.98"/><path d="m927.25 401.27a31.4 31.4 0 0 1 31.4 31.4v94.55a0 0 0 0 1 0 0h-62.8a0 0 0 0 1 0 0v-94.55a31.4 31.4 0 0 1 31.4-31.4z" fill="#585e62" transform="matrix(-.8902923 .45538953 -.45538953 -.8902923 1964.18 455.35)"/><circle cx="885.53" cy="387.53" fill="#cfcfcf" r="75.05"/><path d="m850 321.8a75.08 75.08 0 0 1 91.22 14.64 75.06 75.06 0 0 0 -51.54 126.06 75.05 75.05 0 0 1 -39.68-140.7z" fill="#b1b1b1"/><path d="m248.78 940.2c-36.67 0-67-39.85-75.51-99.15-4.56-31.83-2.26-65.19 6.48-94 9.41-31 25.51-53.59 45.32-63.72a51.72 51.72 0 0 1 23.69-5.84h103.52v262.71z" fill="#585e62"/><path d="m351.43 940.2c-21.26 0-38.85-39.85-43.78-99.15-2.64-31.83-1.31-65.19 3.76-94 5.45-31 14.78-53.59 26.27-63.72 4.39-3.87 9-5.84 13.73-5.84s9.34 2 13.75 5.8l49.7 43.83c17.37 15.32 23.39 64 20.23 102-2.43 29.28-10 52.18-20.19 61.28l-49.69 43.82c-4.44 3.99-9.08 5.98-13.78 5.98z" fill="#585e62"/><path d="m360.57 699 49.65 43.79c11.18 9.9 17.78 47.45 14.78 83.91-2 24.27-7.83 41.95-14.77 48.13l-49.65 43.79c-18.58 16.38-37.79-19.43-42.83-80.07s6-123.1 24.58-139.51c6.15-5.42 12.5-5.04 18.24-.04z" fill="#35393b"/><path d="m850.73 940.2c36.66 0 67-39.85 75.51-99.15 4.56-31.83 2.26-65.19-6.48-94-9.41-31-25.51-53.59-45.32-63.72a51.72 51.72 0 0 0 -23.69-5.84h-103.53v262.71z" fill="#585e62"/><path d="m748.08 940.2c21.26 0 38.85-39.85 43.78-99.15 2.64-31.83 1.31-65.19-3.76-94-5.45-31-14.79-53.59-26.27-63.72-4.4-3.87-9-5.84-13.73-5.84s-9.34 2-13.76 5.8l-49.69 43.83c-17.38 15.32-23.39 64-20.23 102 2.43 29.28 10 52.18 20.19 61.28l49.68 43.82c4.45 3.99 9.09 5.98 13.79 5.98z" fill="#585e62"/><path d="m738.94 699-49.65 43.79c-11.19 9.86-17.8 47.41-14.77 83.87 2 24.27 7.83 41.95 14.77 48.13l49.65 43.79c18.61 16.41 37.78-19.43 42.82-80.07s-6-123.1-24.58-139.51c-6.18-5.38-12.5-5-18.24 0z" fill="#35393b"/><path d="m848.63 451.38a83.62 83.62 0 0 1 -.56-45.6c14.74-53.13 5.06-111.78 5.06-111.78-185.07-57.77-300.13-.48-300.13-.48s-114.79-57.64-300-.45c0 0-9.86 58.64 4.72 111.83a83.69 83.69 0 0 1 -.69 45.59c-5.14 17.57-10.72 44.5-10.77 78.8-.37 249 306 326.08 306 326.08s306.58-76.15 306.95-325.16c0-34.3-5.49-61.21-10.58-78.83z" fill="#cfcfcf"/><path d="m552.34 808.87c-50.72-15.87-261.7-93.25-261.42-279.51 0-29.65 4.89-52.42 9-66.31a128.3 128.3 0 0 0 .91-70c-6.2-22.58-6.9-47.13-6.17-65.29 40.48-10.23 80.2-15.37 118.41-15.32 75.66.12 119.86 21 120.3 21.17l20.39 10.23 19.24-10.32c.11 0 44.36-20.75 120-20.64 38.21.06 77.91 5.32 118.37 15.68.67 18.14-.1 42.71-6.37 65.27a128.33 128.33 0 0 0 .69 70c4 13.91 8.82 36.69 8.77 66.35-.28 187.06-211.26 263.09-262.12 278.69z" fill="#49b04a"/><path d="m610.15 478.76a57.46 57.46 0 1 0 -70.15 55.92l-32.29 135.47 44.67 12.85 44.71-12.71-31.84-135.57a57.46 57.46 0 0 0 44.9-55.96z" fill="#35393b"/><g fill="#49b04a"><path d="m454.94 131.08a60.64 60.64 0 0 0 -60.64 60.64h121.28a60.64 60.64 0 0 0 -60.64-60.64z"/><path d="m642.38 131.08a60.64 60.64 0 0 0 -60.64 60.64h121.26a60.64 60.64 0 0 0 -60.62-60.64z"/><circle cx="483.23" cy="229.43" r="11.52"/><circle cx="528.52" cy="229.43" r="11.52"/><circle cx="573.8" cy="229.43" r="11.52"/><circle cx="619.09" cy="229.43" r="11.52"/></g></svg>
--- a/dist/linux/appimage/resources/AppDir/usr/share/icons/hicolor/256x256/apps/org.cryptomator.Cryptomator.png
+++ b/dist/linux/appimage/resources/AppDir/usr/share/icons/hicolor/256x256/apps/org.cryptomator.Cryptomator.png
--- a/dist/linux/appimage/resources/AppDir/usr/share/icons/hicolor/512x512/apps/org.cryptomator.Cryptomator.png
+++ b/dist/linux/appimage/resources/AppDir/usr/share/icons/hicolor/512x512/apps/org.cryptomator.Cryptomator.png
--- a/dist/linux/debian/cryptomator.install
+++ b/dist/linux/debian/cryptomator.install
@@ -1,7 +1,8 @@
 cryptomator usr/lib
 debian/cryptomator.sh usr/lib/cryptomator/bin
-debian/org.cryptomator.Cryptomator.desktop usr/share/applications
-debian/org.cryptomator.Cryptomator.svg usr/share/icons/hicolor/scalable/apps
-debian/org.cryptomator.Cryptomator.png usr/share/icons/hicolor/512x512/apps
-debian/org.cryptomator.Cryptomator.appdata.xml usr/share/metainfo
-debian/cryptomator-vault.xml usr/share/mime/packages
+common/org.cryptomator.Cryptomator.desktop usr/share/applications
+common/org.cryptomator.Cryptomator.svg usr/share/icons/hicolor/scalable/apps
+common/org.cryptomator.Cryptomator256.png usr/share/icons/hicolor/256x256/apps
+common/org.cryptomator.Cryptomator512.png usr/share/icons/hicolor/512x512/apps
+common/org.cryptomator.Cryptomator.metainfo.xml usr/share/metainfo
+common/application-vnd.cryptomator.vault.xml usr/share/mime/packages
--- a/dist/linux/debian/org.cryptomator.Cryptomator.appdata.xml
+++ b/dist/linux/debian/org.cryptomator.Cryptomator.appdata.xml
@@ -1,69 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- Copyright 2018 Armin Schrenk <armin.schrenk@zoho.eu> -->
-<component type="desktop-application">
-  <id>org.cryptomator.Cryptomator</id>
-  <metadata_license>FSFAP</metadata_license>
-  <project_license>GPL-3.0-or-later</project_license>
-  <name>Cryptomator</name>
-  <summary>Multi-platform client-side encryption tool optimized for cloud storages</summary>
-  <description>
-    <p>
-      Cryptomator offers multi-platform transparent client-side encryption of your files in the cloud.
-    </p>
-    <p>
-      Features:
-      <ul>
-        <li>Works with Dropbox, Google Drive, OneDrive, ownCloud, Nextcloud and any other cloud storage service which synchronizes with a local directory</li>
-        <li>Open Source means: No backdoors, control is better than trust</li>
-        <li>Client-side: No accounts, no data shared with any online service</li>
-        <li>Totally transparent: Just work on the virtual drive as if it were a USB flash drive</li>
-        <li>AES encryption with 256-bit key length</li>
-        <li>File names get encrypted</li>
-        <li>Folder structure gets obfuscated</li>
-        <li>Use as many vaults in your Dropbox as you want, each having individual passwords</li>
-        <li>One thousand commits for the security of your data!! :tada:</li>
-      </ul>
-    </p>
-    <p>
-      Privacy:
-      <ul>
-        <li>256-bit keys (unlimited strength policy bundled with native binaries)</li>
-        <li>Scrypt key derivation</li>
-        <li>Cryptographically secure random numbers for salts, IVs and the masterkey of course</li>
-        <li>Sensitive data is wiped from the heap asap</li>
-        <li>Lightweight: Complexity kills security</li>
-      </ul>
-    </p>
-    <p>
-      Consistency:
-      <ul>
-        <li>HMAC over file contents to recognize changed ciphertext before decryption</li>
-        <li>I/O operations are transactional and atomic, if the filesystems support it</li>
-        <li>Each file contains all information needed for decryption (except for the key of course), no common metadata means no Single Point of Failure</li>
-      </ul>
-    </p>
-  </description>
-  <categories>
-      <category>Office</category>
-      <category>Security</category>
-      <category>FileTools</category>
-      <category>Java</category>
-  </categories>
-  <url type="homepage">http://cryptomator.org</url>
-  <url type="bugtracker">https://github.com/cryptomator/cryptomator/issues</url>
-  <url type="faq">https://community.cryptomator.org/c/kb/faq</url>
-  <url type="help">https://community.cryptomator.org/</url>
-  <url type="donation">https://cryptomator.org/</url>
-  <content_rating type="oars-1.0">
-    <content_attribute id="violence-cartoon">none</content_attribute>
-    <content_attribute id="drugs-alcohol">none</content_attribute>
-    <content_attribute id="sex-nudity">none</content_attribute>
-    <content_attribute id="language-profanity">none</content_attribute>
-    <content_attribute id="social-info">mild</content_attribute> <!-- update checker conencts to https://api.cryptomator.org/updates/latestVersion.json -->
-  </content_rating>
-  <project_group>Cryptomator</project_group>
-  <provides>
-    <binary>cryptomator</binary>
-  </provides>
-  <launchable type="desktop-id">org.cryptomator.Cryptomator.desktop</launchable>
-</component>
--- a/dist/linux/debian/org.cryptomator.Cryptomator.desktop
+++ b/dist/linux/debian/org.cryptomator.Cryptomator.desktop
@@ -1,11 +0,0 @@
-[Desktop Entry]
-Name=Cryptomator
-Version=${VERSION_STR}
-Comment=Cloud Storage Encryption Utility
-Exec=/usr/bin/cryptomator %f
-Icon=org.cryptomator.Cryptomator
-Terminal=false
-Type=Application
-Categories=Utility;Security;FileTools;
-StartupWMClass=org.cryptomator.launcher.Cryptomator
-MimeType=application/vnd.cryptomator.encrypted;application/x-vnd.cryptomator.vault-metadata;
--- a/dist/linux/debian/org.cryptomator.Cryptomator.png
+++ b/dist/linux/debian/org.cryptomator.Cryptomator.png
--- a/dist/linux/debian/postinst
+++ b/dist/linux/debian/postinst
@@ -24,7 +24,7 @@ case "$1" in
          mkdir -p /usr/share/desktop-directories
        fi
        xdg-desktop-menu install --novendor /usr/share/applications/org.cryptomator.Cryptomator.desktop
-        xdg-mime install /usr/share/mime/packages/cryptomator-vault.xml
+        xdg-mime install /usr/share/mime/packages/application-vnd.cryptomator.vault.xml
    ;;

    abort-upgrade|abort-remove|abort-deconfigure)
--- a/dist/linux/debian/prerm
+++ b/dist/linux/debian/prerm
@@ -22,7 +22,7 @@ case "$1" in
        echo Removing shortcut

        xdg-desktop-menu uninstall --novendor /usr/share/applications/org.cryptomator.Cryptomator.desktop
-        xdg-mime uninstall /usr/share/mime/packages/cryptomator-vault.xml
+        xdg-mime uninstall /usr/share/mime/packages/application-vnd.cryptomator.vault.xml
    ;;

    failed-upgrade)
--- a/dist/linux/debian/rules
+++ b/dist/linux/debian/rules
@@ -11,8 +11,11 @@ override_dh_auto_clean:
 	rm -rf runtime
 	rm -rf cryptomator
 	rm -rf debian/cryptomator
+	rm -rf resources

 override_dh_auto_build:
+	mkdir resources
+	ln -s ../common/org.cryptomator.Cryptomator512.png resources/cryptomator.png
 	jlink \
 		--output runtime \
 		--add-modules java.base,java.desktop,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,jdk.unsupported,jdk.crypto.ec,jdk.accessibility,jdk.management.jfr \
@@ -39,8 +42,8 @@ override_dh_auto_build:
 		--java-options "-Dcryptomator.ipcSocketPath=\"~/.config/Cryptomator/ipc.socket\"" \
 		--java-options "-Dcryptomator.mountPointsDir=\"~/.local/share/Cryptomator/mnt\"" \
 		--java-options "-Dcryptomator.showTrayIcon=false" \
-		--java-options "-Dcryptomator.buildNumber=\"ppa-${REVISION_NUM}\"" \
-		--java-options "-Dcryptomator.appVersion=\"${VERSION_STR}\"" \
+		--java-options "-Dcryptomator.buildNumber=\"deb-${REVISION_NUM}\"" \
+		--java-options "-Dcryptomator.appVersion=\"${SEMVER_STR}\"" \
 		--app-version "${VERSION_NUM}.${REVISION_NUM}" \
 		--resource-dir resources \
 		--verbose
--- a/dist/linux/debian/source/include-binaries
+++ b/dist/linux/debian/source/include-binaries
@@ -1,2 +1,2 @@
-debian/org.cryptomator.Cryptomator.png
-resources/cryptomator.png
+common/org.cryptomator.Cryptomator256.png
+common/org.cryptomator.Cryptomator512.png
--- a/dist/mac/dmg/.gitignore
+++ b/dist/mac/dmg/.gitignore
@@ -1,4 +1,5 @@
 # created during build
+Cryptomator.app/
 runtime/
 dmg/
-*.dmg
+*.dmg
--- a/dist/win/.gitignore
+++ b/dist/win/.gitignore
@@ -1,3 +1,7 @@
 runtime
 Cryptomator
-installer
+installer
+*.wixobj
+*.pdb
+*.msi
+license.rtf
--- a/dist/win/build.ps1
+++ b/dist/win/build.ps1
@@ -1,11 +1,14 @@
+# check parameters
+$clean = $args[0] -eq "fresh"
+
 # check preconditions
-if ((Get-Command "git" -ErrorAction SilentlyContinue) -eq $null) 
-{ 
+if ((Get-Command "git" -ErrorAction SilentlyContinue) -eq $null)
+{
   Write-Host "Unable to find git.exe in your PATH (try: choco install git)"
   exit 1
 }
-if ((Get-Command "mvn" -ErrorAction SilentlyContinue) -eq $null) 
-{ 
+if ((Get-Command "mvn" -ErrorAction SilentlyContinue) -eq $null)
+{
   Write-Host "Unable to find mvn.cmd in your PATH (try: choco install maven)"
   exit 1
 }
@@ -21,11 +24,19 @@ Write-Output "`$revisionNo=$revisionNo"
 Write-Output "`$buildDir=$buildDir"
 Write-Output "`$Env:JAVA_HOME=$Env:JAVA_HOME"

+$vendor = "Skymatic GmbH"
+$copyright = "(C) 2016 - 2022 Skymatic GmbH"
+
 # compile
 &mvn -B -f $buildDir/../../pom.xml clean package -DskipTests -Pwin
 Copy-Item "$buildDir\..\..\target\cryptomator-*.jar" -Destination "$buildDir\..\..\target\mods"

 # add runtime
+$runtimeImagePath = '.\runtime'
+if ($clean -and (Test-Path -Path $runtimeImagePath)) {
+	Remove-Item -Path $runtimeImagePath -Force -Recurse
+}
+
 & "$Env:JAVA_HOME\bin\jlink" `
 	--verbose `
 	--output runtime `
@@ -36,6 +47,11 @@ Copy-Item "$buildDir\..\..\target\cryptomator-*.jar" -Destination "$buildDir\..\
 	--strip-debug `
 	--compress=1

+$appPath = '.\Cryptomator'
+if ($clean -and (Test-Path -Path $appPath)) {
+	Remove-Item -Path $appPath -Force -Recurse
+}
+
 # create app dir
 & "$Env:JAVA_HOME\bin\jpackage" `
 	--verbose `
@@ -46,8 +62,8 @@ Copy-Item "$buildDir\..\..\target\cryptomator-*.jar" -Destination "$buildDir\..\
 	--module org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator `
 	--dest . `
 	--name Cryptomator `
-	--vendor "Skymatic GmbH" `
-	--copyright "(C) 2016 - 2022 Skymatic GmbH" `
+	--vendor $vendor `
+	--copyright $copyright `
 	--java-options "-Xss5m" `
 	--java-options "-Xmx256m" `
 	--java-options "-Dcryptomator.appVersion=`"$semVerNo`"" `
@@ -64,11 +80,21 @@ Copy-Item "$buildDir\..\..\target\cryptomator-*.jar" -Destination "$buildDir\..\
 	--resource-dir resources `
 	--icon resources/Cryptomator.ico

+#Create RTF license for msi
+&mvn -B -f $buildDir/../../pom.xml license:add-third-party `
+ "-Dlicense.thirdPartyFilename=license.rtf" `
+ "-Dlicense.fileTemplate=$buildDir\resources\licenseTemplate.ftl" `
+ "-Dlicense.outputDirectory=$buildDir\resources\"
+
 # patch app dir
 Copy-Item "contrib\*" -Destination "Cryptomator"
 attrib -r "Cryptomator\Cryptomator.exe"

-# create .msi bundle
+$aboutUrl="https://cryptomator.org"
+$updateUrl="https://cryptomator.org/downloads/"
+$helpUrl="https://cryptomator.org/contact/"
+
+# create .msi
 $Env:JP_WIXWIZARD_RESOURCES = "$buildDir\resources"
 & "$Env:JAVA_HOME\bin\jpackage" `
 	--verbose `
@@ -77,14 +103,41 @@ $Env:JP_WIXWIZARD_RESOURCES = "$buildDir\resources"
 	--app-image Cryptomator `
 	--dest installer `
 	--name Cryptomator `
-	--vendor "Skymatic GmbH" `
-	--copyright "(C) 2016 - 2022 Skymatic GmbH" `
+	--vendor $vendor `
+	--copyright $copyright `
 	--app-version "$semVerNo" `
 	--win-menu `
 	--win-dir-chooser `
 	--win-shortcut-prompt `
-	--win-update-url "https:\\cryptomator.org" `
+	--win-update-url $updateUrl `
 	--win-menu-group Cryptomator `
 	--resource-dir resources `
+	--about-url $aboutUrl `
 	--license-file resources/license.rtf `
 	--file-associations resources/FAvaultFile.properties
+
+#Create RTF license for bundle
+&mvn -B -f $buildDir/../../pom.xml license:add-third-party `
+ "-Dlicense.thirdPartyFilename=license.rtf" `
+ "-Dlicense.fileTemplate=$buildDir\bundle\resources\licenseTemplate.ftl" `
+ "-Dlicense.outputDirectory=$buildDir\bundle\resources\"
+
+# download Winfsp
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+$ProgressPreference = 'SilentlyContinue' # disables Invoke-WebRequest's progress bar, which slows down downloads to a few bytes/s
+$winfspMsiUrl = "https://github.com/winfsp/winfsp/releases/download/v1.10/winfsp-1.10.22006.msi"
+Write-Output "Downloading ${winfspMsiUrl}..."
+Invoke-WebRequest $winfspMsiUrl -OutFile ".\bundle\resources\winfsp.msi" # redirects are followed by default
+
+# copy MSI to bundle resources
+Copy-Item ".\installer\Cryptomator-*.msi" -Destination ".\bundle\resources\Cryptomator.msi"
+
+# create bundle including winfsp
+& "$env:WIX\bin\candle.exe" .\bundle\bundleWithWinfsp.wxs -ext WixBalExtension -out bundle\ `
+	-dBundleVersion="$semVerNo.$revisionNo" `
+	-dBundleVendor="$vendor" `
+	-dBundleCopyright="$copyright" `
+	-dAboutUrl="$aboutUrl" `
+	-dHelpUrl="$helpUrl" `
+	-dUpdateUrl="$updateUrl"
+& "$env:WIX\bin\light.exe" -b . .\bundle\BundlewithWinfsp.wixobj -ext WixBalExtension -out installer\Cryptomator-Installer.exe
--- a/dist/win/bundle/bundleWithWinfsp.wxs
+++ b/dist/win/bundle/bundleWithWinfsp.wxs
@@ -0,0 +1,43 @@
+<?xml version="1.0"?>
+
+<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi" xmlns:bal="http://schemas.microsoft.com/wix/BalExtension">
+    <!-- see https://wixtoolset.org/documentation/manual/v3/xsd/wix/bundle.html-->
+    <!-- Attributes explicitly not used:
+        Condition - the single msi files have their own install conditions, no need to copy them here
+    -->
+    <Bundle Name="Cryptomator" UpgradeCode="29eea626-2e5b-4449-b5f8-4602925ddf7b" Version="$(var.BundleVersion)" Manufacturer="$(var.BundleVendor)"
+     AboutUrl="$(var.AboutUrl)" HelpUrl="$(var.HelpUrl)" UpdateUrl="$(var.UpdateUrl)" Copyright="$(var.BundleCopyright)" IconSourceFile="bundle\resources\Cryptomator.ico">
+
+        <!-- for definition of the standard themes, see https://github.com/wixtoolset/wix3/blob/master/src/ext/BalExtension/wixstdba/Resources/-->
+        <BootstrapperApplicationRef Id="WixStandardBootstrapperApplication.RtfLargeLicense">
+            <!-- see https://wixtoolset.org/documentation/manual/v3/xsd/bal/wixstandardbootstrapperapplication.html -->
+            <!-- Possible Attributes: LaunchTarget -->
+            <bal:WixStandardBootstrapperApplication
+                LicenseFile="bundle\resources\license.rtf"
+                ShowVersion="yes"
+                SuppressOptionsUI="yes"
+                ThemeFile="bundle\customBootstrapperTheme.xml"
+                LocalizationFile="bundle\customBootstrapperTheme.wxl"
+                LogoFile="bundle\resources\logo.png"
+            />
+            <Payload SourceFile="bundle\resources\logoSide.png" />
+        </BootstrapperApplicationRef>
+        <Chain>
+            <!-- see https://wixtoolset.org/documentation/manual/v3/xsd/wix/msipackage.html-->
+            <MsiPackage
+                SourceFile="resources\Cryptomator.msi"
+                CacheId="cryptomator-bundle-cryptomator"
+                DisplayInternalUI="no"
+                Visible="no"
+            />
+            <MsiPackage
+                SourceFile="resources\winfsp.msi"
+                CacheId="cryptomator-bundle-winfsp"
+                Visible="yes"
+                DisplayInternalUI="no"
+                Vital="no"
+                Permanent="yes"
+            />
+        </Chain>
+    </Bundle>
+</Wix>
--- a/dist/win/bundle/customBootstrapperTheme.wxl
+++ b/dist/win/bundle/customBootstrapperTheme.wxl
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->
+
+
+<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">
+  <String Id="Caption">[WixBundleName] Setup</String>
+  <String Id="Title">[WixBundleName]</String>
+  <String Id="InstallHeader">Welcome</String>
+  <String Id="InstallMessage">This Setup will install [WixBundleName] and additional dependencies on your computer.</String>
+  <String Id="InstallVersion">Version [WixBundleVersion]</String>
+  <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>
+  <String Id="ExecuteUpgradeRelatedBundleMessage">Previous version</String>
+  <String Id="HelpHeader">Setup Help</String>
+  <String Id="HelpText">/install | /repair | /uninstall | /layout [directory] - installs, repairs, uninstalls or
+   creates a complete local copy of the bundle in directory. Install is the default.
+
+/passive | /quiet -  displays minimal UI with no prompts or displays no UI and
+   no prompts. By default UI and all prompts are displayed.
+
+/norestart   - suppress any attempts to restart. By default UI will prompt before restart.
+/log log.txt - logs to a specific file. By default a log file is created in %TEMP%.</String>
+  <String Id="HelpCloseButton">&amp;Close</String>
+  <String Id="InstallLicenseLinkText">[WixBundleName] &lt;a href="#"&gt;license terms&lt;/a&gt;.</String>
+  <String Id="InstallAcceptCheckbox">I &amp;agree to the license terms and conditions</String>
+  <String Id="InstallOptionsButton">&amp;Options</String>
+  <String Id="InstallInstallButton">&amp;Install</String>
+  <String Id="InstallCloseButton">&amp;Close</String>
+  <String Id="OptionsHeader">Setup Options</String>
+  <String Id="OptionsLocationLabel">Install location:</String>
+  <String Id="OptionsBrowseButton">&amp;Browse</String>
+  <String Id="OptionsOkButton">&amp;OK</String>
+  <String Id="OptionsCancelButton">&amp;Cancel</String>
+  <String Id="ProgressHeader">Setup Progress</String>
+  <String Id="ProgressLabel">Processing:</String>
+  <String Id="OverallProgressPackageText">Initializing...</String>
+  <String Id="ProgressCancelButton">&amp;Cancel</String>
+  <String Id="ModifyHeader">Modify Setup</String>
+  <String Id="ModifyRepairButton">&amp;Repair</String>
+  <String Id="ModifyUninstallButton">&amp;Uninstall</String>
+  <String Id="ModifyCloseButton">&amp;Close</String>
+  <String Id="SuccessRepairHeader">Repair Successfully Completed</String>
+  <String Id="SuccessUninstallHeader">Uninstall Successfully Completed</String>
+  <String Id="SuccessInstallHeader">Installation Successfully Completed</String> 
+  <String Id="SuccessHeader">Setup Successful</String>	
+  <String Id="SuccessLaunchButton">&amp;Launch</String>
+  <String Id="SuccessRestartText">You must restart your computer before you can use the software.</String>
+  <String Id="SuccessRestartButton">&amp;Restart</String>
+  <String Id="SuccessCloseButton">&amp;Close</String>
+  <String Id="FailureHeader">Setup Failed</String>
+  <String Id="FailureInstallHeader">Setup Failed</String>
+  <String Id="FailureUninstallHeader">Uninstall Failed</String>
+  <String Id="FailureRepairHeader">Repair Failed</String> 
+  <String Id="FailureHyperlinkLogText">One or more issues caused the setup to fail. Please fix the issues and then retry setup. For more information see the &lt;a href="#"&gt;log file&lt;/a&gt;.</String>
+  <String Id="FailureRestartText">You must restart your computer to complete the rollback of the software.</String>
+  <String Id="FailureRestartButton">&amp;Restart</String>
+  <String Id="FailureCloseButton">&amp;Close</String>
+  <String Id="FilesInUseHeader">Files In Use</String>
+  <String Id="FilesInUseLabel">The following applications are using files that need to be updated:</String>
+  <String Id="FilesInUseCloseRadioButton">Close the &amp;applications and attempt to restart them.</String>
+  <String Id="FilesInUseDontCloseRadioButton">&amp;Do not close applications. A reboot will be required.</String>
+  <String Id="FilesInUseOkButton">&amp;OK</String>
+  <String Id="FilesInUseCancelButton">&amp;Cancel</String>
+  <String Id="ErrorFailNoActionReboot">No action was taken as a system reboot is required.</String>
+</WixLocalization>
--- a/dist/win/bundle/customBootstrapperTheme.xml
+++ b/dist/win/bundle/customBootstrapperTheme.xml
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->
+<!-- adjusted theme based on https://github.com/wixtoolset/wix3/blob/master/src/ext/BalExtension/wixstdba/Resources/HyperlinkSidebarTheme.xml -->
+
+
+<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">
+    <Window Width="600" Height="450" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>
+    <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>
+    <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>
+    <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>
+    <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>
+    <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>
+
+    <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" />
+    <Text X="80" Y="11" Width="-11" Height="64" FontId="1" DisablePrefix="yes">#(loc.Title)</Text>
+
+    <Page Name="Help">
+        <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" />
+        <Text X="80" Y="11" Width="-11" Height="64" FontId="1" DisablePrefix="yes">#(loc.Title)</Text>
+        <Text X="11" Y="80" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.HelpHeader)</Text>
+        <Text X="11" Y="112" Width="-11" Height="-35" FontId="3" DisablePrefix="yes">#(loc.HelpText)</Text>
+        <Button Name="HelpCancelButton" X="-11" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0">#(loc.HelpCloseButton)</Button>
+    </Page>
+    <Page Name="Install">
+        <Text X="185" Y="11" Width="-11" Height="32" FontId="1" DisablePrefix="yes">#(loc.Title)</Text>
+        <Image X="11" Y="11" Width="165" Height="400" ImageFile="logoside.png"/>
+        <Text X="185" Y="50" Width="-11" Height="32" FontId="2" DisablePrefix="yes">#(loc.InstallHeader)</Text>
+        <Text X="185" Y="91" Width="-11" Height="64" FontId="3" DisablePrefix="yes">#(loc.InstallMessage)</Text>
+        <Richedit Name="EulaRichedit" X="185" Y="131" Width="-12" Height="-65" HexStyle="0x00800000" TabStop="yes" FontId="0" />
+        <Checkbox Name="EulaAcceptCheckbox" X="185" Y="-46" Width="-11" Height="17" TabStop="yes" FontId="3" HideWhenDisabled="yes">#(loc.InstallAcceptCheckbox)</Checkbox>
+        <Text Name="InstallVersion" X="185" Y="-11" Width="-11" Height="17" FontId="3" DisablePrefix="yes" HideWhenDisabled="yes">#(loc.InstallVersion)</Text>
+        <Button Name="InstallButton" X="-91" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0">#(loc.InstallInstallButton)</Button>
+        <Button Name="WelcomeCancelButton" X="-11" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0">#(loc.InstallCloseButton)</Button>
+    </Page>
+    <Page Name="FilesInUse">
+        <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" />
+        <Text X="80" Y="11" Width="-11" Height="64" FontId="1" DisablePrefix="yes">#(loc.Title)</Text>
+        <Text X="11" Y="80" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.FilesInUseHeader)</Text>
+        <Text X="11" Y="121" Width="-11" Height="34" FontId="3" DisablePrefix="yes">#(loc.FilesInUseLabel)</Text>
+        <Text Name="FilesInUseText" X="11" Y="150" Width="-11" Height="-86" FontId="3" DisablePrefix="yes" HexStyle="0x0000000C">A</Text>
+
+        <Button Name="FilesInUseCloseRadioButton" X="11" Y="-60" Width="-11" Height="23" TabStop="yes" FontId="0" HideWhenDisabled="yes" HexStyle="0x000009">#(loc.FilesInUseCloseRadioButton)</Button>
+        <Button Name="FilesInUseDontCloseRadioButton" X="11" Y="-40" Width="-11" Height="23" TabStop="yes" FontId="0" HideWhenDisabled="yes" HexStyle="0x000009">#(loc.FilesInUseDontCloseRadioButton)</Button>
+
+        <Button Name="FilesInUseOkButton" X="-91" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0" HideWhenDisabled="yes">#(loc.FilesInUseOkButton)</Button>
+        <Button Name="FilesInUseCancelButton" X="-11" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0">#(loc.FilesInUseCancelButton)</Button>
+    </Page>
+    <Page Name="Progress">
+        <Text X="80" Y="11" Width="-11" Height="32" FontId="1" DisablePrefix="yes">#(loc.Title)</Text>
+        <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png"/>
+        <Text X="11" Y="80" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.ProgressHeader)</Text>
+        <Text X="11" Y="141" Width="70" Height="17" FontId="3" DisablePrefix="yes">#(loc.ProgressLabel)</Text>
+        <Text Name="OverallProgressPackageText" X="85" Y="141" Width="-11" Height="17" FontId="3" DisablePrefix="yes">#(loc.OverallProgressPackageText)</Text>
+        <Progressbar Name="OverallCalculatedProgressbar" X="11" Y="163" Width="-11" Height="20" />
+        <Button Name="ProgressCancelButton" X="-11" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0">#(loc.ProgressCancelButton)</Button>
+    </Page>
+    <Page Name="Modify">
+        <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" />
+        <Text X="80" Y="11" Width="-11" Height="64" FontId="1" DisablePrefix="yes">#(loc.Title)</Text>
+        <Text X="11" Y="80" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.ModifyHeader)</Text>
+        <Button Name="RepairButton" X="-171" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0" HideWhenDisabled="yes">#(loc.ModifyRepairButton)</Button>
+        <Button Name="UninstallButton" X="-91" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0">#(loc.ModifyUninstallButton)</Button>
+        <Button Name="ModifyCancelButton" X="-11" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0">#(loc.ModifyCloseButton)</Button>
+    </Page>
+    <Page Name="Success">
+        <Text X="185" Y="11" Width="-11" Height="32" FontId="1" DisablePrefix="yes">#(loc.Title)</Text>
+        <Image X="11" Y="11" Width="165" Height="400" ImageFile="logoside.png"/>
+        <Text Name="SuccessHeader" X="185" Y="50" Width="-11" Height="30" FontId="2" HideWhenDisabled="yes" DisablePrefix="yes">#(loc.SuccessHeader)</Text>
+        <Text Name="SuccessInstallHeader" X="185" Y="50" Width="-11" Height="100" FontId="2" HideWhenDisabled="yes" DisablePrefix="yes">#(loc.SuccessInstallHeader)</Text>
+        <Text Name="SuccessRepairHeader" X="185" Y="50" Width="-11" Height="100" FontId="2" HideWhenDisabled="yes" DisablePrefix="yes">#(loc.SuccessRepairHeader)</Text>
+        <Text Name="SuccessUninstallHeader" X="185" Y="50" Width="-11" Height="30" FontId="2" HideWhenDisabled="yes" DisablePrefix="yes">#(loc.SuccessUninstallHeader)</Text>
+        <Button Name="LaunchButton" X="-91" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0" HideWhenDisabled="yes">#(loc.SuccessLaunchButton)</Button>
+        <Text Name="SuccessRestartText" X="185" Y="-51" Width="400" Height="34" FontId="3" HideWhenDisabled="yes" DisablePrefix="yes">#(loc.SuccessRestartText)</Text>
+        <Button Name="SuccessRestartButton" X="-91" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0" HideWhenDisabled="yes">#(loc.SuccessRestartButton)</Button>
+        <Button Name="SuccessCancelButton" X="-11" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0">#(loc.SuccessCloseButton)</Button>
+    </Page>
+    <Page Name="Failure">
+        <Text X="185" Y="11" Width="-11" Height="32" FontId="1" DisablePrefix="yes">#(loc.Title)</Text>
+        <Image X="11" Y="11" Width="165" Height="400" ImageFile="logoside.png"/>
+        <Text Name="FailureHeader" X="185" Y="50" Width="-11" Height="30" FontId="2" HideWhenDisabled="yes" DisablePrefix="yes">#(loc.FailureHeader)</Text>
+        <Text Name="FailureInstallHeader" X="185" Y="50" Width="-11" Height="30" FontId="2" HideWhenDisabled="yes" DisablePrefix="yes">#(loc.FailureInstallHeader)</Text>
+        <Text Name="FailureUninstallHeader" X="185" Y="50" Width="-11" Height="30" FontId="2" HideWhenDisabled="yes" DisablePrefix="yes">#(loc.FailureUninstallHeader)</Text>
+        <Text Name="FailureRepairHeader" X="185" Y="50" Width="-11" Height="30" FontId="2" HideWhenDisabled="yes" DisablePrefix="yes">#(loc.FailureRepairHeader)</Text>
+        <Hypertext Name="FailureLogFileLink" X="185" Y="121" Width="-11" Height="68" FontId="3" TabStop="yes" HideWhenDisabled="yes">#(loc.FailureHyperlinkLogText)</Hypertext>
+        <Hypertext Name="FailureMessageText" X="185" Y="-115" Width="-11" Height="80" FontId="3" TabStop="yes" HideWhenDisabled="yes" />
+        <Text Name="FailureRestartText" X="185" Y="-57" Width="-11" Height="80" FontId="3" HideWhenDisabled="yes" DisablePrefix="yes">#(loc.FailureRestartText)</Text>
+        <Button Name="FailureRestartButton" X="-91" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0" HideWhenDisabled="yes">#(loc.FailureRestartButton)</Button>
+        <Button Name="FailureCloseButton" X="-11" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0">#(loc.FailureCloseButton)</Button>
+    </Page>
+</Theme>
--- a/dist/win/bundle/resources/Cryptomator.ico
+++ b/dist/win/bundle/resources/Cryptomator.ico
--- a/dist/win/bundle/resources/licenseTemplate.ftl
+++ b/dist/win/bundle/resources/licenseTemplate.ftl
@@ -0,0 +1,41 @@
+<#function artifactFormat p>
+    <#if p.name?index_of('Unnamed') &gt; -1>
+        <#return p.artifactId + " (" + p.groupId + ":" + p.artifactId + ":" + p.version + " - {{\\field{\\*\\fldinst{HYPERLINK " + (p.url!"no url defined") + "}}{\\fldrslt{" + (p.url!"no url defined") + "\\ul0\\cf0}}}}\\f0\\fs16 ) ">
+    <#else>
+        <#return p.name + " (" + p.groupId + ":" + p.artifactId + ":" + p.version + " - {{\\field{\\*\\fldinst{HYPERLINK " + (p.url!"no url defined") + "}}{\\fldrslt{" + (p.url!"no url defined") + "\\ul0\\cf0}}}}\\f0\\fs16 ) ">
+    </#if>
+</#function>
+{\rtf1\ansi\ansicpg1252\deff0\nouicompat{\fonttbl{\f0\fnil\fcharset0 Arial;}}
+{\colortbl ;\red0\green0\blue255;}
+\viewkind4\uc1
+\pard\tx566\tx1133\tx1700\tx2267\tx2834\tx3401\tx3968\tx4535\tx5102\tx5669\tx6236\tx6803\b\fs16\lang7 Cryptomator is distributed under the GPLv3 License, found below. Please see the bottom of this document for any other license applicable to code used within Cryptomator.\b0\par
+\par
+\b\'a9 2016 \endash 2022 Skymatic GmbH\b0\par
+\par
+This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.\par
+\par
+This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.\par
+\par
+You should have received a copy of the GNU General Public License along with this program.  If not, see {{\field{\*\fldinst{HYPERLINK http://www.gnu.org/licenses/ }}{\fldrslt{http://www.gnu.org/licenses/\ul0\cf0}}}}\f0\fs16 .\par
+\par
+
+\b Cryptomator uses ${dependencyMap?size} third-party dependencies under the following licenses:\b0\par
+<#list licenseMap as e>
+<#assign license = e.getKey()/>
+<#assign projects = e.getValue()/>
+<#if projects?size &gt; 0>
+\tab ${license}:\par
+<#list projects as project>
+\tab\tab- ${artifactFormat(project)}\par
+</#list>
+</#if>
+</#list>
+\par
+\b Cryptomator uses other third-party assets under the following licenses:\b0\par
+\tab SIL OFL 1.1 License:\par
+\tab\tab - Font Awesome 5.12.0 ({{\field{\*\fldinst{HYPERLINK https://fontawesome.com/ }}{\fldrslt{https://fontawesome.com/\ul0\cf0}}}}\f0\fs16 )\b\par
+\par
+\b Cryptomator dynamically links to third-party libraries under the following license:\b0\par
+\tab Uncategorized License:\par
+\tab\tab - WinFsp - Windows File System Proxy, Copyright (C) Bill Zissimopoulos  ({{\field{\*\fldinst{HYPERLINK https://github.com/billziss-gh/winfsp }}{\fldrslt{https://github.com/billziss-gh/winfsp\ul0\cf0}}}}\f0\fs16 )\b\par
+}
--- a/dist/win/bundle/resources/logo.png
+++ b/dist/win/bundle/resources/logo.png
--- a/dist/win/bundle/resources/logoSide.png
+++ b/dist/win/bundle/resources/logoSide.png
--- a/dist/win/resources/customWizard.wxi
+++ b/dist/win/resources/customWizard.wxi
@@ -13,7 +13,6 @@
 			<DialogRef Id="BrowseDlg" />
 			<DialogRef Id="DiskCostDlg" />
 			<DialogRef Id="ErrorDlg" />
-			<DialogRef Id="FatalError" />
 			<DialogRef Id="FilesInUse" />
 			<DialogRef Id="MsiRMFilesInUse" />
 			<DialogRef Id="PrepareDlg" />
@@ -24,8 +23,9 @@
 			<Publish Dialog="BrowseDlg" Control="OK" Event="DoAction" Value="WixUIValidatePath" Order="3">1</Publish>
 			<Publish Dialog="BrowseDlg" Control="OK" Event="SpawnDialog" Value="InvalidDirDlg" Order="4"><![CDATA[NOT WIXUI_DONTVALIDATEPATH AND WIXUI_INSTALLDIR_VALID<>"1"]]></Publish>

-			<!-- custom end dialog -->
+			<!-- custom end dialogs -->
 			<Publish Dialog="MyExitDialog" Control="Finish" Event="EndDialog" Value="Return" Order="999">1</Publish>
+			<Publish Dialog="MyFatalErrorDlg" Control="Finish" Event="EndDialog" Value="Return" Order="998">1</Publish>

 			<Publish Dialog="WelcomeDlg" Control="Next" Event="NewDialog" Value="LicenseAgreementDlg">NOT Installed</Publish>
 			<Publish Dialog="WelcomeDlg" Control="Next" Event="NewDialog" Value="VerifyReadyDlg">Installed AND PATCH</Publish>
@@ -75,11 +75,34 @@
 				</Control>
 			</Dialog>

+			<!-- copy pasta from https://github.com/wixtoolset/wix3/blob/develop/src/ext/UIExtension/wixlib/FatalError.wxs with adjustments-->
+			<Dialog Id="MyFatalErrorDlg" Width="370" Height="270" Title="!(loc.FatalError_Title)">
+                <Control Id="Finish" Type="PushButton" X="236" Y="243" Width="56" Height="17" Default="yes" Cancel="yes" Text="!(loc.WixUIFinish)">
+                    <Publish Event="EndDialog" Value="Exit">1</Publish>
+                </Control>
+                <Control Id="Cancel" Type="PushButton" X="304" Y="243" Width="56" Height="17" Disabled="yes" Text="!(loc.WixUICancel)" />
+                <Control Id="Bitmap" Type="Bitmap" X="0" Y="0" Width="370" Height="234" TabSkip="no" Text="!(loc.FatalErrorBitmap)" />
+                <Control Id="Back" Type="PushButton" X="180" Y="243" Width="56" Height="17" Disabled="yes" Text="!(loc.WixUIBack)" />
+                <Control Id="BottomLine" Type="Line" X="0" Y="234" Width="370" Height="0" />
+                <Control Id="Title" Type="Text" X="135" Y="20" Width="220" Height="60" Transparent="yes" NoPrefix="yes" Text="!(loc.FatalErrorTitle)" />
+                <Control Id="Description" Type="Text" X="135" Y="70" Width="220" Height="80" Transparent="yes" NoPrefix="yes" Text="!(loc.FatalErrorDescription1) !(loc.FatalErrorDescription2)" />
+                <Control Id="DescriptionReason1" Type="Text" X="135" Y="160" Width="220" Height="20" Transparent="yes" NoPrefix="yes" Hidden="yes" >
+					<Text>Reason:</Text>
+                    <Condition Action="show">FOUNDRUNNINGAPP</Condition>
+                </Control>
+                <Control Id="DescriptionReason2" Type="Text" X="135" Y="170" Width="220" Height="40" Transparent="yes" NoPrefix="yes" Hidden="yes" >
+					<Text>Cryptomator was still running during installation.</Text>
+                    <Condition Action="show">FOUNDRUNNINGAPP</Condition>
+                </Control>
+            </Dialog>
+
 			<InstallUISequence>
 				<Show Dialog="MyExitDialog" Overridable="yes" OnExit="success"/>
+				<Show Dialog="MyFatalErrorDlg" Overridable="yes" OnExit="error"/>
 			</InstallUISequence>
 			<AdminUISequence>
 				<Show Dialog="MyExitDialog" Overridable="yes" OnExit="success"/>
+				<Show Dialog="MyFatalErrorDlg" Overridable="yes" OnExit="error"/>
 			</AdminUISequence>

 		</UI>
--- a/dist/win/resources/license.rtf
+++ b/dist/win/resources/license.rtf
@@ -1,84 +0,0 @@
-{\rtf1\ansi\ansicpg1252\deff0\nouicompat{\fonttbl{\f0\fnil\fcharset0 Arial;}}
-{\colortbl ;\red0\green0\blue255;}
-{\*\generator Riched20 10.0.17134}\viewkind4\uc1 
-\pard\tx566\tx1133\tx1700\tx2267\tx2834\tx3401\tx3968\tx4535\tx5102\tx5669\tx6236\tx6803\b\fs16\lang7 Cryptomator is distributed under the GPLv3 License, found below. Please see the bottom of this document for any other license applicable to code used within Cryptomator.\b0\par
-\par
-\b\'a9 2016 \endash  2022 Skymatic GmbH\b0\par
-\par
-This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.\par
-\par
-This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.\par
-\par
-You should have received a copy of the GNU General Public License along with this program.  If not, see {{\field{\*\fldinst{HYPERLINK http://www.gnu.org/licenses/ }}{\fldrslt{http://www.gnu.org/licenses/\ul0\cf0}}}}\f0\fs16 .\par
-\par
-\b Cryptomator uses 40 third-party dependencies under the following licenses:\b0\par
-\tab Apache License v2.0:\par
-\tab\tab - jffi (com.github.jnr:jffi:1.2.23 - {{\field{\*\fldinst{HYPERLINK http://github.com/jnr/jffi }}{\fldrslt{http://github.com/jnr/jffi\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - jnr-a64asm (com.github.jnr:jnr-a64asm:1.0.0 - {{\field{\*\fldinst{HYPERLINK http://nexus.sonatype.org/oss-repository-hosting.html/jnr-a64asm }}{\fldrslt{http://nexus.sonatype.org/oss-repository-hosting.html/jnr-a64asm\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - jnr-constants (com.github.jnr:jnr-constants:0.9.15 - {{\field{\*\fldinst{HYPERLINK http://github.com/jnr/jnr-constants }}{\fldrslt{http://github.com/jnr/jnr-constants\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - jnr-ffi (com.github.jnr:jnr-ffi:2.1.12 - {{\field{\*\fldinst{HYPERLINK http://github.com/jnr/jnr-ffi }}{\fldrslt{http://github.com/jnr/jnr-ffi\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Gson (com.google.code.gson:gson:2.8.7 - {{\field{\*\fldinst{HYPERLINK https://github.com/google/gson/gson }}{\fldrslt{https://github.com/google/gson/gson\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Dagger (com.google.dagger:dagger:2.38.1 - {{\field{\*\fldinst{HYPERLINK https://github.com/google/dagger }}{\fldrslt{https://github.com/google/dagger\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Guava InternalFutureFailureAccess and InternalFutures (com.google.guava:failureaccess:1.0.1 - {{\field{\*\fldinst{HYPERLINK https://github.com/google/guava/failureaccess }}{\fldrslt{https://github.com/google/guava/failureaccess\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Guava: Google Core Libraries for Java (com.google.guava:guava:30.1.1-jre - {{\field{\*\fldinst{HYPERLINK https://github.com/google/guava/guava }}{\fldrslt{https://github.com/google/guava/guava\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Apache Commons CLI (commons-cli:commons-cli:1.4 - {{\field{\*\fldinst{HYPERLINK http://commons.apache.org/proper/commons-cli/ }}{\fldrslt{http://commons.apache.org/proper/commons-cli/\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - javax.inject (javax.inject:javax.inject:1 - {{\field{\*\fldinst{HYPERLINK http://code.google.com/p/atinject/ }}{\fldrslt{http://code.google.com/p/atinject/\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Java Native Access (net.java.dev.jna:jna:5.7.0 - {{\field{\*\fldinst{HYPERLINK https://github.com/java-native-access/jna }}{\fldrslt{https://github.com/java-native-access/jna\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Java Native Access Platform (net.java.dev.jna:jna-platform:5.7.0 - {{\field{\*\fldinst{HYPERLINK https://github.com/java-native-access/jna }}{\fldrslt{https://github.com/java-native-access/jna\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Apache Commons Lang (org.apache.commons:commons-lang3:3.12.0 - {{\field{\*\fldinst{HYPERLINK https://commons.apache.org/proper/commons-lang/ }}{\fldrslt{https://commons.apache.org/proper/commons-lang/\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Apache HttpCore (org.apache.httpcomponents:httpcore:4.4.14 - {{\field{\*\fldinst{HYPERLINK http://hc.apache.org/httpcomponents-core-ga }}{\fldrslt{http://hc.apache.org/httpcomponents-core-ga\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Jackrabbit WebDAV Library (org.apache.jackrabbit:jackrabbit-webdav:2.21.5 - {{\field{\*\fldinst{HYPERLINK http://jackrabbit.apache.org/jackrabbit-webdav/ }}{\fldrslt{http://jackrabbit.apache.org/jackrabbit-webdav/\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Jetty :: Http Utility (org.eclipse.jetty:jetty-http:10.0.6 - {{\field{\*\fldinst{HYPERLINK https://eclipse.org/jetty/jetty-http }}{\fldrslt{https://eclipse.org/jetty/jetty-http\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Jetty :: IO Utility (org.eclipse.jetty:jetty-io:10.0.6 - {{\field{\*\fldinst{HYPERLINK https://eclipse.org/jetty/jetty-io }}{\fldrslt{https://eclipse.org/jetty/jetty-io\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Jetty :: Security (org.eclipse.jetty:jetty-security:10.0.6 - {{\field{\*\fldinst{HYPERLINK https://eclipse.org/jetty/jetty-security }}{\fldrslt{https://eclipse.org/jetty/jetty-security\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Jetty :: Server Core (org.eclipse.jetty:jetty-server:10.0.6 - {{\field{\*\fldinst{HYPERLINK https://eclipse.org/jetty/jetty-server }}{\fldrslt{https://eclipse.org/jetty/jetty-server\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Jetty :: Servlet Handling (org.eclipse.jetty:jetty-servlet:10.0.6 - {{\field{\*\fldinst{HYPERLINK https://eclipse.org/jetty/jetty-servlet }}{\fldrslt{https://eclipse.org/jetty/jetty-servlet\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Jetty :: Utilities (org.eclipse.jetty:jetty-util:10.0.6 - {{\field{\*\fldinst{HYPERLINK https://eclipse.org/jetty/jetty-util }}{\fldrslt{https://eclipse.org/jetty/jetty-util\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Jetty :: Servlet API and Schemas for JPMS and OSGi (org.eclipse.jetty.toolchain:jetty-servlet-api:4.0.6 - {{\field{\*\fldinst{HYPERLINK https://eclipse.org/jetty/jetty-servlet-api }}{\fldrslt{https://eclipse.org/jetty/jetty-servlet-api\ul0\cf0}}}}\f0\fs16 )\par
-\tab BSD:\par
-\tab\tab - asm (org.ow2.asm:asm:7.1 - {{\field{\*\fldinst{HYPERLINK http://asm.ow2.org/ }}{\fldrslt{http://asm.ow2.org/\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - asm-analysis (org.ow2.asm:asm-analysis:7.1 - {{\field{\*\fldinst{HYPERLINK http://asm.ow2.org/ }}{\fldrslt{http://asm.ow2.org/\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - asm-commons (org.ow2.asm:asm-commons:7.1 - {{\field{\*\fldinst{HYPERLINK http://asm.ow2.org/ }}{\fldrslt{http://asm.ow2.org/\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - asm-tree (org.ow2.asm:asm-tree:7.1 - {{\field{\*\fldinst{HYPERLINK http://asm.ow2.org/ }}{\fldrslt{http://asm.ow2.org/\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - asm-util (org.ow2.asm:asm-util:7.1 - {{\field{\*\fldinst{HYPERLINK http://asm.ow2.org/ }}{\fldrslt{http://asm.ow2.org/\ul0\cf0}}}}\f0\fs16 )\par
-\tab Eclipse Public License - Version 1.0:\par
-\tab\tab - Jetty :: Servlet API and Schemas for JPMS and OSGi (org.eclipse.jetty.toolchain:jetty-servlet-api:4.0.6 - {{\field{\*\fldinst{HYPERLINK https://eclipse.org/jetty/jetty-servlet-api }}{\fldrslt{https://eclipse.org/jetty/jetty-servlet-api\ul0\cf0}}}}\f0\fs16 )\par
-\tab Eclipse Public License - Version 2.0:\par
-\tab\tab - Jetty :: Http Utility (org.eclipse.jetty:jetty-http:10.0.6 - {{\field{\*\fldinst{HYPERLINK https://eclipse.org/jetty/jetty-http }}{\fldrslt{https://eclipse.org/jetty/jetty-http\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Jetty :: IO Utility (org.eclipse.jetty:jetty-io:10.0.6 - {{\field{\*\fldinst{HYPERLINK https://eclipse.org/jetty/jetty-io }}{\fldrslt{https://eclipse.org/jetty/jetty-io\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Jetty :: Security (org.eclipse.jetty:jetty-security:10.0.6 - {{\field{\*\fldinst{HYPERLINK https://eclipse.org/jetty/jetty-security }}{\fldrslt{https://eclipse.org/jetty/jetty-security\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Jetty :: Server Core (org.eclipse.jetty:jetty-server:10.0.6 - {{\field{\*\fldinst{HYPERLINK https://eclipse.org/jetty/jetty-server }}{\fldrslt{https://eclipse.org/jetty/jetty-server\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Jetty :: Servlet Handling (org.eclipse.jetty:jetty-servlet:10.0.6 - {{\field{\*\fldinst{HYPERLINK https://eclipse.org/jetty/jetty-servlet }}{\fldrslt{https://eclipse.org/jetty/jetty-servlet\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Jetty :: Utilities (org.eclipse.jetty:jetty-util:10.0.6 - {{\field{\*\fldinst{HYPERLINK https://eclipse.org/jetty/jetty-util }}{\fldrslt{https://eclipse.org/jetty/jetty-util\ul0\cf0}}}}\f0\fs16 )\par
-\tab Eclipse Public License - v 1.0:\par
-\tab\tab - Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 - {{\field{\*\fldinst{HYPERLINK http://logback.qos.ch/logback-classic }}{\fldrslt{http://logback.qos.ch/logback-classic\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Logback Core Module (ch.qos.logback:logback-core:1.2.3 - {{\field{\*\fldinst{HYPERLINK http://logback.qos.ch/logback-core }}{\fldrslt{http://logback.qos.ch/logback-core\ul0\cf0}}}}\f0\fs16 )\par
-\tab Eclipse Public License - v 2.0:\par
-\tab\tab - jnr-posix (com.github.jnr:jnr-posix:3.0.54 - {{\field{\*\fldinst{HYPERLINK http://nexus.sonatype.org/oss-repository-hosting.html/jnr-posix }}{\fldrslt{http://nexus.sonatype.org/oss-repository-hosting.html/jnr-posix\ul0\cf0}}}}\f0\fs16 )\par
-\tab GNU Lesser General Public License:\par
-\tab\tab - Logback Classic Module (ch.qos.logback:logback-classic:1.2.3 - {{\field{\*\fldinst{HYPERLINK http://logback.qos.ch/logback-classic }}{\fldrslt{http://logback.qos.ch/logback-classic\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Logback Core Module (ch.qos.logback:logback-core:1.2.3 - {{\field{\*\fldinst{HYPERLINK http://logback.qos.ch/logback-core }}{\fldrslt{http://logback.qos.ch/logback-core\ul0\cf0}}}}\f0\fs16 )\par
-\tab GPLv2:\par
-\tab\tab - jnr-posix (com.github.jnr:jnr-posix:3.0.54 - {{\field{\*\fldinst{HYPERLINK http://nexus.sonatype.org/oss-repository-hosting.html/jnr-posix }}{\fldrslt{http://nexus.sonatype.org/oss-repository-hosting.html/jnr-posix\ul0\cf0}}}}\f0\fs16 )\par
-\tab GPLv2+CE:\par
-\tab\tab - javafx-base (org.openjfx:javafx-base:16 - {{\field{\*\fldinst{HYPERLINK https://openjdk.java.net/projects/openjfx/javafx-base/ }}{\fldrslt{https://openjdk.java.net/projects/openjfx/javafx-base/\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - javafx-controls (org.openjfx:javafx-controls:16 - {{\field{\*\fldinst{HYPERLINK https://openjdk.java.net/projects/openjfx/javafx-controls/ }}{\fldrslt{https://openjdk.java.net/projects/openjfx/javafx-controls/\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - javafx-fxml (org.openjfx:javafx-fxml:16 - {{\field{\*\fldinst{HYPERLINK https://openjdk.java.net/projects/openjfx/javafx-fxml/ }}{\fldrslt{https://openjdk.java.net/projects/openjfx/javafx-fxml/\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - javafx-graphics (org.openjfx:javafx-graphics:16 - {{\field{\*\fldinst{HYPERLINK https://openjdk.java.net/projects/openjfx/javafx-graphics/ }}{\fldrslt{https://openjdk.java.net/projects/openjfx/javafx-graphics/\ul0\cf0}}}}\f0\fs16 )\par
-\tab LGPL 2.1:\par
-\tab\tab - jnr-posix (com.github.jnr:jnr-posix:3.0.54 - {{\field{\*\fldinst{HYPERLINK http://nexus.sonatype.org/oss-repository-hosting.html/jnr-posix }}{\fldrslt{http://nexus.sonatype.org/oss-repository-hosting.html/jnr-posix\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Java Native Access (net.java.dev.jna:jna:5.7.0 - {{\field{\*\fldinst{HYPERLINK https://github.com/java-native-access/jna }}{\fldrslt{https://github.com/java-native-access/jna\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - Java Native Access Platform (net.java.dev.jna:jna-platform:5.7.0 - {{\field{\*\fldinst{HYPERLINK https://github.com/java-native-access/jna }}{\fldrslt{https://github.com/java-native-access/jna\ul0\cf0}}}}\f0\fs16 )\par
-\tab MIT License:\par
-\tab\tab - java jwt (com.auth0:java-jwt:3.18.1 - {{\field{\*\fldinst{HYPERLINK https://github.com/auth0/java-jwt }}{\fldrslt{https://github.com/auth0/java-jwt\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - jnr-x86asm (com.github.jnr:jnr-x86asm:1.0.2 - {{\field{\*\fldinst{HYPERLINK http://github.com/jnr/jnr-x86asm }}{\fldrslt{http://github.com/jnr/jnr-x86asm\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - jnr-fuse (com.github.serceman:jnr-fuse:0.5.5 - {{\field{\*\fldinst{HYPERLINK https://github.com/SerCeMan/jnr-fuse }}{\fldrslt{https://github.com/SerCeMan/jnr-fuse\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - zxcvbn4j (com.nulab-inc:zxcvbn:1.5.2 - {{\field{\*\fldinst{HYPERLINK https://github.com/nulab/zxcvbn4j }}{\fldrslt{https://github.com/nulab/zxcvbn4j\ul0\cf0}}}}\f0\fs16 )\par
-\tab\tab - SLF4J API Module (org.slf4j:slf4j-api:1.7.31 - {{\field{\*\fldinst{HYPERLINK http://www.slf4j.org }}{\fldrslt{http://www.slf4j.org\ul0\cf0}}}}\f0\fs16 )\par
-\tab The BSD 2-Clause License:\par
-\tab\tab - EasyBind (com.tobiasdiez:easybind:2.2 - {{\field{\*\fldinst{HYPERLINK https://github.com/tobiasdiez/EasyBind }}{\fldrslt{https://github.com/tobiasdiez/EasyBind\ul0\cf0}}}}\f0\fs16 )\par
-\par
-\b Cryptomator uses other third-party assets under the following licenses:\b0\par
-\tab SIL OFL 1.1 License:\par
-\tab\tab - Font Awesome 5.12.0 ({{\field{\*\fldinst{HYPERLINK https://fontawesome.com/ }}{\fldrslt{https://fontawesome.com/\ul0\cf0}}}}\f0\fs16 )\b\par
-}
--- a/dist/win/resources/licenseTemplate.ftl
+++ b/dist/win/resources/licenseTemplate.ftl
@@ -0,0 +1,37 @@
+<#function artifactFormat p>
+    <#if p.name?index_of('Unnamed') &gt; -1>
+        <#return p.artifactId + " (" + p.groupId + ":" + p.artifactId + ":" + p.version + " - {{\\field{\\*\\fldinst{HYPERLINK " + (p.url!"no url defined") + "}}{\\fldrslt{" + (p.url!"no url defined") + "\\ul0\\cf0}}}}\\f0\\fs16 ) ">
+    <#else>
+        <#return p.name + " (" + p.groupId + ":" + p.artifactId + ":" + p.version + " - {{\\field{\\*\\fldinst{HYPERLINK " + (p.url!"no url defined") + "}}{\\fldrslt{" + (p.url!"no url defined") + "\\ul0\\cf0}}}}\\f0\\fs16 ) ">
+    </#if>
+</#function>
+{\rtf1\ansi\ansicpg1252\deff0\nouicompat{\fonttbl{\f0\fnil\fcharset0 Arial;}}
+{\colortbl ;\red0\green0\blue255;}
+\viewkind4\uc1
+\pard\tx566\tx1133\tx1700\tx2267\tx2834\tx3401\tx3968\tx4535\tx5102\tx5669\tx6236\tx6803\b\fs16\lang7 Cryptomator is distributed under the GPLv3 License, found below. Please see the bottom of this document for any other license applicable to code used within Cryptomator.\b0\par
+\par
+\b\'a9 2016 \endash 2022 Skymatic GmbH\b0\par
+\par
+This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.\par
+\par
+This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.\par
+\par
+You should have received a copy of the GNU General Public License along with this program.  If not, see {{\field{\*\fldinst{HYPERLINK http://www.gnu.org/licenses/ }}{\fldrslt{http://www.gnu.org/licenses/\ul0\cf0}}}}\f0\fs16 .\par
+\par
+
+\b Cryptomator uses ${dependencyMap?size} third-party dependencies under the following licenses:\b0\par
+<#list licenseMap as e>
+<#assign license = e.getKey()/>
+<#assign projects = e.getValue()/>
+<#if projects?size &gt; 0>
+\tab ${license}:\par
+<#list projects as project>
+\tab\tab- ${artifactFormat(project)}\par
+</#list>
+</#if>
+</#list>
+\par
+\b Cryptomator uses other third-party assets under the following licenses:\b0\par
+\tab SIL OFL 1.1 License:\par
+\tab\tab - Font Awesome 5.12.0 ({{\field{\*\fldinst{HYPERLINK https://fontawesome.com/ }}{\fldrslt{https://fontawesome.com/\ul0\cf0}}}}\f0\fs16 )\b\par
+}
--- a/dist/win/resources/main.wxs
+++ b/dist/win/resources/main.wxs
@@ -127,6 +127,20 @@
    <!-- WebDAV patches -->
    <CustomAction Id="PatchWebDAV" Impersonate="no" ExeCommand="[INSTALLDIR]patchWebDAV.bat" Directory="INSTALLDIR" Execute="deferred" Return="asyncWait" />

+    <!-- Running App detection and exit -->
+    <Property Id="FOUNDRUNNINGAPP" Admin="yes"/>
+    <util:CloseApplication
+      Id="CloseCryptomator"
+      Target="cryptomator.exe"
+      CloseMessage="no"
+      RebootPrompt="no"
+      PromptToContinue="yes"
+      Description="A running instance of Cryptomator is found. Please close it to continue."
+      Property="FOUNDRUNNINGAPP"
+      >
+    </util:CloseApplication>
+    <CustomAction Id="FailOnRunningApp" Impersonate="no" ExeCommand="[SystemFolder]\cmd.exe /c &quot;exit 1&quot;" Directory="INSTALLDIR" Execute="immediate" Return="check" />
+
    <?ifdef JpIcon ?>
    <Property Id="ARPPRODUCTICON" Value="JpARPPRODUCTICON"/>
    <Icon Id="JpARPPRODUCTICON" SourceFile="$(var.JpIcon)"/>
@@ -155,7 +169,12 @@
      <?ifndef JpAllowDowngrades ?>
      <Custom Action="JpDisallowDowngrade" After="FindRelatedProducts">JP_DOWNGRADABLE_FOUND</Custom>
      <?endif?>
-      <RemoveExistingProducts Before="CostInitialize"/>
+
+      <!-- Check and fail if Cryptomator is running -->
+      <Custom Action="WixCloseApplications" Before="InstallValidate"></Custom>
+      <Custom Action="FailOnRunningApp" After="WixCloseApplications" >FOUNDRUNNINGAPP</Custom>
+
+      <RemoveExistingProducts After="InstallValidate"/>

      <Custom Action="PatchWebDAV" After="InstallFiles">NOT Installed OR REINSTALL</Custom>
    </InstallExecuteSequence>
--- a/pom.xml
+++ b/pom.xml
@@ -28,32 +28,37 @@

 		<!-- cryptomator dependencies -->
 		<cryptomator.cryptolib.version>2.1.0-beta3</cryptomator.cryptolib.version>
-		<cryptomator.cryptofs.version>2.3.1</cryptomator.cryptofs.version>
+		<cryptomator.cryptofs.version>2.4.0</cryptomator.cryptofs.version>
 		<cryptomator.integrations.version>1.1.0-beta1</cryptomator.integrations.version>
 		<cryptomator.integrations.win.version>1.0.0</cryptomator.integrations.win.version>
 		<cryptomator.integrations.mac.version>1.0.0</cryptomator.integrations.mac.version>
 		<cryptomator.integrations.linux.version>1.0.1</cryptomator.integrations.linux.version>
 		<cryptomator.fuse.version>1.3.3</cryptomator.fuse.version>
 		<cryptomator.dokany.version>1.3.3</cryptomator.dokany.version>
-		<cryptomator.webdav.version>1.2.6</cryptomator.webdav.version>
+		<cryptomator.webdav.version>1.2.7</cryptomator.webdav.version>

 		<!-- 3rd party dependencies -->
-		<javafx.version>17.0.2</javafx.version>
+		<javafx.version>18</javafx.version>
 		<commons-lang3.version>3.12.0</commons-lang3.version>
-		<jwt.version>3.18.2</jwt.version>
+		<jwt.version>3.19.1</jwt.version>
 		<easybind.version>2.2</easybind.version>
-		<guava.version>31.0-jre</guava.version>
-		<dagger.version>2.40.3</dagger.version>
-		<gson.version>2.8.9</gson.version>
-		<zxcvbn.version>1.5.2</zxcvbn.version>
-		<slf4j.version>1.7.32</slf4j.version>
-		<logback.version>1.2.9</logback.version>
+		<guava.version>31.1-jre</guava.version>
+		<dagger.version>2.41</dagger.version>
+		<gson.version>2.9.0</gson.version>
+		<zxcvbn.version>1.6.0</zxcvbn.version>
+		<slf4j.version>1.7.36</slf4j.version>
+		<logback.version>1.2.11</logback.version>
 		<jetty.version>10.0.6</jetty.version>

 		<!-- test dependencies -->
 		<junit.jupiter.version>5.8.1</junit.jupiter.version>
-		<mockito.version>3.12.4</mockito.version>
+		<mockito.version>4.4.0</mockito.version>
 		<hamcrest.version>2.2</hamcrest.version>
+
+		<!-- build-time dependencies -->
+		<jetbrains.annotations.version>23.0.0</jetbrains.annotations.version>
+		<dependency-check.version>7.0.2</dependency-check.version>
+		<jacoco.version>0.8.7</jacoco.version>
 	</properties>

 	<dependencies>
@@ -248,6 +253,13 @@
 			<version>1.2</version>
 			<scope>test</scope>
 		</dependency>
+
+		<dependency>
+			<groupId>org.jetbrains</groupId>
+			<artifactId>annotations</artifactId>
+			<version>${jetbrains.annotations.version}</version>
+			<scope>provided</scope>
+		</dependency>
 	</dependencies>

 	<build>
@@ -256,7 +268,7 @@
 				<plugin>
 					<groupId>org.apache.maven.plugins</groupId>
 					<artifactId>maven-compiler-plugin</artifactId>
-					<version>3.8.1</version>
+					<version>3.10.1</version>
 				</plugin>
 				<plugin>
 					<groupId>org.apache.maven.plugins</groupId>
@@ -266,7 +278,7 @@
 				<plugin>
 					<groupId>org.apache.maven.plugins</groupId>
 					<artifactId>maven-dependency-plugin</artifactId>
-					<version>3.2.0</version>
+					<version>3.3.0</version>
 				</plugin>
 				<plugin>
 					<groupId>org.apache.maven.plugins</groupId>
@@ -281,17 +293,17 @@
 				<plugin>
 					<groupId>org.apache.maven.plugins</groupId>
 					<artifactId>maven-jar-plugin</artifactId>
-					<version>3.2.0</version>
+					<version>3.2.2</version>
 				</plugin>
 				<plugin>
 					<groupId>org.jacoco</groupId>
 					<artifactId>jacoco-maven-plugin</artifactId>
-					<version>0.8.7</version>
+					<version>${jacoco.version}</version>
 				</plugin>
 				<plugin>
 					<groupId>org.owasp</groupId>
 					<artifactId>dependency-check-maven</artifactId>
-					<version>6.3.1</version>
+					<version>${dependency-check.version}</version>
 				</plugin>
 			</plugins>
 		</pluginManagement>
--- a/src/main/java/module-info.java
+++ b/src/main/java/module-info.java
@@ -4,7 +4,10 @@ import org.cryptomator.integrations.tray.TrayIntegrationProvider;
 import org.cryptomator.integrations.uiappearance.UiAppearanceProvider;

 module org.cryptomator.desktop {
+	requires static org.jetbrains.annotations;
+
 	requires org.cryptomator.cryptolib;
+
 	requires org.cryptomator.cryptofs;
 	requires org.cryptomator.frontend.dokany;
 	requires org.cryptomator.frontend.fuse;
@@ -47,6 +50,8 @@ module org.cryptomator.desktop {
 	opens org.cryptomator.common.settings to com.google.gson;
 	opens org.cryptomator.ui.keyloading.hub to com.google.gson, javafx.fxml;

+	opens org.cryptomator.launcher to javafx.graphics;
+
 	opens org.cryptomator.common to javafx.fxml;
 	opens org.cryptomator.common.vaults to javafx.fxml;
 	opens org.cryptomator.ui.addvaultwizard to javafx.fxml;
--- a/src/main/java/org/cryptomator/common/Environment.java
+++ b/src/main/java/org/cryptomator/common/Environment.java
@@ -94,11 +94,6 @@ public class Environment {
 		return Boolean.getBoolean("cryptomator.showTrayIcon");
 	}

-	@Deprecated // TODO: remove as soon as custom mount path works properly on Win+Fuse
-	public boolean useExperimentalFuse() {
-		return Boolean.getBoolean("fuse.experimental");
-	}
-
 	private int getInt(String propertyName, int defaultValue) {
 		String value = System.getProperty(propertyName);
 		try {
--- a/src/main/java/org/cryptomator/common/Passphrase.java
+++ b/src/main/java/org/cryptomator/common/Passphrase.java
@@ -0,0 +1,108 @@
+package org.cryptomator.common;
+
+import javax.security.auth.Destroyable;
+import java.util.Arrays;
+
+/**
+ * A destroyable CharSequence.
+ */
+public class Passphrase implements Destroyable, CharSequence {
+
+	private final char[] data;
+	private final int offset;
+	private final int length;
+	private boolean destroyed;
+
+	/**
+	 * Wraps (doesn't copy) the given data.
+	 *
+	 * @param data The wrapped data. Any changes to this will be reflected in this passphrase
+	 */
+	public Passphrase(char[] data) {
+		this(data, 0, data.length);
+	}
+
+	/**
+	 * Wraps (doesn't copy) a subarray of the given data.
+	 *
+	 * @param data The wrapped data. Any changes to this will be reflected in this passphrase
+	 * @param offset The subarray offset, i.e. the first character of this passphrase
+	 * @param length The subarray length, i.e. the length of this passphrase
+	 */
+	public Passphrase(char[] data, int offset, int length) {
+		if (offset < 0 || length < 0 || offset + length > data.length) {
+			throw new IndexOutOfBoundsException("[%1$d %1$d + %2$d[ not within [0, %3$d[".formatted(offset, length, data.length));
+		}
+		this.data = data;
+		this.offset = offset;
+		this.length = length;
+	}
+
+	public static Passphrase copyOf(CharSequence cs) {
+		char[] result = new char[cs.length()];
+		for (int i = 0; i < cs.length(); i++) {
+			result[i] = cs.charAt(i);
+		}
+		return new Passphrase(result);
+	}
+
+	@Override
+	public boolean equals(Object o) {
+		if (this == o) return true;
+		if (o == null || getClass() != o.getClass()) return false;
+		Passphrase that = (Passphrase) o;
+		// time-constant comparison
+		int diff = 0;
+		for (int i = 0; i < length; i++) {
+			diff |= charAt(i) ^ that.charAt(i);
+		}
+		return diff == 0;
+	}
+
+	@Override
+	public int hashCode() {
+		// basically Arrays.hashCode, but only for a certain subarray
+		int result = 1;
+		for (int i = 0; i < length; i++) {
+			result = 31 * result + charAt(i);
+		}
+		return result;
+	}
+
+	@Override
+	public String toString() {
+		return new String(data, offset, length);
+	}
+
+	@Override
+	public int length() {
+		return length;
+	}
+
+	@Override
+	public char charAt(int index) {
+		if (index < 0 || index >= length) {
+			throw new IndexOutOfBoundsException("%d not within [0, %d[".formatted(index, length));
+		}
+		return data[offset + index];
+	}
+
+	@Override
+	public Passphrase subSequence(int start, int end) {
+		if (start < 0 || end < 0 || end > length || start > end) {
+			throw new IndexOutOfBoundsException("[%d, %d[ not within [0, %d[".formatted(start, end, length));
+		}
+		return new Passphrase(Arrays.copyOfRange(data, offset + start, offset + end));
+	}
+
+	@Override
+	public boolean isDestroyed() {
+		return destroyed;
+	}
+
+	@Override
+	public void destroy() {
+		Arrays.fill(data, offset, offset + length, '\0');
+		destroyed = true;
+	}
+}
--- a/src/main/java/org/cryptomator/common/mountpoint/CustomMountPointChooser.java
+++ b/src/main/java/org/cryptomator/common/mountpoint/CustomMountPointChooser.java
@@ -4,6 +4,7 @@ import org.apache.commons.lang3.SystemUtils;
 import org.cryptomator.common.Environment;
 import org.cryptomator.common.settings.VaultSettings;
 import org.cryptomator.common.settings.VolumeImpl;
+import org.cryptomator.common.vaults.MountPointRequirement;
 import org.cryptomator.common.vaults.Volume;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -11,32 +12,33 @@ import org.slf4j.LoggerFactory;
 import javax.inject.Inject;
 import java.io.IOException;
 import java.nio.file.DirectoryNotEmptyException;
-import java.nio.file.DirectoryStream;
 import java.nio.file.FileAlreadyExistsException;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
+import java.nio.file.NoSuchFileException;
 import java.nio.file.NotDirectoryException;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.nio.file.attribute.BasicFileAttributes;
 import java.util.Optional;

 class CustomMountPointChooser implements MountPointChooser {

+	private static final String HIDEAWAY_PREFIX = ".~$";
+	private static final String HIDEAWAY_SUFFIX = ".tmp";
+	private static final String WIN_HIDDEN = "dos:hidden";
 	private static final Logger LOG = LoggerFactory.getLogger(CustomMountPointChooser.class);

 	private final VaultSettings vaultSettings;
-	private final Environment environment;

 	@Inject
-	public CustomMountPointChooser(VaultSettings vaultSettings, Environment environment) {
+	public CustomMountPointChooser(VaultSettings vaultSettings) {
 		this.vaultSettings = vaultSettings;
-		this.environment = environment;
 	}

 	@Override
 	public boolean isApplicable(Volume caller) {
-		//Disable if useExperimentalFuse is required (Win + Fuse), but set to false
-		return caller.getImplementationType() != VolumeImpl.FUSE || !SystemUtils.IS_OS_WINDOWS || environment.useExperimentalFuse();
+		return caller.getImplementationType() != VolumeImpl.WEBDAV;
 	}

 	@Override
@@ -47,49 +49,102 @@ class CustomMountPointChooser implements MountPointChooser {

 	@Override
 	public boolean prepare(Volume caller, Path mountPoint) throws InvalidMountPointException {
-		switch (caller.getMountPointRequirement()) {
-			case PARENT_NO_MOUNT_POINT -> prepareParentNoMountPoint(mountPoint);
-			case EMPTY_MOUNT_POINT -> prepareEmptyMountPoint(mountPoint);
-			case NONE -> {
-				//Requirement "NONE" doesn't make any sense here.
-				//No need to prepare/verify a Mountpoint without requiring one...
+		return switch (caller.getMountPointRequirement()) {
+			case PARENT_NO_MOUNT_POINT -> {
+				prepareParentNoMountPoint(mountPoint);
+				LOG.debug("Successfully checked custom mount point: {}", mountPoint);
+				yield true;
+			}
+			case EMPTY_MOUNT_POINT -> {
+				prepareEmptyMountPoint(mountPoint);
+				LOG.debug("Successfully checked custom mount point: {}", mountPoint);
+				yield false;
+			}
+			case NONE, UNUSED_ROOT_DIR, PARENT_OPT_MOUNT_POINT -> {
 				throw new InvalidMountPointException(new IllegalStateException("Illegal MountPointRequirement"));
 			}
-			default -> {
-				//Currently the case for "UNUSED_ROOT_DIR, PARENT_OPT_MOUNT_POINT"
-				throw new InvalidMountPointException(new IllegalStateException("Not implemented"));
-			}
-		}
-		LOG.debug("Successfully checked custom mount point: {}", mountPoint);
-		return false;
+		};
 	}

-	private void prepareParentNoMountPoint(Path mountPoint) throws InvalidMountPointException {
-		//This the case on Windows when using FUSE
-		//See https://github.com/billziss-gh/winfsp/issues/320
-		Path parent = mountPoint.getParent();
-		if (!Files.isDirectory(parent)) {
-			throw new InvalidMountPointException(new NotDirectoryException(parent.toString()));
-		}
-		//We must use #notExists() here because notExists =/= !exists (see docs)
-		if (!Files.notExists(mountPoint, LinkOption.NOFOLLOW_LINKS)) {
-			//File exists OR can't be determined
-			throw new InvalidMountPointException(new FileAlreadyExistsException(mountPoint.toString()));
+	//This is case on Windows when using FUSE
+	//See https://github.com/billziss-gh/winfsp/issues/320
+	void prepareParentNoMountPoint(Path mountPoint) throws InvalidMountPointException {
+		Path hideaway = getHideaway(mountPoint);
+		var mpExists = Files.exists(mountPoint, LinkOption.NOFOLLOW_LINKS);
+		var hideExists = Files.exists(hideaway, LinkOption.NOFOLLOW_LINKS);
+
+		//TODO: possible improvement by just deleting an _empty_ hideaway
+		if (mpExists && hideExists) { //both resources exist (whatever type)
+			throw new InvalidMountPointException(new FileAlreadyExistsException(hideaway.toString()));
+		} else if (!mpExists && !hideExists) { //neither mountpoint nor hideaway exist
+			throw new InvalidMountPointException(new NoSuchFileException(mountPoint.toString()));
+		} else if (!mpExists) { //only hideaway exists
+			checkIsDirectory(hideaway);
+			LOG.info("Mountpoint {} for winfsp mount seems to be not properly cleaned up. Will be fixed on unmount.", mountPoint);
+			try {
+				if (SystemUtils.IS_OS_WINDOWS) {
+					Files.setAttribute(hideaway, WIN_HIDDEN, true, LinkOption.NOFOLLOW_LINKS);
+				}
+			} catch (IOException e) {
+				throw new InvalidMountPointException(e);
+			}
+		} else { //only mountpoint exists
+			try {
+				checkIsDirectory(mountPoint);
+				checkIsEmpty(mountPoint);
+
+				Files.move(mountPoint, hideaway);
+				if (SystemUtils.IS_OS_WINDOWS) {
+					Files.setAttribute(hideaway, WIN_HIDDEN, true, LinkOption.NOFOLLOW_LINKS);
+				}
+			} catch (IOException e) {
+				throw new InvalidMountPointException(e);
+			}
 		}
 	}

 	private void prepareEmptyMountPoint(Path mountPoint) throws InvalidMountPointException {
 		//This is the case for Windows when using Dokany and for Linux and Mac
-		if (!Files.isDirectory(mountPoint)) {
-			throw new InvalidMountPointException(new NotDirectoryException(mountPoint.toString()));
-		}
-		try (DirectoryStream<Path> ds = Files.newDirectoryStream(mountPoint)) {
-			if (ds.iterator().hasNext()) {
-				throw new InvalidMountPointException(new DirectoryNotEmptyException(mountPoint.toString()));
-			}
+		checkIsDirectory(mountPoint);
+		try {
+			checkIsEmpty(mountPoint);
 		} catch (IOException exception) {
 			throw new InvalidMountPointException("IOException while checking folder content", exception);
 		}
 	}

+	@Override
+	public void cleanup(Volume caller, Path mountPoint) {
+		if (caller.getMountPointRequirement() == MountPointRequirement.PARENT_NO_MOUNT_POINT) {
+			Path hideaway = getHideaway(mountPoint);
+			try {
+				Files.move(hideaway, mountPoint);
+				if (SystemUtils.IS_OS_WINDOWS) {
+					Files.setAttribute(mountPoint, WIN_HIDDEN, false);
+				}
+			} catch (IOException e) {
+				LOG.error("Unable to clean up mountpoint {} for Winfsp mounting.", mountPoint, e);
+			}
+		}
+	}
+
+	private void checkIsDirectory(Path toCheck) throws InvalidMountPointException {
+		if (!Files.isDirectory(toCheck, LinkOption.NOFOLLOW_LINKS)) {
+			throw new InvalidMountPointException(new NotDirectoryException(toCheck.toString()));
+		}
+	}
+
+	private void checkIsEmpty(Path toCheck) throws InvalidMountPointException, IOException {
+		try (var dirStream = Files.list(toCheck)) {
+			if (dirStream.findFirst().isPresent()) {
+				throw new InvalidMountPointException(new DirectoryNotEmptyException(toCheck.toString()));
+			}
+		}
+	}
+
+	//visible for testing
+	Path getHideaway(Path mountPoint) {
+		return mountPoint.resolveSibling(HIDEAWAY_PREFIX + mountPoint.getFileName().toString() + HIDEAWAY_SUFFIX);
+	}
+
 }
--- a/src/main/java/org/cryptomator/common/settings/Settings.java
+++ b/src/main/java/org/cryptomator/common/settings/Settings.java
@@ -44,6 +44,7 @@ public class Settings {
 	public static final String DEFAULT_LICENSE_KEY = "";
 	public static final boolean DEFAULT_SHOW_MINIMIZE_BUTTON = false;
 	public static final String DEFAULT_DISPLAY_CONFIGURATION = "";
+	public static final String DEFAULT_LANGUAGE = null;


 	private final ObservableList<VaultSettings> directories = FXCollections.observableArrayList(VaultSettings::observables);
@@ -66,6 +67,7 @@ public class Settings {
 	private final IntegerProperty windowWidth = new SimpleIntegerProperty();
 	private final IntegerProperty windowHeight = new SimpleIntegerProperty();
 	private final ObjectProperty<String> displayConfiguration = new SimpleObjectProperty<>(DEFAULT_DISPLAY_CONFIGURATION);
+	private final StringProperty language = new SimpleStringProperty(DEFAULT_LANGUAGE);


 	private Consumer<Settings> saveCmd;
@@ -96,6 +98,7 @@ public class Settings {
 		windowWidth.addListener(this::somethingChanged);
 		windowHeight.addListener(this::somethingChanged);
 		displayConfiguration.addListener(this::somethingChanged);
+		language.addListener(this::somethingChanged);
 	}

 	void setSaveCmd(Consumer<Settings> saveCmd) {
@@ -191,4 +194,8 @@ public class Settings {
 	public ObjectProperty<String> displayConfigurationProperty() {
 		return displayConfiguration;
 	}
+
+	public StringProperty languageProperty() {
+		return language;
+	}
 }
--- a/src/main/java/org/cryptomator/common/settings/SettingsJsonAdapter.java
+++ b/src/main/java/org/cryptomator/common/settings/SettingsJsonAdapter.java
@@ -57,6 +57,7 @@ public class SettingsJsonAdapter extends TypeAdapter<Settings> {
 		out.name("windowWidth").value((value.windowWidthProperty().get()));
 		out.name("windowHeight").value((value.windowHeightProperty().get()));
 		out.name("displayConfiguration").value((value.displayConfigurationProperty().get()));
+		out.name("language").value((value.languageProperty().get()));

 		out.endObject();
 	}
@@ -97,6 +98,7 @@ public class SettingsJsonAdapter extends TypeAdapter<Settings> {
 				case "windowWidth" -> settings.windowWidthProperty().set(in.nextInt());
 				case "windowHeight" -> settings.windowHeightProperty().set(in.nextInt());
 				case "displayConfiguration" -> settings.displayConfigurationProperty().set(in.nextString());
+				case "language" -> settings.languageProperty().set(in.nextString());

 				default -> {
 					LOG.warn("Unsupported vault setting found in JSON: " + name);
--- a/src/main/java/org/cryptomator/common/vaults/DefaultMountFlags.java
+++ b/src/main/java/org/cryptomator/common/vaults/DefaultMountFlags.java
@@ -9,6 +9,6 @@ import static java.lang.annotation.RetentionPolicy.RUNTIME;
@Qualifier
@Documented
@Retention(RUNTIME)
-public @interface DefaultMountFlags {
+@interface DefaultMountFlags {

 }
--- a/src/main/java/org/cryptomator/launcher/AppLaunchEvent.java
+++ b/src/main/java/org/cryptomator/launcher/AppLaunchEvent.java
@@ -0,0 +1,13 @@
+package org.cryptomator.launcher;
+
+import java.nio.file.Path;
+import java.util.Collection;
+
+public record AppLaunchEvent(AppLaunchEvent.EventType type, Collection<Path> pathsToOpen) {
+
+	public enum EventType {
+		REVEAL_APP,
+		OPEN_FILE
+	}
+
+}
--- a/src/main/java/org/cryptomator/launcher/Cryptomator.java
+++ b/src/main/java/org/cryptomator/launcher/Cryptomator.java
@@ -13,17 +13,15 @@ import org.cryptomator.common.ShutdownHook;
 import org.cryptomator.ipc.IpcCommunicator;
 import org.cryptomator.logging.DebugMode;
 import org.cryptomator.logging.LoggerConfiguration;
-import org.cryptomator.ui.launcher.UiLauncher;
+import org.cryptomator.ui.fxapp.FxApplicationComponent;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import javax.inject.Inject;
-import javax.inject.Named;
 import javax.inject.Singleton;
-import java.io.IOException;
+import javafx.application.Application;
+import javafx.stage.Stage;
 import java.util.List;
-import java.util.Optional;
-import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.Executors;

@Singleton
@@ -36,21 +34,19 @@ public class Cryptomator {

 	private final LoggerConfiguration logConfig;
 	private final DebugMode debugMode;
+	private final SupportedLanguages supportedLanguages;
 	private final Environment env;
 	private final Lazy<IpcMessageHandler> ipcMessageHandler;
-	private final CountDownLatch shutdownLatch;
 	private final ShutdownHook shutdownHook;
-	private final Lazy<UiLauncher> uiLauncher;

 	@Inject
-	Cryptomator(LoggerConfiguration logConfig, DebugMode debugMode, Environment env, Lazy<IpcMessageHandler> ipcMessageHandler, @Named("shutdownLatch") CountDownLatch shutdownLatch, ShutdownHook shutdownHook, Lazy<UiLauncher> uiLauncher) {
+	Cryptomator(LoggerConfiguration logConfig, DebugMode debugMode, SupportedLanguages supportedLanguages, Environment env, Lazy<IpcMessageHandler> ipcMessageHandler, ShutdownHook shutdownHook) {
 		this.logConfig = logConfig;
 		this.debugMode = debugMode;
+		this.supportedLanguages = supportedLanguages;
 		this.env = env;
 		this.ipcMessageHandler = ipcMessageHandler;
-		this.shutdownLatch = shutdownLatch;
 		this.shutdownHook = shutdownHook;
-		this.uiLauncher = uiLauncher;
 	}

 	public static void main(String[] args) {
@@ -69,6 +65,7 @@ public class Cryptomator {
 		logConfig.init();
 		LOG.info("Starting Cryptomator {} on {} {} ({})", env.getAppVersion().orElse("SNAPSHOT"), SystemUtils.OS_NAME, SystemUtils.OS_VERSION, SystemUtils.OS_ARCH);
 		debugMode.initialize();
+		supportedLanguages.applyPreferred();

 		/*
 		 * Attempts to create an IPC connection to a running Cryptomator instance and sends it the given args.
@@ -79,7 +76,7 @@ public class Cryptomator {
 				communicator.sendHandleLaunchargs(List.of(args));
 				communicator.sendRevealRunningApp();
 				LOG.info("Found running application instance. Shutting down...");
-				return 2;
+				return 0;
 			} else {
 				shutdownHook.runOnShutdown(communicator::closeUnchecked);
 				var executor = Executors.newSingleThreadExecutor(new ThreadFactoryBuilder().setNameFormat("IPC-%d").build());
@@ -96,21 +93,38 @@ public class Cryptomator {
 	}

 	/**
-	 * Launches the JavaFX application and waits until shutdown is requested.
+	 * Launches the JavaFX application, blocking the main thread until shuts down.
 	 *
 	 * @return Nonzero exit code in case of an error.
-	 * @implNote This method blocks until {@link #shutdownLatch} reached zero.
 	 */
 	private int runGuiApplication() {
 		try {
-			uiLauncher.get().launch();
-			shutdownLatch.await();
+			Application.launch(MainApp.class);
 			LOG.info("UI shut down");
 			return 0;
-		} catch (InterruptedException e) {
-			Thread.currentThread().interrupt();
+		} catch (Exception e) {
+			LOG.error("Terminating due to error", e);
 			return 1;
 		}
 	}

+	public static class MainApp extends Application {
+
+		@Override
+		public void start(Stage primaryStage) {
+			LOG.info("JavaFX application started.");
+			FxApplicationComponent component = CRYPTOMATOR_COMPONENT.fxAppComponentBuilder() //
+					.fxApplication(this) //
+					.primaryStage(primaryStage) //
+					.build();
+			component.application().start();
+		}
+
+		@Override
+		public void stop() {
+			LOG.info("JavaFX application stopped.");
+		}
+
+	}
+
 }
--- a/src/main/java/org/cryptomator/launcher/CryptomatorComponent.java
+++ b/src/main/java/org/cryptomator/launcher/CryptomatorComponent.java
@@ -3,14 +3,16 @@ package org.cryptomator.launcher;
 import dagger.Component;
 import org.cryptomator.common.CommonsModule;
 import org.cryptomator.logging.LoggerModule;
-import org.cryptomator.ui.launcher.UiLauncherModule;
+import org.cryptomator.ui.fxapp.FxApplicationComponent;

 import javax.inject.Singleton;

@Singleton
-@Component(modules = {CryptomatorModule.class, CommonsModule.class, LoggerModule.class, UiLauncherModule.class})
+@Component(modules = {CryptomatorModule.class, CommonsModule.class, LoggerModule.class})
 public interface CryptomatorComponent {

 	Cryptomator application();

+	FxApplicationComponent.Builder fxAppComponentBuilder();
+
 }
--- a/src/main/java/org/cryptomator/launcher/CryptomatorModule.java
+++ b/src/main/java/org/cryptomator/launcher/CryptomatorModule.java
@@ -2,20 +2,55 @@ package org.cryptomator.launcher;

 import dagger.Module;
 import dagger.Provides;
+import org.cryptomator.common.PluginClassLoader;
+import org.cryptomator.integrations.autostart.AutoStartProvider;
+import org.cryptomator.integrations.tray.TrayIntegrationProvider;
+import org.cryptomator.integrations.uiappearance.UiAppearanceProvider;
+import org.cryptomator.ui.fxapp.FxApplicationComponent;

 import javax.inject.Named;
 import javax.inject.Singleton;
 import java.util.Optional;
-import java.util.concurrent.CountDownLatch;
+import java.util.ResourceBundle;
+import java.util.ServiceLoader;
+import java.util.concurrent.ArrayBlockingQueue;
+import java.util.concurrent.BlockingQueue;

-@Module
+@Module(subcomponents = {FxApplicationComponent.class})
 class CryptomatorModule {

 	@Provides
 	@Singleton
-	@Named("shutdownLatch")
-	static CountDownLatch provideShutdownLatch() {
-		return new CountDownLatch(1);
+	static ResourceBundle provideLocalization() {
+		return ResourceBundle.getBundle("i18n.strings");
 	}

+	@Provides
+	@Singleton
+	@Named("launchEventQueue")
+	static BlockingQueue<AppLaunchEvent> provideFileOpenRequests() {
+		return new ArrayBlockingQueue<>(10);
+	}
+
+	// TODO: still needed after integrations-api 1.1.0?
+
+	@Provides
+	@Singleton
+	static Optional<UiAppearanceProvider> provideAppearanceProvider(PluginClassLoader classLoader) {
+		return ServiceLoader.load(UiAppearanceProvider.class, classLoader).findFirst();
+	}
+
+	@Provides
+	@Singleton
+	static Optional<AutoStartProvider> provideAutostartProvider(PluginClassLoader classLoader) {
+		return ServiceLoader.load(AutoStartProvider.class, classLoader).findFirst();
+	}
+
+	@Provides
+	@Singleton
+	static Optional<TrayIntegrationProvider> provideTrayIntegrationProvider(PluginClassLoader classLoader) {
+		return ServiceLoader.load(TrayIntegrationProvider.class, classLoader).findFirst();
+	}
+
+
 }
--- a/src/main/java/org/cryptomator/launcher/FileOpenRequestHandler.java
+++ b/src/main/java/org/cryptomator/launcher/FileOpenRequestHandler.java
@@ -6,7 +6,6 @@
 *******************************************************************************/
 package org.cryptomator.launcher;

-import org.cryptomator.ui.launcher.AppLaunchEvent;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -20,12 +19,10 @@ import java.nio.file.FileSystem;
 import java.nio.file.FileSystems;
 import java.nio.file.InvalidPathException;
 import java.nio.file.Path;
-import java.util.Arrays;
 import java.util.Collection;
 import java.util.List;
 import java.util.Objects;
 import java.util.concurrent.BlockingQueue;
-import java.util.stream.Collectors;

@Singleton
 class FileOpenRequestHandler {
--- a/src/main/java/org/cryptomator/launcher/IpcMessageHandler.java
+++ b/src/main/java/org/cryptomator/launcher/IpcMessageHandler.java
@@ -1,7 +1,6 @@
 package org.cryptomator.launcher;

 import org.cryptomator.ipc.IpcMessageListener;
-import org.cryptomator.ui.launcher.AppLaunchEvent;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

--- a/src/main/java/org/cryptomator/launcher/SupportedLanguages.java
+++ b/src/main/java/org/cryptomator/launcher/SupportedLanguages.java
@@ -0,0 +1,39 @@
+package org.cryptomator.launcher;
+
+import org.cryptomator.common.settings.Settings;
+import org.jetbrains.annotations.Nullable;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.inject.Inject;
+import javax.inject.Singleton;
+import java.util.List;
+import java.util.Locale;
+
+@Singleton
+public class SupportedLanguages {
+
+	private static final Logger LOG = LoggerFactory.getLogger(SupportedLanguages.class);
+	// these are BCP 47 language codes, not ISO. Note the "-" instead of the "_":
+	public static final List<String> LANGUAGAE_TAGS = List.of("en", "ar", "bn", "bs", "ca", "cs", "de", "el", "es", "fil", "fr", "gl", "he", //
+			"hi", "hr", "hu", "id", "it", "ja", "ko", "lv", "mk", "nb", "nl", "nn", "no", "pa", "pl", "pt", "pt-BR", "ro", "ru", "sk", "sr", //
+			"sr-Latn", "sv", "ta", "te", "th", "tr", "uk", "zh", "zh-HK", "zh-TW");
+
+	@Nullable
+	private final String preferredLanguage;
+
+	@Inject
+	public SupportedLanguages(Settings settings) {
+		this.preferredLanguage = settings.languageProperty().get();
+	}
+
+	public void applyPreferred() {
+		if (preferredLanguage == null) {
+			LOG.debug("Using system locale");
+			return;
+		}
+		var preferredLocale = Locale.forLanguageTag(preferredLanguage);
+		LOG.debug("Applying preferred locale {}", preferredLocale.getDisplayName(Locale.ENGLISH));
+		Locale.setDefault(preferredLocale);
+	}
+}
--- a/src/main/java/org/cryptomator/ui/addvaultwizard/AddVaultModule.java
+++ b/src/main/java/org/cryptomator/ui/addvaultwizard/AddVaultModule.java
@@ -14,7 +14,7 @@ import org.cryptomator.ui.common.FxmlScene;
 import org.cryptomator.ui.common.NewPasswordController;
 import org.cryptomator.ui.common.PasswordStrengthUtil;
 import org.cryptomator.ui.common.StageFactory;
-import org.cryptomator.ui.mainwindow.MainWindow;
+import org.cryptomator.ui.fxapp.PrimaryStage;
 import org.cryptomator.ui.recoverykey.RecoveryKeyDisplayController;

 import javax.inject.Named;
@@ -43,12 +43,12 @@ public abstract class AddVaultModule {
 	@Provides
 	@AddVaultWizardWindow
 	@AddVaultWizardScoped
-	static Stage provideStage(StageFactory factory, @MainWindow Stage owner, ResourceBundle resourceBundle) {
+	static Stage provideStage(StageFactory factory, @PrimaryStage Stage primaryStage, ResourceBundle resourceBundle) {
 		Stage stage = factory.create();
 		stage.setTitle(resourceBundle.getString("addvaultwizard.title"));
 		stage.setResizable(false);
 		stage.initModality(Modality.WINDOW_MODAL);
-		stage.initOwner(owner);
+		stage.initOwner(primaryStage);
 		return stage;
 	}

--- a/src/main/java/org/cryptomator/ui/addvaultwizard/AddVaultSuccessController.java
+++ b/src/main/java/org/cryptomator/ui/addvaultwizard/AddVaultSuccessController.java
@@ -2,25 +2,24 @@ package org.cryptomator.ui.addvaultwizard;

 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.ui.common.FxController;
-import org.cryptomator.ui.fxapp.FxApplication;
+import org.cryptomator.ui.fxapp.FxApplicationWindows;

 import javax.inject.Inject;
 import javafx.beans.property.ObjectProperty;
 import javafx.beans.property.ReadOnlyObjectProperty;
 import javafx.fxml.FXML;
 import javafx.stage.Stage;
-import java.util.Optional;

@AddVaultWizardScoped
 public class AddVaultSuccessController implements FxController {

-	private final FxApplication fxApplication;
+	private final FxApplicationWindows appWindows;
 	private final Stage window;
 	private final ReadOnlyObjectProperty<Vault> vault;

 	@Inject
-	AddVaultSuccessController(FxApplication fxApplication, @AddVaultWizardWindow Stage window, @AddVaultWizardWindow ObjectProperty<Vault> vault) {
-		this.fxApplication = fxApplication;
+	AddVaultSuccessController(FxApplicationWindows appWindows, @AddVaultWizardWindow Stage window, @AddVaultWizardWindow ObjectProperty<Vault> vault) {
+		this.appWindows = appWindows;
 		this.window = window;
 		this.vault = vault;
 	}
@@ -28,7 +27,7 @@ public class AddVaultSuccessController implements FxController {
 	@FXML
 	public void unlockAndClose() {
 		close();
-		fxApplication.startUnlockWorkflow(vault.get(), Optional.of(window));
+		appWindows.startUnlockWorkflow(vault.get(), window);
 	}

 	@FXML
--- a/src/main/java/org/cryptomator/ui/addvaultwizard/ChooseExistingVaultController.java
+++ b/src/main/java/org/cryptomator/ui/addvaultwizard/ChooseExistingVaultController.java
@@ -4,10 +4,10 @@ import dagger.Lazy;
 import org.apache.commons.lang3.SystemUtils;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.common.vaults.VaultListManager;
-import org.cryptomator.ui.common.ErrorComponent;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxmlFile;
 import org.cryptomator.ui.common.FxmlScene;
+import org.cryptomator.ui.fxapp.FxApplicationWindows;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -20,9 +20,6 @@ import javafx.stage.FileChooser;
 import javafx.stage.Stage;
 import java.io.File;
 import java.io.IOException;
-import java.io.InputStream;
-import java.io.UncheckedIOException;
-import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
 import java.util.ResourceBundle;

@@ -34,7 +31,7 @@ public class ChooseExistingVaultController implements FxController {
 	private final Stage window;
 	private final Lazy<Scene> welcomeScene;
 	private final Lazy<Scene> successScene;
-	private final ErrorComponent.Builder errorComponent;
+	private final FxApplicationWindows appWindows;
 	private final ObjectProperty<Path> vaultPath;
 	private final ObjectProperty<Vault> vault;
 	private final VaultListManager vaultListManager;
@@ -43,11 +40,11 @@ public class ChooseExistingVaultController implements FxController {
 	private Image screenshot;

 	@Inject
-	ChooseExistingVaultController(@AddVaultWizardWindow Stage window, @FxmlScene(FxmlFile.ADDVAULT_WELCOME) Lazy<Scene> welcomeScene, @FxmlScene(FxmlFile.ADDVAULT_SUCCESS) Lazy<Scene> successScene, ErrorComponent.Builder errorComponent, ObjectProperty<Path> vaultPath, @AddVaultWizardWindow ObjectProperty<Vault> vault, VaultListManager vaultListManager, ResourceBundle resourceBundle) {
+	ChooseExistingVaultController(@AddVaultWizardWindow Stage window, @FxmlScene(FxmlFile.ADDVAULT_WELCOME) Lazy<Scene> welcomeScene, @FxmlScene(FxmlFile.ADDVAULT_SUCCESS) Lazy<Scene> successScene, FxApplicationWindows appWindows, ObjectProperty<Path> vaultPath, @AddVaultWizardWindow ObjectProperty<Vault> vault, VaultListManager vaultListManager, ResourceBundle resourceBundle) {
 		this.window = window;
 		this.welcomeScene = welcomeScene;
 		this.successScene = successScene;
-		this.errorComponent = errorComponent;
+		this.appWindows = appWindows;
 		this.vaultPath = vaultPath;
 		this.vault = vault;
 		this.vaultListManager = vaultListManager;
@@ -82,7 +79,7 @@ public class ChooseExistingVaultController implements FxController {
 				window.setScene(successScene.get());
 			} catch (IOException e) {
 				LOG.error("Failed to open existing vault.", e);
-				errorComponent.cause(e).window(window).returnToScene(window.getScene()).build().showErrorScene();
+				appWindows.showErrorWindow(e, window, window.getScene());
 			}
 		}
 	}
--- a/src/main/java/org/cryptomator/ui/addvaultwizard/CreateNewVaultLocationController.java
+++ b/src/main/java/org/cryptomator/ui/addvaultwizard/CreateNewVaultLocationController.java
@@ -35,14 +35,13 @@ import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.nio.file.StandardOpenOption;
 import java.util.ResourceBundle;
-import java.util.UUID;

@AddVaultWizardScoped
 public class CreateNewVaultLocationController implements FxController {

 	private static final Logger LOG = LoggerFactory.getLogger(CreateNewVaultLocationController.class);
 	private static final Path DEFAULT_CUSTOM_VAULT_PATH = Paths.get(System.getProperty("user.home"));
-	private static final String TEMP_FILE_FORMAT = "cryptomator-%s.tmp";
+	private static final String TEMP_FILE_FORMAT = ".locationTest.cryptomator.tmp";

 	private final Stage window;
 	private final Lazy<Scene> chooseNameScene;
@@ -112,7 +111,7 @@ public class CreateNewVaultLocationController implements FxController {
 	}

 	private boolean isActuallyWritable(Path p) {
-		Path tmpFile = p.resolve(String.format(TEMP_FILE_FORMAT, UUID.randomUUID()));
+		Path tmpFile = p.resolve(TEMP_FILE_FORMAT);
 		try (var chan = Files.newByteChannel(tmpFile, StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE, StandardOpenOption.DELETE_ON_CLOSE)) {
 			return true;
 		} catch (IOException e) {
--- a/src/main/java/org/cryptomator/ui/addvaultwizard/CreateNewVaultPasswordController.java
+++ b/src/main/java/org/cryptomator/ui/addvaultwizard/CreateNewVaultPasswordController.java
@@ -10,12 +10,12 @@ import org.cryptomator.cryptolib.api.CryptorProvider;
 import org.cryptomator.cryptolib.api.Masterkey;
 import org.cryptomator.cryptolib.api.MasterkeyLoader;
 import org.cryptomator.cryptolib.common.MasterkeyFileAccess;
-import org.cryptomator.ui.common.ErrorComponent;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxmlFile;
 import org.cryptomator.ui.common.FxmlScene;
 import org.cryptomator.ui.common.NewPasswordController;
 import org.cryptomator.ui.common.Tasks;
+import org.cryptomator.ui.fxapp.FxApplicationWindows;
 import org.cryptomator.ui.keyloading.masterkeyfile.MasterkeyFileLoadingStrategy;
 import org.cryptomator.ui.recoverykey.RecoveryKeyFactory;
 import org.slf4j.Logger;
@@ -60,7 +60,7 @@ public class CreateNewVaultPasswordController implements FxController {
 	private final Lazy<Scene> chooseLocationScene;
 	private final Lazy<Scene> recoveryKeyScene;
 	private final Lazy<Scene> successScene;
-	private final ErrorComponent.Builder errorComponent;
+	private final FxApplicationWindows appWindows;
 	private final ExecutorService executor;
 	private final RecoveryKeyFactory recoveryKeyFactory;
 	private final StringProperty vaultNameProperty;
@@ -83,12 +83,12 @@ public class CreateNewVaultPasswordController implements FxController {
 	public NewPasswordController newPasswordSceneController;

 	@Inject
-	CreateNewVaultPasswordController(@AddVaultWizardWindow Stage window, @FxmlScene(FxmlFile.ADDVAULT_NEW_LOCATION) Lazy<Scene> chooseLocationScene, @FxmlScene(FxmlFile.ADDVAULT_NEW_RECOVERYKEY) Lazy<Scene> recoveryKeyScene, @FxmlScene(FxmlFile.ADDVAULT_SUCCESS) Lazy<Scene> successScene, ErrorComponent.Builder errorComponent, ExecutorService executor, RecoveryKeyFactory recoveryKeyFactory, @Named("vaultName") StringProperty vaultName, ObjectProperty<Path> vaultPath, @AddVaultWizardWindow ObjectProperty<Vault> vault, @Named("recoveryKey") StringProperty recoveryKey, VaultListManager vaultListManager, ResourceBundle resourceBundle, ReadmeGenerator readmeGenerator, SecureRandom csprng, MasterkeyFileAccess masterkeyFileAccess) {
+	CreateNewVaultPasswordController(@AddVaultWizardWindow Stage window, @FxmlScene(FxmlFile.ADDVAULT_NEW_LOCATION) Lazy<Scene> chooseLocationScene, @FxmlScene(FxmlFile.ADDVAULT_NEW_RECOVERYKEY) Lazy<Scene> recoveryKeyScene, @FxmlScene(FxmlFile.ADDVAULT_SUCCESS) Lazy<Scene> successScene, FxApplicationWindows appWindows, ExecutorService executor, RecoveryKeyFactory recoveryKeyFactory, @Named("vaultName") StringProperty vaultName, ObjectProperty<Path> vaultPath, @AddVaultWizardWindow ObjectProperty<Vault> vault, @Named("recoveryKey") StringProperty recoveryKey, VaultListManager vaultListManager, ResourceBundle resourceBundle, ReadmeGenerator readmeGenerator, SecureRandom csprng, MasterkeyFileAccess masterkeyFileAccess) {
 		this.window = window;
 		this.chooseLocationScene = chooseLocationScene;
 		this.recoveryKeyScene = recoveryKeyScene;
 		this.successScene = successScene;
-		this.errorComponent = errorComponent;
+		this.appWindows = appWindows;
 		this.executor = executor;
 		this.recoveryKeyFactory = recoveryKeyFactory;
 		this.vaultNameProperty = vaultName;
@@ -127,7 +127,7 @@ public class CreateNewVaultPasswordController implements FxController {
 			Files.createDirectory(pathToVault);
 		} catch (IOException e) {
 			LOG.error("Failed to create vault directory.", e);
-			errorComponent.cause(e).window(window).returnToScene(window.getScene()).build().showErrorScene();
+			appWindows.showErrorWindow(e, window, window.getScene());
 			return;
 		}

@@ -152,7 +152,7 @@ public class CreateNewVaultPasswordController implements FxController {
 			window.setScene(recoveryKeyScene.get());
 		}).onError(IOException.class, e -> {
 			LOG.error("Failed to initialize vault.", e);
-			errorComponent.cause(e).window(window).returnToScene(window.getScene()).build().showErrorScene();
+			appWindows.showErrorWindow(e, window, window.getScene());
 		}).andFinally(() -> {
 			processing.set(false);
 		}).runOnce(executor);
@@ -168,7 +168,7 @@ public class CreateNewVaultPasswordController implements FxController {
 			window.setScene(successScene.get());
 		}).onError(IOException.class, e -> {
 			LOG.error("Failed to initialize vault.", e);
-			errorComponent.cause(e).window(window).returnToScene(window.getScene()).build().showErrorScene();
+			appWindows.showErrorWindow(e, window, window.getScene());
 		}).andFinally(() -> {
 			processing.set(false);
 		}).runOnce(executor);
--- a/src/main/java/org/cryptomator/ui/changepassword/ChangePasswordController.java
+++ b/src/main/java/org/cryptomator/ui/changepassword/ChangePasswordController.java
@@ -8,10 +8,10 @@ import org.cryptomator.cryptolib.api.InvalidPassphraseException;
 import org.cryptomator.cryptolib.common.MasterkeyFileAccess;
 import org.cryptomator.integrations.keychain.KeychainAccessException;
 import org.cryptomator.ui.common.Animations;
-import org.cryptomator.ui.common.ErrorComponent;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.NewPasswordController;
 import org.cryptomator.ui.controls.NiceSecurePasswordField;
+import org.cryptomator.ui.fxapp.FxApplicationWindows;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -26,7 +26,6 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.StandardCopyOption;
 import java.nio.file.StandardOpenOption;
-import java.security.SecureRandom;

 import static org.cryptomator.common.Constants.MASTERKEY_BACKUP_SUFFIX;
 import static org.cryptomator.common.Constants.MASTERKEY_FILENAME;
@@ -38,9 +37,8 @@ public class ChangePasswordController implements FxController {

 	private final Stage window;
 	private final Vault vault;
-	private final ErrorComponent.Builder errorComponent;
+	private final FxApplicationWindows appWindows;
 	private final KeychainManager keychain;
-	private final SecureRandom csprng;
 	private final MasterkeyFileAccess masterkeyFileAccess;

 	public NiceSecurePasswordField oldPasswordField;
@@ -49,12 +47,11 @@ public class ChangePasswordController implements FxController {
 	public NewPasswordController newPasswordController;

 	@Inject
-	public ChangePasswordController(@ChangePasswordWindow Stage window, @ChangePasswordWindow Vault vault, ErrorComponent.Builder errorComponent, KeychainManager keychain, SecureRandom csprng, MasterkeyFileAccess masterkeyFileAccess) {
+	public ChangePasswordController(@ChangePasswordWindow Stage window, @ChangePasswordWindow Vault vault, FxApplicationWindows appWindows, KeychainManager keychain, MasterkeyFileAccess masterkeyFileAccess) {
 		this.window = window;
 		this.vault = vault;
-		this.errorComponent = errorComponent;
+		this.appWindows = appWindows;
 		this.keychain = keychain;
-		this.csprng = csprng;
 		this.masterkeyFileAccess = masterkeyFileAccess;
 	}

@@ -95,7 +92,7 @@ public class ChangePasswordController implements FxController {
 			oldPasswordField.requestFocus();
 		} catch (IOException | CryptoException e) {
 			LOG.error("Password change failed. Unable to perform operation.", e);
-			errorComponent.cause(e).window(window).returnToScene(window.getScene()).build().showErrorScene();
+			appWindows.showErrorWindow(e, window, window.getScene());
 		}
 	}

--- a/src/main/java/org/cryptomator/ui/common/ErrorComponent.java
+++ b/src/main/java/org/cryptomator/ui/common/ErrorComponent.java
@@ -4,7 +4,6 @@ import dagger.BindsInstance;
 import dagger.Subcomponent;
 import org.cryptomator.common.Nullable;

-import javafx.application.Platform;
 import javafx.scene.Scene;
 import javafx.stage.Stage;

@@ -16,34 +15,17 @@ public interface ErrorComponent {
 	@FxmlScene(FxmlFile.ERROR)
 	Scene scene();

-	default void showErrorScene() {
-		if (Platform.isFxApplicationThread()) {
-			show();
-		} else {
-			Platform.runLater(this::show);
-		}
-	}
-
-	private void show() {
+	default Stage show() {
 		Stage stage = window();
 		stage.setScene(scene());
 		stage.show();
+		return stage;
 	}

-	@Subcomponent.Builder
-	interface Builder {
-
-		@BindsInstance
-		Builder cause(Throwable cause);
-
-		@BindsInstance
-		Builder window(Stage window);
-
-		@BindsInstance
-		Builder returnToScene(@Nullable Scene previousScene);
-
-		ErrorComponent build();
+	@Subcomponent.Factory
+	interface Factory {

+		ErrorComponent create(@BindsInstance Throwable cause, @BindsInstance Stage window, @BindsInstance @Nullable Scene previousScene);
 	}

 }
--- a/src/main/java/org/cryptomator/ui/common/FxmlFile.java
+++ b/src/main/java/org/cryptomator/ui/common/FxmlFile.java
@@ -46,7 +46,7 @@ public enum FxmlFile {
 		this.ressourcePathString = ressourcePathString;
 	}

-	String getRessourcePathString() {
+	public String getRessourcePathString() {
 		return ressourcePathString;
 	}
 }
--- a/src/main/java/org/cryptomator/ui/common/FxmlLoaderFactory.java
+++ b/src/main/java/org/cryptomator/ui/common/FxmlLoaderFactory.java
@@ -22,6 +22,10 @@ public class FxmlLoaderFactory {
 		this.resourceBundle = resourceBundle;
 	}

+	public static <T extends FxController> FxmlLoaderFactory forController(T controller, Function<Parent, Scene> sceneFactory, ResourceBundle resourceBundle) {
+		return new FxmlLoaderFactory(Map.of(controller.getClass(), () -> controller), sceneFactory, resourceBundle);
+	}
+
 	/**
 	 * @return A new FXMLLoader instance
 	 */
--- a/src/main/java/org/cryptomator/ui/common/StageFactory.java
+++ b/src/main/java/org/cryptomator/ui/common/StageFactory.java
@@ -1,23 +1,24 @@
 package org.cryptomator.ui.common;

+import org.cryptomator.ui.fxapp.FxApplicationScoped;
+
+import javax.inject.Inject;
 import javafx.stage.Stage;
 import javafx.stage.StageStyle;
 import java.util.function.Consumer;

+@FxApplicationScoped
 public class StageFactory {

 	private final Consumer<Stage> initializer;

-	public StageFactory(Consumer<Stage> initializer) {
+	@Inject
+	public StageFactory(StageInitializer initializer) {
 		this.initializer = initializer;
 	}

 	public Stage create() {
-		return create(StageStyle.DECORATED);
-	}
-
-	public Stage create(StageStyle stageStyle) {
-		Stage stage = new Stage(stageStyle);
+		Stage stage = new Stage(StageStyle.DECORATED);
 		initializer.accept(stage);
 		return stage;
 	}
--- a/src/main/java/org/cryptomator/ui/common/StageInitializer.java
+++ b/src/main/java/org/cryptomator/ui/common/StageInitializer.java
@@ -0,0 +1,32 @@
+package org.cryptomator.ui.common;
+
+import org.apache.commons.lang3.SystemUtils;
+import org.cryptomator.ui.fxapp.FxApplicationScoped;
+
+import javax.inject.Inject;
+import javafx.scene.image.Image;
+import javafx.stage.Stage;
+import java.util.List;
+import java.util.function.Consumer;
+
+/**
+ * Performs common setup for all stages
+ */
+@FxApplicationScoped
+public class StageInitializer implements Consumer<Stage> {
+
+	private final List<Image> windowIcons;
+
+	@Inject
+	public StageInitializer() {
+		this.windowIcons = SystemUtils.IS_OS_MAC ? List.of() : List.of( //
+				new Image(StageInitializer.class.getResource("/img/window_icon_32.png").toString()), //
+				new Image(StageInitializer.class.getResource("/img/window_icon_512.png").toString()) //
+		);
+	}
+
+	@Override
+	public void accept(Stage stage) {
+		stage.getIcons().setAll(windowIcons);
+	}
+}
--- a/src/main/java/org/cryptomator/ui/common/UserInteractionLock.java
+++ b/src/main/java/org/cryptomator/ui/common/UserInteractionLock.java
@@ -1,61 +0,0 @@
-package org.cryptomator.ui.common;
-
-import javafx.application.Platform;
-import javafx.beans.property.BooleanProperty;
-import javafx.beans.property.ReadOnlyBooleanProperty;
-import javafx.beans.property.SimpleBooleanProperty;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.concurrent.atomic.AtomicReference;
-import java.util.concurrent.locks.Condition;
-import java.util.concurrent.locks.Lock;
-import java.util.concurrent.locks.ReentrantLock;
-
-public class UserInteractionLock<E extends Enum<E>> {
-
-	private final Lock lock = new ReentrantLock();
-	private final Condition condition = lock.newCondition();
-	private final BooleanProperty awaitingInteraction = new SimpleBooleanProperty();
-	private final AtomicBoolean interacted = new AtomicBoolean();
-	private final AtomicReference<E> state;
-
-	public UserInteractionLock(E initialValue) {
-		this.state = new AtomicReference<>(initialValue);
-	}
-
-	public synchronized void reset(E value) {
-		state.set(value);
-		interacted.set(false);
-	}
-
-	public void interacted(E result) {
-		assert Platform.isFxApplicationThread();
-		lock.lock();
-		try {
-			state.set(result);
-			interacted.set(true);
-			awaitingInteraction.set(false);
-			condition.signal();
-		} finally {
-			lock.unlock();
-		}
-	}
-
-	public E awaitInteraction() throws InterruptedException {
-		assert !Platform.isFxApplicationThread();
-		lock.lock();
-		try {
-			Platform.runLater(() -> awaitingInteraction.set(true));
-			while (!interacted.get()) {
-				condition.await();
-			}
-			return state.get();
-		} finally {
-			lock.unlock();
-		}
-	}
-
-	public ReadOnlyBooleanProperty awaitingInteraction() {
-		return awaitingInteraction;
-	}
-
-}
--- a/src/main/java/org/cryptomator/ui/common/VaultService.java
+++ b/src/main/java/org/cryptomator/ui/common/VaultService.java
@@ -10,6 +10,7 @@ import org.slf4j.LoggerFactory;

 import javax.inject.Inject;
 import javafx.concurrent.Task;
+import javafx.stage.Stage;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Iterator;
@@ -53,7 +54,9 @@ public class VaultService {
 	 *
 	 * @param vault The vault to lock
 	 * @param forced Whether to attempt a forced lock
+	 * @deprecated use {@link org.cryptomator.ui.fxapp.FxApplicationWindows#startLockWorkflow(Vault, Stage)}
 	 */
+	@Deprecated
 	public void lock(Vault vault, boolean forced) {
 		executorService.execute(createLockTask(vault, forced));
 	}
@@ -90,7 +93,7 @@ public class VaultService {
 	 * @return Meta-Task that waits until all vaults are locked or fails after the first failure of a subtask
 	 */
 	public Task<Collection<Vault>> createLockAllTask(Collection<Vault> vaults, boolean forced) {
-		List<Task<Vault>> lockTasks = vaults.stream().map(v -> new LockVaultTask(v, forced)).collect(Collectors.toUnmodifiableList());
+		List<Task<Vault>> lockTasks = vaults.stream().<Task<Vault>>map(v -> new LockVaultTask(v, forced)).toList();
 		lockTasks.forEach(executorService::execute);
 		Task<Collection<Vault>> task = new WaitForTasksTask(lockTasks);
 		String vaultNames = vaults.stream().map(Vault::getDisplayName).collect(Collectors.joining(", "));
--- a/src/main/java/org/cryptomator/ui/controls/NiceSecurePasswordField.java
+++ b/src/main/java/org/cryptomator/ui/controls/NiceSecurePasswordField.java
@@ -1,5 +1,7 @@
 package org.cryptomator.ui.controls;

+import org.cryptomator.common.Passphrase;
+
 import javafx.beans.Observable;
 import javafx.beans.binding.Bindings;
 import javafx.beans.property.StringProperty;
@@ -82,11 +84,7 @@ public class NiceSecurePasswordField extends StackPane {
 		return passwordField.textProperty();
 	}

-	public char[] copyChars() {
-		return passwordField.copyChars();
-	}
-
-	public CharSequence getCharacters() {
+	public Passphrase getCharacters() {
 		return passwordField.getCharacters();
 	}

--- a/src/main/java/org/cryptomator/ui/controls/SecurePasswordField.java
+++ b/src/main/java/org/cryptomator/ui/controls/SecurePasswordField.java
@@ -9,6 +9,7 @@
 package org.cryptomator.ui.controls;

 import com.google.common.base.Strings;
+import org.cryptomator.common.Passphrase;

 import javafx.application.Platform;
 import javafx.beans.NamedArg;
@@ -28,7 +29,6 @@ import javafx.scene.input.KeyCodeCombination;
 import javafx.scene.input.KeyCombination;
 import javafx.scene.input.KeyEvent;
 import javafx.scene.input.TransferMode;
-import java.nio.CharBuffer;
 import java.text.Normalizer;
 import java.text.Normalizer.Form;
 import java.util.Arrays;
@@ -212,8 +212,8 @@ public class SecurePasswordField extends TextField {
 	 * @see #wipe()
 	 */
 	@Override
-	public CharSequence getCharacters() {
-		return CharBuffer.wrap(content, 0, length);
+	public Passphrase getCharacters() {
+		return new Passphrase(content, 0, length);
 	}

 	/**
--- a/src/main/java/org/cryptomator/ui/launcher/AppLaunchEventHandler.java
+++ b/src/main/java/org/cryptomator/ui/launcher/AppLaunchEventHandler.java
@@ -1,14 +1,14 @@
-package org.cryptomator.ui.launcher;
+package org.cryptomator.ui.fxapp;

 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.common.vaults.VaultListManager;
-import org.cryptomator.ui.fxapp.FxApplication;
+import org.cryptomator.launcher.AppLaunchEvent;
+import org.cryptomator.ui.common.VaultService;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import javax.inject.Inject;
 import javax.inject.Named;
-import javax.inject.Singleton;
 import javafx.application.Platform;
 import java.io.IOException;
 import java.nio.file.Path;
@@ -17,22 +17,25 @@ import java.util.concurrent.ExecutorService;

 import static org.cryptomator.common.Constants.CRYPTOMATOR_FILENAME_EXT;

-@Singleton
+// TODO: use message bus
+@FxApplicationScoped
 class AppLaunchEventHandler {

 	private static final Logger LOG = LoggerFactory.getLogger(AppLaunchEventHandler.class);

 	private final BlockingQueue<AppLaunchEvent> launchEventQueue;
 	private final ExecutorService executorService;
-	private final FxApplicationStarter fxApplicationStarter;
+	private final FxApplicationWindows appWindows;
 	private final VaultListManager vaultListManager;
+	private final VaultService vaultService;

 	@Inject
-	public AppLaunchEventHandler(@Named("launchEventQueue") BlockingQueue<AppLaunchEvent> launchEventQueue, ExecutorService executorService, FxApplicationStarter fxApplicationStarter, VaultListManager vaultListManager) {
+	public AppLaunchEventHandler(@Named("launchEventQueue") BlockingQueue<AppLaunchEvent> launchEventQueue, ExecutorService executorService, FxApplicationWindows appWindows, VaultListManager vaultListManager, VaultService vaultService) {
 		this.launchEventQueue = launchEventQueue;
 		this.executorService = executorService;
-		this.fxApplicationStarter = fxApplicationStarter;
+		this.appWindows = appWindows;
 		this.vaultListManager = vaultListManager;
+		this.vaultService = vaultService;
 	}

 	public void startHandlingLaunchEvents() {
@@ -52,14 +55,12 @@ class AppLaunchEventHandler {
 	}

 	private void handleLaunchEvent(AppLaunchEvent event) {
-		switch (event.getType()) {
-			case REVEAL_APP -> fxApplicationStarter.get().thenAccept(FxApplication::showMainWindow);
-			case OPEN_FILE -> fxApplicationStarter.get().thenRun(() -> {
-				Platform.runLater(() -> {
-					event.getPathsToOpen().forEach(this::addOrRevealVault);
-				});
+		switch (event.type()) {
+			case REVEAL_APP -> appWindows.showMainWindow();
+			case OPEN_FILE -> Platform.runLater(() -> {
+				event.pathsToOpen().forEach(this::addOrRevealVault);
 			});
-			default -> LOG.warn("Unsupported event type: {}", event.getType());
+			default -> LOG.warn("Unsupported event type: {}", event.type());
 		}
 	}

@@ -75,7 +76,7 @@ class AppLaunchEventHandler {
 			}

 			if (v.isUnlocked()) {
-				fxApplicationStarter.get().thenAccept(app -> app.getVaultService().reveal(v));
+				vaultService.reveal(v);
 			}
 			LOG.debug("Added vault {}", potentialVaultPath);
 		} catch (IOException e) {
--- a/src/main/java/org/cryptomator/ui/fxapp/AutoUnlocker.java
+++ b/src/main/java/org/cryptomator/ui/fxapp/AutoUnlocker.java
@@ -0,0 +1,26 @@
+package org.cryptomator.ui.fxapp;
+
+import org.cryptomator.common.vaults.Vault;
+
+import javax.inject.Inject;
+import javafx.collections.ObservableList;
+
+@FxApplicationScoped
+public class AutoUnlocker {
+
+	private final ObservableList<Vault> vaults;
+	private final FxApplicationWindows appWindows;
+
+	@Inject
+	public AutoUnlocker(ObservableList<Vault> vaults, FxApplicationWindows appWindows) {
+		this.vaults = vaults;
+		this.appWindows = appWindows;
+	}
+
+	public void unlock() {
+		vaults.stream().filter(Vault::isLocked).filter(v -> v.getVaultSettings().unlockAfterStartup().get()).forEach(v -> {
+			appWindows.startUnlockWorkflow(v, null);
+		});
+	}
+
+}
--- a/src/main/java/org/cryptomator/ui/fxapp/ExitingQuitResponse.java
+++ b/src/main/java/org/cryptomator/ui/fxapp/ExitingQuitResponse.java
@@ -0,0 +1,20 @@
+package org.cryptomator.ui.fxapp;
+
+import javafx.application.Platform;
+import java.awt.desktop.QuitResponse;
+
+record ExitingQuitResponse(QuitResponse delegate) implements QuitResponse {
+
+	@Override
+	public void performQuit() {
+		Platform.exit();
+		// TODO wait a moment for javafx to terminate?
+		delegate.performQuit();
+	}
+
+	@Override
+	public void cancelQuit() {
+		delegate.cancelQuit();
+	}
+
+}
--- a/src/main/java/org/cryptomator/ui/fxapp/FxApplication.java
+++ b/src/main/java/org/cryptomator/ui/fxapp/FxApplication.java
@@ -1,213 +1,70 @@
 package org.cryptomator.ui.fxapp;

 import dagger.Lazy;
-import javafx.application.Application;
-import javafx.application.Platform;
-import javafx.beans.binding.Bindings;
-import javafx.beans.binding.BooleanBinding;
-import javafx.beans.value.ObservableValue;
-import javafx.collections.ObservableList;
-import javafx.stage.Stage;
-import javafx.stage.Window;
-import org.cryptomator.common.LicenseHolder;
 import org.cryptomator.common.settings.Settings;
-import org.cryptomator.common.settings.UiTheme;
-import org.cryptomator.common.vaults.Vault;
-import org.cryptomator.common.vaults.VaultListManager;
-import org.cryptomator.common.vaults.VaultState;
-import org.cryptomator.integrations.tray.TrayIntegrationProvider;
-import org.cryptomator.integrations.uiappearance.Theme;
-import org.cryptomator.integrations.uiappearance.UiAppearanceException;
-import org.cryptomator.integrations.uiappearance.UiAppearanceListener;
-import org.cryptomator.integrations.uiappearance.UiAppearanceProvider;
-import org.cryptomator.ui.common.ErrorComponent;
-import org.cryptomator.ui.common.VaultService;
-import org.cryptomator.ui.lock.LockComponent;
-import org.cryptomator.ui.mainwindow.MainWindowComponent;
-import org.cryptomator.ui.preferences.PreferencesComponent;
-import org.cryptomator.ui.preferences.SelectedPreferencesTab;
-import org.cryptomator.ui.quit.QuitComponent;
-import org.cryptomator.ui.unlock.UnlockComponent;
+import org.cryptomator.ui.traymenu.TrayMenuComponent;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import javax.inject.Inject;
-import javax.inject.Provider;
-import java.awt.desktop.QuitResponse;
-import java.util.Optional;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionStage;
-import java.util.concurrent.ScheduledExecutorService;
-import java.util.concurrent.TimeUnit;
+import javafx.application.Platform;
+import javafx.stage.Stage;
+import javafx.stage.StageStyle;
+import java.awt.SystemTray;

@FxApplicationScoped
-public class FxApplication extends Application {
+public class FxApplication {

 	private static final Logger LOG = LoggerFactory.getLogger(FxApplication.class);

 	private final Settings settings;
-	private final Lazy<MainWindowComponent> mainWindow;
-	private final Lazy<PreferencesComponent> preferencesWindow;
-	private final Lazy<QuitComponent> quitWindow;
-	private final Provider<UnlockComponent.Builder> unlockWorkflowBuilderProvider;
-	private final Provider<LockComponent.Builder> lockWorkflowBuilderProvider;
-	private final ErrorComponent.Builder errorWindowBuilder;
-	private final Optional<TrayIntegrationProvider> trayIntegration;
-	private final Optional<UiAppearanceProvider> appearanceProvider;
-	private final VaultService vaultService;
-	private final LicenseHolder licenseHolder;
-	private final ObservableList<Window> visibleWindows;
-	private final BooleanBinding hasVisibleWindows;
-	private final UiAppearanceListener systemInterfaceThemeListener = this::systemInterfaceThemeChanged;
+	private final AppLaunchEventHandler launchEventHandler;
+	private final Lazy<TrayMenuComponent> trayMenu;
+	private final FxApplicationWindows appWindows;
+	private final FxApplicationStyle applicationStyle;
+	private final FxApplicationTerminator applicationTerminator;
+	private final AutoUnlocker autoUnlocker;

 	@Inject
-	FxApplication(Settings settings, Lazy<MainWindowComponent> mainWindow, Lazy<PreferencesComponent> preferencesWindow, Provider<UnlockComponent.Builder> unlockWorkflowBuilderProvider, Provider<LockComponent.Builder> lockWorkflowBuilderProvider, Lazy<QuitComponent> quitWindow, ErrorComponent.Builder errorWindowBuilder, Optional<TrayIntegrationProvider> trayIntegration, Optional<UiAppearanceProvider> appearanceProvider, VaultService vaultService, LicenseHolder licenseHolder) {
+	FxApplication(Settings settings, AppLaunchEventHandler launchEventHandler, Lazy<TrayMenuComponent> trayMenu, FxApplicationWindows appWindows, FxApplicationStyle applicationStyle, FxApplicationTerminator applicationTerminator, AutoUnlocker autoUnlocker) {
 		this.settings = settings;
-		this.mainWindow = mainWindow;
-		this.preferencesWindow = preferencesWindow;
-		this.unlockWorkflowBuilderProvider = unlockWorkflowBuilderProvider;
-		this.lockWorkflowBuilderProvider = lockWorkflowBuilderProvider;
-		this.quitWindow = quitWindow;
-		this.errorWindowBuilder = errorWindowBuilder;
-		this.trayIntegration = trayIntegration;
-		this.appearanceProvider = appearanceProvider;
-		this.vaultService = vaultService;
-		this.licenseHolder = licenseHolder;
-		this.visibleWindows = Stage.getWindows().filtered(Window::isShowing);
-		this.hasVisibleWindows = Bindings.isNotEmpty(visibleWindows);
+		this.launchEventHandler = launchEventHandler;
+		this.trayMenu = trayMenu;
+		this.appWindows = appWindows;
+		this.applicationStyle = applicationStyle;
+		this.applicationTerminator = applicationTerminator;
+		this.autoUnlocker = autoUnlocker;
 	}

 	public void start() {
 		LOG.trace("FxApplication.start()");
-		Platform.setImplicitExit(false);
+		applicationStyle.initialize();
+		appWindows.initialize();
+		applicationTerminator.initialize();

-		hasVisibleWindows.addListener(this::hasVisibleStagesChanged);
-
-		settings.theme().addListener(this::appThemeChanged);
-		loadSelectedStyleSheet(settings.theme().get());
-	}
-
-	@Override
-	public void start(Stage stage) {
-		throw new UnsupportedOperationException("Use start() instead.");
-	}
-
-	private void hasVisibleStagesChanged(@SuppressWarnings("unused") ObservableValue<? extends Boolean> observableValue, @SuppressWarnings("unused") boolean oldValue, boolean newValue) {
-		LOG.debug("has visible stages: {}", newValue);
-		if (newValue) {
-			trayIntegration.ifPresent(TrayIntegrationProvider::restoredFromTray);
+		// init system tray
+		final boolean hasTrayIcon;
+		if (SystemTray.isSupported() && settings.showTrayIcon().get()) {
+			trayMenu.get().initializeTrayIcon();
+			Platform.setImplicitExit(false); // don't quit when closing all windows
+			hasTrayIcon = true;
 		} else {
-			trayIntegration.ifPresent(TrayIntegrationProvider::minimizedToTray);
+			hasTrayIcon = false;
 		}
-	}

-	public void showPreferencesWindow(SelectedPreferencesTab selectedTab) {
-		Platform.runLater(() -> {
-			preferencesWindow.get().showPreferencesWindow(selectedTab);
-			LOG.debug("Showing Preferences");
-		});
-	}
-
-	public CompletionStage<Stage> showMainWindow() {
-		CompletableFuture<Stage> future = new CompletableFuture<>();
-		Platform.runLater(() -> {
-			var win = mainWindow.get().showMainWindow();
-			LOG.debug("Showing MainWindow");
-			future.complete(win);
-		});
-		return future;
-	}
-
-	public void startUnlockWorkflow(Vault vault, Optional<Stage> owner) {
-		Platform.runLater(() -> {
-			if (vault.stateProperty().transition(VaultState.Value.LOCKED, VaultState.Value.PROCESSING)) {
-				unlockWorkflowBuilderProvider.get().vault(vault).owner(owner).build().startUnlockWorkflow();
-				LOG.debug("Start unlock workflow for {}", vault.getDisplayName());
-			} else {
-				showMainWindow().thenAccept(mainWindow -> errorWindowBuilder.window(mainWindow).cause(new IllegalStateException("Unable to unlock vault in non-locked state.")));
+		// show main window
+		appWindows.showMainWindow().thenAccept(stage -> {
+			if (settings.startHidden().get()) {
+				if (hasTrayIcon) {
+					stage.hide();
+				} else {
+					stage.setIconified(true);
+				}
 			}
 		});
-	}

-	public void startLockWorkflow(Vault vault, Optional<Stage> owner) {
-		Platform.runLater(() -> {
-			if (vault.stateProperty().transition(VaultState.Value.UNLOCKED, VaultState.Value.PROCESSING)) {
-				lockWorkflowBuilderProvider.get().vault(vault).owner(owner).build().startLockWorkflow();
-				LOG.debug("Start lock workflow for {}", vault.getDisplayName());
-			} else {
-				showMainWindow().thenAccept(mainWindow -> errorWindowBuilder.window(mainWindow).cause(new IllegalStateException("Unable to lock vault in non-unlocked state.")));
-			}
-		});
-	}
-
-	public void showQuitWindow(QuitResponse response) {
-		Platform.runLater(() -> {
-			quitWindow.get().showQuitWindow(response);
-			LOG.debug("Showing QuitWindow");
-		});
-	}
-
-	public VaultService getVaultService() {
-		return vaultService;
-	}
-
-	private void appThemeChanged(@SuppressWarnings("unused") ObservableValue<? extends UiTheme> observable, @SuppressWarnings("unused") UiTheme oldValue, UiTheme newValue) {
-		if (appearanceProvider.isPresent() && oldValue == UiTheme.AUTOMATIC && newValue != UiTheme.AUTOMATIC) {
-			try {
-				appearanceProvider.get().removeListener(systemInterfaceThemeListener);
-			} catch (UiAppearanceException e) {
-				LOG.error("Failed to disable automatic theme switching.");
-			}
-		}
-		loadSelectedStyleSheet(newValue);
-	}
-
-	private void loadSelectedStyleSheet(UiTheme desiredTheme) {
-		UiTheme theme = licenseHolder.isValidLicense() ? desiredTheme : UiTheme.LIGHT;
-		switch (theme) {
-			case LIGHT -> applyLightTheme();
-			case DARK -> applyDarkTheme();
-			case AUTOMATIC -> {
-				appearanceProvider.ifPresent(appearanceProvider -> {
-					try {
-						appearanceProvider.addListener(systemInterfaceThemeListener);
-					} catch (UiAppearanceException e) {
-						LOG.error("Failed to enable automatic theme switching.");
-					}
-				});
-				applySystemTheme();
-			}
-		}
-	}
-
-	private void systemInterfaceThemeChanged(Theme theme) {
-		switch (theme) {
-			case LIGHT -> applyLightTheme();
-			case DARK -> applyDarkTheme();
-		}
-	}
-
-	private void applySystemTheme() {
-		if (appearanceProvider.isPresent()) {
-			systemInterfaceThemeChanged(appearanceProvider.get().getSystemTheme());
-		} else {
-			LOG.warn("No UiAppearanceProvider present, assuming LIGHT theme...");
-			applyLightTheme();
-		}
-	}
-
-	private void applyLightTheme() {
-		Application.setUserAgentStylesheet(getClass().getResource("/css/light_theme.css").toString());
-		appearanceProvider.ifPresent(appearanceProvider -> {
-			appearanceProvider.adjustToTheme(Theme.LIGHT);
-		});
-	}
-
-	private void applyDarkTheme() {
-		Application.setUserAgentStylesheet(getClass().getResource("/css/dark_theme.css").toString());
-		appearanceProvider.ifPresent(appearanceProvider -> {
-			appearanceProvider.adjustToTheme(Theme.DARK);
-		});
+		launchEventHandler.startHandlingLaunchEvents();
+		autoUnlocker.unlock();
 	}

 }
--- a/src/main/java/org/cryptomator/ui/fxapp/FxApplicationComponent.java
+++ b/src/main/java/org/cryptomator/ui/fxapp/FxApplicationComponent.java
@@ -5,8 +5,12 @@
 *******************************************************************************/
 package org.cryptomator.ui.fxapp;

+import dagger.BindsInstance;
 import dagger.Subcomponent;

+import javafx.application.Application;
+import javafx.stage.Stage;
+
@FxApplicationScoped
@Subcomponent(modules = FxApplicationModule.class)
 public interface FxApplicationComponent {
@@ -16,6 +20,12 @@ public interface FxApplicationComponent {
 	@Subcomponent.Builder
 	interface Builder {

+		@BindsInstance
+		Builder fxApplication(Application application);
+
+		@BindsInstance
+		Builder primaryStage(@PrimaryStage Stage primaryStage);
+
 		FxApplicationComponent build();
 	}

--- a/src/main/java/org/cryptomator/ui/fxapp/FxApplicationModule.java
+++ b/src/main/java/org/cryptomator/ui/fxapp/FxApplicationModule.java
@@ -5,7 +5,6 @@
 *******************************************************************************/
 package org.cryptomator.ui.fxapp;

-import dagger.Binds;
 import dagger.Module;
 import dagger.Provides;
 import org.apache.commons.lang3.SystemUtils;
@@ -15,67 +14,46 @@ import org.cryptomator.ui.lock.LockComponent;
 import org.cryptomator.ui.mainwindow.MainWindowComponent;
 import org.cryptomator.ui.preferences.PreferencesComponent;
 import org.cryptomator.ui.quit.QuitComponent;
+import org.cryptomator.ui.traymenu.TrayMenuComponent;
 import org.cryptomator.ui.unlock.UnlockComponent;

 import javax.inject.Named;
-import javafx.application.Application;
-import javafx.collections.ObservableSet;
 import javafx.scene.image.Image;
-import javafx.stage.Stage;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.UncheckedIOException;
 import java.util.Collections;
 import java.util.List;

-@Module(includes = {UpdateCheckerModule.class}, subcomponents = {MainWindowComponent.class, PreferencesComponent.class, UnlockComponent.class, LockComponent.class, QuitComponent.class, ErrorComponent.class})
+@Module(includes = {UpdateCheckerModule.class}, subcomponents = {TrayMenuComponent.class, MainWindowComponent.class, PreferencesComponent.class, UnlockComponent.class, LockComponent.class, QuitComponent.class, ErrorComponent.class})
 abstract class FxApplicationModule {

-	@Provides
-	@Named("windowIcons")
-	@FxApplicationScoped
-	static List<Image> provideWindowIcons() {
-		if (SystemUtils.IS_OS_MAC) {
-			return Collections.emptyList();
-		}
-		try {
-			return List.of( //
-					createImageFromResource("/img/window_icon_32.png"), //
-					createImageFromResource("/img/window_icon_512.png") //
-			);
-		} catch (IOException e) {
-			throw new UncheckedIOException("Failed to load embedded resource.", e);
-		}
-	}
-
-	@Provides
-	@FxApplicationScoped
-	static StageFactory provideStageFactory(@Named("windowIcons") List<Image> windowIcons) {
-		return new StageFactory(stage -> {
-			stage.getIcons().addAll(windowIcons);
-		});
-	}
-
 	private static Image createImageFromResource(String resourceName) throws IOException {
 		try (InputStream in = FxApplicationModule.class.getResourceAsStream(resourceName)) {
 			return new Image(in);
 		}
 	}

-	@Binds
-	abstract Application bindApplication(FxApplication application);
+	@Provides
+	@FxApplicationScoped
+	static TrayMenuComponent provideTrayMenuComponent(TrayMenuComponent.Builder builder) {
+		return builder.build();
+	}

 	@Provides
+	@FxApplicationScoped
 	static MainWindowComponent provideMainWindowComponent(MainWindowComponent.Builder builder) {
 		return builder.build();
 	}

 	@Provides
+	@FxApplicationScoped
 	static PreferencesComponent providePreferencesComponent(PreferencesComponent.Builder builder) {
 		return builder.build();
 	}

 	@Provides
+	@FxApplicationScoped
 	static QuitComponent provideQuitComponent(QuitComponent.Builder builder) {
 		return builder.build();
 	}
--- a/src/main/java/org/cryptomator/ui/fxapp/FxApplicationStyle.java
+++ b/src/main/java/org/cryptomator/ui/fxapp/FxApplicationStyle.java
@@ -0,0 +1,94 @@
+package org.cryptomator.ui.fxapp;
+
+import org.cryptomator.common.LicenseHolder;
+import org.cryptomator.common.settings.Settings;
+import org.cryptomator.common.settings.UiTheme;
+import org.cryptomator.integrations.uiappearance.Theme;
+import org.cryptomator.integrations.uiappearance.UiAppearanceException;
+import org.cryptomator.integrations.uiappearance.UiAppearanceListener;
+import org.cryptomator.integrations.uiappearance.UiAppearanceProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.inject.Inject;
+import javafx.application.Application;
+import javafx.beans.value.ObservableValue;
+import java.util.Optional;
+
+@FxApplicationScoped
+public class FxApplicationStyle {
+
+	private static final Logger LOG = LoggerFactory.getLogger(FxApplicationStyle.class);
+
+	private final Settings settings;
+	private final Optional<UiAppearanceProvider> appearanceProvider;
+	private final LicenseHolder licenseHolder;
+	private final UiAppearanceListener systemInterfaceThemeListener = this::systemInterfaceThemeChanged;
+
+	@Inject
+	public FxApplicationStyle(Settings settings, Optional<UiAppearanceProvider> appearanceProvider, LicenseHolder licenseHolder){
+		this.settings = settings;
+		this.appearanceProvider = appearanceProvider;
+		this.licenseHolder = licenseHolder;
+	}
+
+	public void initialize() {
+		settings.theme().addListener(this::appThemeChanged);
+		loadSelectedStyleSheet(settings.theme().get());
+	}
+
+	private void appThemeChanged(@SuppressWarnings("unused") ObservableValue<? extends UiTheme> observable, @SuppressWarnings("unused") UiTheme oldValue, UiTheme newValue) {
+		if (appearanceProvider.isPresent() && oldValue == UiTheme.AUTOMATIC && newValue != UiTheme.AUTOMATIC) {
+			try {
+				appearanceProvider.get().removeListener(systemInterfaceThemeListener);
+			} catch (UiAppearanceException e) {
+				LOG.error("Failed to disable automatic theme switching.");
+			}
+		}
+		loadSelectedStyleSheet(newValue);
+	}
+
+	private void loadSelectedStyleSheet(UiTheme desiredTheme) {
+		UiTheme theme = licenseHolder.isValidLicense() ? desiredTheme : UiTheme.LIGHT;
+		switch (theme) {
+			case LIGHT -> applyLightTheme();
+			case DARK -> applyDarkTheme();
+			case AUTOMATIC -> {
+				appearanceProvider.ifPresent(provider -> {
+					try {
+						provider.addListener(systemInterfaceThemeListener);
+					} catch (UiAppearanceException e) {
+						LOG.error("Failed to enable automatic theme switching.");
+					}
+				});
+				applySystemTheme();
+			}
+		}
+	}
+
+	private void systemInterfaceThemeChanged(Theme theme) {
+		switch (theme) {
+			case LIGHT -> applyLightTheme();
+			case DARK -> applyDarkTheme();
+		}
+	}
+
+	private void applySystemTheme() {
+		if (appearanceProvider.isPresent()) {
+			systemInterfaceThemeChanged(appearanceProvider.get().getSystemTheme());
+		} else {
+			LOG.warn("No UiAppearanceProvider present, assuming LIGHT theme...");
+			applyLightTheme();
+		}
+	}
+
+	private void applyLightTheme() {
+		Application.setUserAgentStylesheet(getClass().getResource("/css/light_theme.css").toString());
+		appearanceProvider.ifPresent(provider -> provider.adjustToTheme(Theme.LIGHT));
+	}
+
+	private void applyDarkTheme() {
+		Application.setUserAgentStylesheet(getClass().getResource("/css/dark_theme.css").toString());
+		appearanceProvider.ifPresent(provider -> provider.adjustToTheme(Theme.DARK));
+	}
+}
--- a/src/main/java/org/cryptomator/ui/fxapp/FxApplicationTerminator.java
+++ b/src/main/java/org/cryptomator/ui/fxapp/FxApplicationTerminator.java
@@ -0,0 +1,134 @@
+package org.cryptomator.ui.fxapp;
+
+import com.google.common.base.Preconditions;
+import org.cryptomator.common.ShutdownHook;
+import org.cryptomator.common.vaults.LockNotCompletedException;
+import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.common.vaults.VaultState;
+import org.cryptomator.common.vaults.Volume;
+import org.jetbrains.annotations.Nullable;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.inject.Inject;
+import javafx.beans.Observable;
+import javafx.collections.ObservableList;
+import java.awt.Desktop;
+import java.awt.desktop.QuitResponse;
+import java.awt.desktop.QuitStrategy;
+import java.util.EnumSet;
+import java.util.EventObject;
+import java.util.Set;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+import static org.cryptomator.common.vaults.VaultState.Value.*;
+
+@FxApplicationScoped
+public class FxApplicationTerminator {
+
+	private static final Set<VaultState.Value> STATES_ALLOWING_TERMINATION = EnumSet.of(LOCKED, NEEDS_MIGRATION, MISSING, ERROR);
+	private static final Logger LOG = LoggerFactory.getLogger(FxApplicationTerminator.class);
+
+	private final ObservableList<Vault> vaults;
+	private final ShutdownHook shutdownHook;
+	private final FxApplicationWindows appWindows;
+	private final AtomicBoolean allowQuitWithoutPrompt = new AtomicBoolean();
+
+	@Inject
+	public FxApplicationTerminator(ObservableList<Vault> vaults, ShutdownHook shutdownHook, FxApplicationWindows appWindows) {
+		this.vaults = vaults;
+		this.shutdownHook = shutdownHook;
+		this.appWindows = appWindows;
+	}
+
+	public void initialize() {
+		Preconditions.checkState(Desktop.isDesktopSupported(), "java.awt.Desktop not supported");
+		Desktop desktop = Desktop.getDesktop();
+
+		// register quit handler
+		if (desktop.isSupported(Desktop.Action.APP_QUIT_HANDLER)) {
+			desktop.setQuitHandler(this::handleQuitRequest);
+		}
+
+		// set quit strategy (cmd+q would call `System.exit(0)` otherwise)
+		if (desktop.isSupported(Desktop.Action.APP_QUIT_STRATEGY)) {
+			desktop.setQuitStrategy(QuitStrategy.CLOSE_ALL_WINDOWS);
+		}
+
+		// allow sudden termination?
+		vaultListChanged(vaults);
+		vaults.addListener(this::vaultListChanged);
+
+		shutdownHook.runOnShutdown(this::forceUnmountRemainingVaults);
+	}
+
+	/**
+	 * Gracefully terminates the application.
+	 */
+	public void terminate() {
+		handleQuitRequest(null, new NoopQuitResponse());
+	}
+
+	private void vaultListChanged(@SuppressWarnings("unused") Observable observable) {
+		boolean allowSuddenTermination = vaults.stream().map(Vault::getState).allMatch(STATES_ALLOWING_TERMINATION::contains);
+		boolean stateChanged = allowQuitWithoutPrompt.compareAndSet(!allowSuddenTermination, allowSuddenTermination);
+		Desktop desktop = Desktop.getDesktop();
+		if (stateChanged && desktop.isSupported(Desktop.Action.APP_SUDDEN_TERMINATION)) {
+			if (allowSuddenTermination) {
+				LOG.debug("Enabling sudden termination");
+				desktop.enableSuddenTermination();
+			} else {
+				LOG.debug("Disabling sudden termination");
+				desktop.disableSuddenTermination();
+			}
+		}
+	}
+
+	/**
+	 * Asks the app to quit. If confirmed, the JavaFX application will exit before giving a {@code response}.
+	 *
+	 * @param e ignored
+	 * @param response a quit response that will be {@link ExitingQuitResponse decorated in order to exit the JavaFX application}.
+	 */
+	private void handleQuitRequest(@SuppressWarnings("unused") @Nullable EventObject e, QuitResponse response) {
+		var exitingResponse = new ExitingQuitResponse(response);
+		if (allowQuitWithoutPrompt.get()) {
+			exitingResponse.performQuit();
+		} else {
+			appWindows.showQuitWindow(exitingResponse);
+		}
+	}
+
+	private void forceUnmountRemainingVaults() {
+		for (Vault vault : vaults) {
+			if (vault.isUnlocked()) {
+				try {
+					vault.lock(true);
+				} catch (Volume.VolumeException e) {
+					LOG.error("Failed to unmount vault " + vault.getPath(), e);
+				} catch (LockNotCompletedException e) {
+					LOG.error("Failed to lock vault " + vault.getPath(), e);
+				}
+			}
+		}
+	}
+
+	/**
+	 * A dummy QuitResponse that ignores the response.
+	 *
+	 * To be used with {@link #handleQuitRequest(EventObject, QuitResponse)} if the invoking method is not interested in the response.
+	 */
+	private static class NoopQuitResponse implements QuitResponse {
+
+		@Override
+		public void performQuit() {
+			// no-op
+		}
+
+		@Override
+		public void cancelQuit() {
+			// no-op
+		}
+	}
+
+}
--- a/src/main/java/org/cryptomator/ui/fxapp/FxApplicationWindows.java
+++ b/src/main/java/org/cryptomator/ui/fxapp/FxApplicationWindows.java
@@ -0,0 +1,155 @@
+package org.cryptomator.ui.fxapp;
+
+import com.google.common.base.Preconditions;
+import dagger.Lazy;
+import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.common.vaults.VaultState;
+import org.cryptomator.integrations.tray.TrayIntegrationProvider;
+import org.cryptomator.ui.common.ErrorComponent;
+import org.cryptomator.ui.lock.LockComponent;
+import org.cryptomator.ui.mainwindow.MainWindowComponent;
+import org.cryptomator.ui.preferences.PreferencesComponent;
+import org.cryptomator.ui.preferences.SelectedPreferencesTab;
+import org.cryptomator.ui.quit.QuitComponent;
+import org.cryptomator.ui.unlock.UnlockComponent;
+import org.jetbrains.annotations.Nullable;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.inject.Inject;
+import javafx.application.Platform;
+import javafx.collections.ListChangeListener;
+import javafx.collections.transformation.FilteredList;
+import javafx.scene.Scene;
+import javafx.stage.Stage;
+import javafx.stage.Window;
+import java.awt.Desktop;
+import java.awt.desktop.AppReopenedListener;
+import java.awt.desktop.QuitResponse;
+import java.util.Optional;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CompletionStage;
+import java.util.concurrent.ExecutorService;
+
+@FxApplicationScoped
+public class FxApplicationWindows {
+
+	private static final Logger LOG = LoggerFactory.getLogger(FxApplicationWindows.class);
+
+	private final Stage primaryStage;
+	private final Optional<TrayIntegrationProvider> trayIntegration;
+	private final Lazy<MainWindowComponent> mainWindow;
+	private final Lazy<PreferencesComponent> preferencesWindow;
+	private final Lazy<QuitComponent> quitWindow;
+	private final UnlockComponent.Factory unlockWorkflowFactory;
+	private final LockComponent.Factory lockWorkflowFactory;
+	private final ErrorComponent.Factory errorWindowFactory;
+	private final ExecutorService executor;
+	private final FilteredList<Window> visibleWindows;
+
+	@Inject
+	public FxApplicationWindows(@PrimaryStage Stage primaryStage, Optional<TrayIntegrationProvider> trayIntegration, Lazy<MainWindowComponent> mainWindow, Lazy<PreferencesComponent> preferencesWindow, Lazy<QuitComponent> quitWindow, UnlockComponent.Factory unlockWorkflowFactory, LockComponent.Factory lockWorkflowFactory, ErrorComponent.Factory errorWindowFactory, ExecutorService executor) {
+		this.primaryStage = primaryStage;
+		this.trayIntegration = trayIntegration;
+		this.mainWindow = mainWindow;
+		this.preferencesWindow = preferencesWindow;
+		this.quitWindow = quitWindow;
+		this.unlockWorkflowFactory = unlockWorkflowFactory;
+		this.lockWorkflowFactory = lockWorkflowFactory;
+		this.errorWindowFactory = errorWindowFactory;
+		this.executor = executor;
+		this.visibleWindows = Window.getWindows().filtered(Window::isShowing);
+	}
+
+	public void initialize() {
+		Preconditions.checkState(Desktop.isDesktopSupported(), "java.awt.Desktop not supported");
+		Desktop desktop = Desktop.getDesktop();
+
+		// register preferences shortcut
+		if (desktop.isSupported(Desktop.Action.APP_PREFERENCES)) {
+			desktop.setPreferencesHandler(evt -> showPreferencesWindow(SelectedPreferencesTab.ANY));
+		}
+
+		// register preferences shortcut
+		if (desktop.isSupported(Desktop.Action.APP_ABOUT)) {
+			desktop.setAboutHandler(evt -> showPreferencesWindow(SelectedPreferencesTab.ABOUT));
+		}
+
+		// register app reopen listener
+		if (desktop.isSupported(Desktop.Action.APP_EVENT_REOPENED)) {
+			desktop.addAppEventListener((AppReopenedListener) e -> showMainWindow());
+		}
+
+		// observe visible windows
+		if (trayIntegration.isPresent()) {
+			visibleWindows.addListener(this::visibleWindowsChanged);
+		}
+	}
+
+	private void visibleWindowsChanged(ListChangeListener.Change<? extends Window> change) {
+		int visibleWindows = change.getList().size();
+		LOG.debug("visible windows: {}", visibleWindows);
+		if (visibleWindows > 0) {
+			trayIntegration.ifPresent(TrayIntegrationProvider::restoredFromTray);
+		} else {
+			trayIntegration.ifPresent(TrayIntegrationProvider::minimizedToTray);
+		}
+	}
+
+	public CompletionStage<Stage> showMainWindow() {
+		return CompletableFuture.supplyAsync(mainWindow.get()::showMainWindow, Platform::runLater).whenComplete(this::reportErrors);
+	}
+
+	public CompletionStage<Stage> showPreferencesWindow(SelectedPreferencesTab selectedTab) {
+		return CompletableFuture.supplyAsync(() -> preferencesWindow.get().showPreferencesWindow(selectedTab), Platform::runLater).whenComplete(this::reportErrors);
+	}
+
+	public CompletionStage<Stage> showQuitWindow(QuitResponse response) {
+		return CompletableFuture.supplyAsync(() -> quitWindow.get().showQuitWindow(response), Platform::runLater).whenComplete(this::reportErrors);
+	}
+
+	public CompletionStage<Void> startUnlockWorkflow(Vault vault, @Nullable Stage owner) {
+		return CompletableFuture.supplyAsync(() -> {
+					Preconditions.checkState(vault.stateProperty().transition(VaultState.Value.LOCKED, VaultState.Value.PROCESSING), "Vault not locked.");
+					LOG.debug("Start unlock workflow for {}", vault.getDisplayName());
+					return unlockWorkflowFactory.create(vault, owner).unlockWorkflow();
+				}, Platform::runLater) //
+				.thenCompose(unlockWorkflow -> CompletableFuture.runAsync(unlockWorkflow, executor)) //
+				.exceptionally(e -> {
+					showErrorWindow(e, owner == null ? primaryStage : owner, null);
+					return null;
+				});
+	}
+
+	public CompletionStage<Void> startLockWorkflow(Vault vault, @Nullable Stage owner) {
+		return CompletableFuture.supplyAsync(() -> {
+					Preconditions.checkState(vault.stateProperty().transition(VaultState.Value.UNLOCKED, VaultState.Value.PROCESSING), "Vault not unlocked.");
+					LOG.debug("Start lock workflow for {}", vault.getDisplayName());
+					return lockWorkflowFactory.create(vault, owner).lockWorkflow();
+				}, Platform::runLater) //
+				.thenCompose(lockWorkflow -> CompletableFuture.runAsync(lockWorkflow, executor)) //
+				.exceptionally(e -> {
+					showErrorWindow(e, owner == null ? primaryStage : owner, null);
+					return null;
+				});
+	}
+
+	/**
+	 * Displays the generic error scene in the given window.
+	 *
+	 * @param cause The exception to show
+	 * @param window What window to display the scene in
+	 * @param previousScene To what scene to return to when pressing "back". Back button will be hidden, if <code>null</code>
+	 * @return A
+	 */
+	public CompletionStage<Stage> showErrorWindow(Throwable cause, Stage window, @Nullable Scene previousScene) {
+		return CompletableFuture.supplyAsync(() -> errorWindowFactory.create(cause, window, previousScene).show(), Platform::runLater).whenComplete(this::reportErrors);
+	}
+
+	private void reportErrors(@Nullable Stage stage, @Nullable Throwable error) {
+		if (error != null) {
+			LOG.error("Failed to display stage", error);
+		}
+	}
+
+}
--- a/src/main/java/org/cryptomator/ui/fxapp/PrimaryStage.java
+++ b/src/main/java/org/cryptomator/ui/fxapp/PrimaryStage.java
@@ -0,0 +1,14 @@
+package org.cryptomator.ui.fxapp;
+
+import javax.inject.Qualifier;
+import java.lang.annotation.Documented;
+import java.lang.annotation.Retention;
+
+import static java.lang.annotation.RetentionPolicy.RUNTIME;
+
+@Qualifier
+@Documented
+@Retention(RUNTIME)
+public @interface PrimaryStage {
+
+}
--- a/src/main/java/org/cryptomator/ui/health/CheckListController.java
+++ b/src/main/java/org/cryptomator/ui/health/CheckListController.java
@@ -1,9 +1,8 @@
 package org.cryptomator.ui.health;

 import com.google.common.base.Preconditions;
-import dagger.Lazy;
-import org.cryptomator.ui.common.ErrorComponent;
 import org.cryptomator.ui.common.FxController;
+import org.cryptomator.ui.fxapp.FxApplicationWindows;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -15,9 +14,7 @@ import javafx.beans.property.ObjectProperty;
 import javafx.collections.FXCollections;
 import javafx.collections.ObservableList;
 import javafx.collections.transformation.FilteredList;
-import javafx.event.ActionEvent;
 import javafx.fxml.FXML;
-import javafx.scene.control.CheckBox;
 import javafx.scene.control.ListView;
 import javafx.scene.control.SelectionMode;
 import javafx.stage.Stage;
@@ -37,7 +34,7 @@ public class CheckListController implements FxController {
 	private final ObjectProperty<Check> selectedCheck;
 	private final BooleanBinding mainRunStarted; //TODO: rerunning not considered for now
 	private final BooleanBinding somethingsRunning;
-	private final Lazy<ErrorComponent.Builder> errorComponentBuilder;
+	private final FxApplicationWindows appWindows;
 	private final IntegerBinding chosenTaskCount;
 	private final BooleanBinding anyCheckSelected;
 	private final CheckListCellFactory listCellFactory;
@@ -46,7 +43,7 @@ public class CheckListController implements FxController {
 	public ListView<Check> checksListView;

 	@Inject
-	public CheckListController(@HealthCheckWindow Stage window, List<Check> checks, CheckExecutor checkExecutor, ReportWriter reportWriteTask, ObjectProperty<Check> selectedCheck, Lazy<ErrorComponent.Builder> errorComponentBuilder, CheckListCellFactory listCellFactory) {
+	public CheckListController(@HealthCheckWindow Stage window, List<Check> checks, CheckExecutor checkExecutor, ReportWriter reportWriteTask, ObjectProperty<Check> selectedCheck, FxApplicationWindows appWindows, CheckListCellFactory listCellFactory) {
 		this.window = window;
 		this.checks = FXCollections.observableList(checks, Check::observables);
 		this.checkExecutor = checkExecutor;
@@ -54,7 +51,7 @@ public class CheckListController implements FxController {
 		this.chosenChecks = this.checks.filtered(Check::isChosenForExecution);
 		this.reportWriter = reportWriteTask;
 		this.selectedCheck = selectedCheck;
-		this.errorComponentBuilder = errorComponentBuilder;
+		this.appWindows = appWindows;
 		this.chosenTaskCount = Bindings.size(this.chosenChecks);
 		this.mainRunStarted = Bindings.isEmpty(this.checks.filtered(c -> c.getState() == Check.CheckState.RUNNABLE));
 		this.somethingsRunning = Bindings.isNotEmpty(this.checks.filtered(c -> c.getState() == Check.CheckState.SCHEDULED || c.getState() == Check.CheckState.RUNNING));
@@ -104,7 +101,7 @@ public class CheckListController implements FxController {
 			reportWriter.writeReport(chosenChecks);
 		} catch (IOException e) {
 			LOG.error("Failed to write health check report.", e);
-			errorComponentBuilder.get().cause(e).window(window).returnToScene(window.getScene()).build().showErrorScene();
+			appWindows.showErrorWindow(e, window, window.getScene());
 		}
 	}

--- a/src/main/java/org/cryptomator/ui/health/StartController.java
+++ b/src/main/java/org/cryptomator/ui/health/StartController.java
@@ -7,10 +7,10 @@ import org.cryptomator.cryptofs.VaultConfig;
 import org.cryptomator.cryptofs.VaultConfigLoadException;
 import org.cryptomator.cryptofs.VaultKeyInvalidException;
 import org.cryptomator.cryptolib.api.Masterkey;
-import org.cryptomator.ui.common.ErrorComponent;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxmlFile;
 import org.cryptomator.ui.common.FxmlScene;
+import org.cryptomator.ui.fxapp.FxApplicationWindows;
 import org.cryptomator.ui.keyloading.KeyLoadingStrategy;
 import org.cryptomator.ui.unlock.UnlockCancelledException;
 import org.slf4j.Logger;
@@ -40,10 +40,10 @@ public class StartController implements FxController {
 	private final AtomicReference<Masterkey> masterkeyRef;
 	private final AtomicReference<VaultConfig> vaultConfigRef;
 	private final Lazy<Scene> checkScene;
-	private final Lazy<ErrorComponent.Builder> errorComponent;
+	private final FxApplicationWindows appWindows;

 	@Inject
-	public StartController(@HealthCheckWindow Stage window, @HealthCheckWindow Vault vault, @HealthCheckWindow KeyLoadingStrategy keyLoadingStrategy, ExecutorService executor, AtomicReference<Masterkey> masterkeyRef, AtomicReference<VaultConfig> vaultConfigRef, @FxmlScene(FxmlFile.HEALTH_CHECK_LIST) Lazy<Scene> checkScene, Lazy<ErrorComponent.Builder> errorComponent, @Named("unlockWindow") Stage unlockWindow) {
+	public StartController(@HealthCheckWindow Stage window, @HealthCheckWindow Vault vault, @HealthCheckWindow KeyLoadingStrategy keyLoadingStrategy, ExecutorService executor, AtomicReference<Masterkey> masterkeyRef, AtomicReference<VaultConfig> vaultConfigRef, @FxmlScene(FxmlFile.HEALTH_CHECK_LIST) Lazy<Scene> checkScene, FxApplicationWindows appWindows, @Named("unlockWindow") Stage unlockWindow) {
 		this.window = window;
 		this.unlockWindow = unlockWindow;
 		this.vaultConfig = vault.getVaultConfigCache();
@@ -52,7 +52,7 @@ public class StartController implements FxController {
 		this.masterkeyRef = masterkeyRef;
 		this.vaultConfigRef = vaultConfigRef;
 		this.checkScene = checkScene;
-		this.errorComponent = errorComponent;
+		this.appWindows = appWindows;
 	}

 	@FXML
@@ -106,10 +106,10 @@ public class StartController implements FxController {
 			// ok
 		} else if (e instanceof VaultKeyInvalidException) {
 			LOG.error("Invalid key"); //TODO: specific error screen
-			errorComponent.get().window(window).cause(e).build().showErrorScene();
+			appWindows.showErrorWindow(e, window, null);
 		} else {
 			LOG.error("Failed to load key.", e);
-			errorComponent.get().window(window).cause(e).build().showErrorScene();
+			appWindows.showErrorWindow(e, window, null);
 		}
 	}

--- a/src/main/java/org/cryptomator/ui/keyloading/KeyLoadingModule.java
+++ b/src/main/java/org/cryptomator/ui/keyloading/KeyLoadingModule.java
@@ -27,7 +27,7 @@ abstract class KeyLoadingModule {
 	@Provides
 	@KeyLoading
 	@KeyLoadingScoped
-	static KeyLoadingStrategy provideKeyLoaderProvider(@KeyLoading Vault vault, Map<String, Provider<KeyLoadingStrategy>> strategies) {
+	static KeyLoadingStrategy provideKeyLoadingStrategy(@KeyLoading Vault vault, Map<String, Provider<KeyLoadingStrategy>> strategies) {
 		try {
 			String scheme = vault.getVaultConfigCache().get().getKeyId().getScheme();
 			var fallback = KeyLoadingStrategy.failed(new IllegalArgumentException("Unsupported key id " + scheme));
--- a/src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/ChooseMasterkeyFileComponent.java
+++ b/src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/ChooseMasterkeyFileComponent.java
@@ -0,0 +1,25 @@
+package org.cryptomator.ui.keyloading.masterkeyfile;
+
+import dagger.Subcomponent;
+
+import javafx.scene.Scene;
+import java.nio.file.Path;
+import java.util.concurrent.CompletableFuture;
+
+@ChooseMasterkeyFileScoped
+@Subcomponent(modules = {ChooseMasterkeyFileModule.class})
+public interface ChooseMasterkeyFileComponent {
+
+	@ChooseMasterkeyFileScoped
+	Scene chooseMasterkeyScene();
+
+	@ChooseMasterkeyFileScoped
+	CompletableFuture<Path> result();
+
+	@Subcomponent.Builder
+	interface Builder {
+
+		ChooseMasterkeyFileComponent build();
+	}
+
+}
--- a/src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/ChooseMasterkeyFileController.java
+++ b/src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/ChooseMasterkeyFileController.java
@@ -0,0 +1,57 @@
+package org.cryptomator.ui.keyloading.masterkeyfile;
+
+import org.cryptomator.ui.common.FxController;
+import org.cryptomator.ui.keyloading.KeyLoading;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.inject.Inject;
+import javafx.fxml.FXML;
+import javafx.stage.FileChooser;
+import javafx.stage.Stage;
+import javafx.stage.WindowEvent;
+import java.io.File;
+import java.nio.file.Path;
+import java.util.ResourceBundle;
+import java.util.concurrent.CompletableFuture;
+
+@ChooseMasterkeyFileScoped
+public class ChooseMasterkeyFileController implements FxController {
+
+	private static final Logger LOG = LoggerFactory.getLogger(ChooseMasterkeyFileController.class);
+
+	private final Stage window;
+	private final CompletableFuture<Path> result;
+	private final ResourceBundle resourceBundle;
+
+	@Inject
+	public ChooseMasterkeyFileController(@KeyLoading Stage window, CompletableFuture<Path> result, ResourceBundle resourceBundle) {
+		this.window = window;
+		this.result = result;
+		this.resourceBundle = resourceBundle;
+		this.window.setOnHiding(this::windowClosed);
+	}
+
+	@FXML
+	public void cancel() {
+		window.close();
+	}
+
+	private void windowClosed(WindowEvent windowEvent) {
+		result.cancel(true);
+	}
+
+	@FXML
+	public void proceed() {
+		LOG.trace("proceed()");
+		FileChooser fileChooser = new FileChooser();
+		fileChooser.setTitle(resourceBundle.getString("unlock.chooseMasterkey.filePickerTitle"));
+		fileChooser.getExtensionFilters().add(new FileChooser.ExtensionFilter("Cryptomator Masterkey", "*.cryptomator"));
+		File masterkeyFile = fileChooser.showOpenDialog(window);
+		if (masterkeyFile != null) {
+			LOG.debug("Chose masterkey file: {}", masterkeyFile);
+			result.complete(masterkeyFile.toPath());
+		}
+	}
+
+}
--- a/src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/ChooseMasterkeyFileModule.java
+++ b/src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/ChooseMasterkeyFileModule.java
@@ -0,0 +1,29 @@
+package org.cryptomator.ui.keyloading.masterkeyfile;
+
+import dagger.Module;
+import dagger.Provides;
+import org.cryptomator.ui.common.DefaultSceneFactory;
+import org.cryptomator.ui.common.FxmlFile;
+import org.cryptomator.ui.common.FxmlLoaderFactory;
+
+import javafx.scene.Scene;
+import java.nio.file.Path;
+import java.util.ResourceBundle;
+import java.util.concurrent.CompletableFuture;
+
+@Module
+interface ChooseMasterkeyFileModule {
+
+	@Provides
+	@ChooseMasterkeyFileScoped
+	static CompletableFuture<Path> provideResult() {
+		return new CompletableFuture<>();
+	}
+
+	@Provides
+	@ChooseMasterkeyFileScoped
+	static Scene provideChooseMasterkeyScene(ChooseMasterkeyFileController controller, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
+		return FxmlLoaderFactory.forController(controller, sceneFactory, resourceBundle).createScene(FxmlFile.UNLOCK_SELECT_MASTERKEYFILE);
+	}
+
+}
--- a/src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/ChooseMasterkeyFileScoped.java
+++ b/src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/ChooseMasterkeyFileScoped.java
@@ -0,0 +1,13 @@
+package org.cryptomator.ui.keyloading.masterkeyfile;
+
+import javax.inject.Scope;
+import java.lang.annotation.Documented;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+
+@Scope
+@Documented
+@Retention(RetentionPolicy.RUNTIME)
+@interface ChooseMasterkeyFileScoped {
+
+}
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				<svg width="512" height="512" viewBox="0 0 512 512" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg"><path d="m255.4 42.2c-76.9 0-119.4 65.3-119.4 129h238.7c.1-63.8-47.9-129-119.3-129z" fill="#cfcfcf"/><path d="m255.4 66.4c-62.5 0-97 53-97 104.8l97 11 97-11c0-51.8-39-104.8-97-104.8z" fill="#585e62"/><path d="m44.8 378.5c-5 0-9.1-4.1-9.1-9.1 0-4.6 3.5-8.6 8.1-9.1 10.7-1.2 18.4-10.8 17.2-21.5s-10.8-18.4-21.5-17.2-18.4 10.8-17.2 21.5c.3 2.5 1.1 5 2.3 7.3 2.3 4.5.5 10-4 12.2-4.3 2.1-9.4.6-11.9-3.4-10.1-18.2-3.4-41.1 14.8-51.2s41.1-3.4 51.2 14.8 3.4 41.2-14.8 51.2c-4.3 2.4-9.1 3.9-14 4.5-.4 0-.7 0-1.1 0z" fill="#585e62"/><path d="m82.6 258 2.4 1.2c11.1 5.7 15.4 19.2 9.8 30.2l-9.4 18.4c-5.7 11.1-19.2 15.4-30.2 9.8l-2.4-1.2c-11.1-5.7-15.4-19.2-9.8-30.2l9.4-18.4c5.6-11 19.2-15.4 30.2-9.8z" fill="#cfcfcf"/><path d="m86.6 221.3 25.4 13-19.6 38.3c-3.6 7-12.2 9.8-19.2 6.2-7-3.6-9.8-12.2-6.2-19.2z" fill="#585e62"/><circle cx="105.2" cy="218.4" fill="#cfcfcf" r="34.1"/><path d="m121.4 188.5c-13.7-7.6-30.8-4.8-41.5 6.7 18.8.9 33.4 16.8 32.5 35.7-.4 8.1-3.6 15.8-9.1 21.7 18.8.8 34.8-13.7 35.6-32.6.7-13-6.1-25.2-17.5-31.5z" fill="#b1b1b1"/><path d="m467.2 378.5c-.3 0-.7 0-1-.1-20.7-2.3-35.5-21-33.2-41.6 2.3-20.7 21-35.5 41.6-33.2 20.7 2.3 35.5 21 33.2 41.6-.6 4.9-2.1 9.7-4.5 14-2.3 4.5-7.7 6.3-12.2 4s-6.3-7.7-4-12.2c.1-.2.2-.4.3-.6 5.2-9.4 1.8-21.3-7.6-26.5s-21.3-1.8-26.5 7.6-1.8 21.3 7.6 26.5c2.2 1.2 4.7 2 7.2 2.3 5 .5 8.6 5 8 10-.4 4.8-4.3 8.3-8.9 8.2z" fill="#585e62"/><path d="m459.3 316.4-2.4 1.2c-11.1 5.7-24.6 1.3-30.2-9.8l-9.4-18.4c-5.7-11.1-1.3-24.6 9.8-30.2l2.4-1.2c11.1-5.7 24.6-1.3 30.2 9.8l9.4 18.4c5.6 11 1.2 24.6-9.8 30.2z" fill="#cfcfcf"/><path d="m438.8 278.9c-7 3.6-15.6.8-19.2-6.2l-19.6-38.3 25.4-13 19.6 38.3c3.6 7 .8 15.6-6.2 19.2z" fill="#585e62"/><circle cx="406.8" cy="218.4" fill="#cfcfcf" r="34.1"/><path d="m390.6 188.5c13.7-7.6 30.8-4.8 41.5 6.7-18.8.9-33.4 16.8-32.5 35.7.4 8.1 3.6 15.7 9.1 21.7-18.8.9-34.8-13.7-35.7-32.5-.6-13.1 6.2-25.3 17.6-31.6z" fill="#b1b1b1"/><path d="m117.2 469.8c-16.7 0-30.5-18.1-34.3-45.1-2.1-14.5-1-29.7 2.9-42.8 4.3-14.1 11.6-24.4 20.6-29 3.3-1.7 7-2.6 10.8-2.7h47.1v119.5z" fill="#585e62"/><path d="m163.8 469.8c-9.7 0-17.7-18.1-19.9-45.1-1.2-14.5-.6-29.7 1.7-42.8 2.5-14.1 6.7-24.4 11.9-29 2-1.8 4.1-2.7 6.2-2.7 2.2 0 4.2.9 6.3 2.6l22.6 19.9c7.9 7 10.6 29.1 9.2 46.4-1.1 13.3-4.5 23.7-9.2 27.9l-22.6 19.9c-1.9 2-4 2.9-6.2 2.9z" fill="#585e62"/><path d="m168 360.1 22.6 19.9c5.1 4.5 8.1 21.6 6.7 38.2-.9 11-3.6 19.1-6.7 21.9l-22.6 19.9c-8.5 7.5-17.2-8.8-19.5-36.4s2.7-56 11.2-63.5c2.8-2.4 5.7-2.3 8.3 0z" fill="#35393b"/><path d="m390.9 469.8c16.7 0 30.5-18.1 34.3-45.1 2.1-14.5 1-29.7-2.9-42.8-4.3-14.1-11.6-24.4-20.6-29-3.3-1.7-7-2.6-10.8-2.7h-47.1v119.5z" fill="#585e62"/><path d="m344.3 469.8c9.7 0 17.7-18.1 19.9-45.1 1.2-14.5.6-29.7-1.7-42.8-2.5-14.1-6.7-24.4-11.9-29-2-1.8-4.1-2.7-6.2-2.7s-4.2.9-6.3 2.6l-22.6 19.9c-7.9 7-10.6 29.1-9.2 46.4 1.1 13.3 4.5 23.7 9.2 27.9l22.6 19.9c1.9 2 4 2.9 6.2 2.9z" fill="#585e62"/><path d="m340.1 360.1-22.6 19.9c-5.1 4.5-8.1 21.6-6.7 38.1.9 11 3.6 19.1 6.7 21.9l22.6 19.9c8.5 7.5 17.2-8.8 19.5-36.4s-2.7-56-11.2-63.5c-2.8-2.3-5.7-2.2-8.3.1z" fill="#35393b"/><path d="m390 247.5c-2-6.8-2.1-13.9-.3-20.7 6.7-24.2 2.3-50.8 2.3-50.8-84.2-26.3-136.5-.2-136.5-.2s-52.2-26.2-136.5-.2c0 0-4.5 26.7 2.1 50.9 1.8 6.8 1.7 14-.3 20.7-2.3 8-4.9 20.2-4.9 35.8-.2 113.3 139.2 148.3 139.2 148.3s139.4-34.6 139.6-147.9c.1-15.7-2.4-27.9-4.7-35.9z" fill="#cfcfcf"/><path d="m255.2 410.1c-23.1-7.2-119-42.4-118.9-127.1 0-13.5 2.2-23.8 4.1-30.2 3.1-10.4 3.2-21.4.4-31.8-2.8-10.3-3.1-21.4-2.8-29.7 18.4-4.7 36.5-7 53.9-7 34.4.1 54.5 9.6 54.7 9.6l9.3 4.7 8.8-4.7c.1 0 20.2-9.4 54.6-9.4 17.4 0 35.4 2.4 53.8 7.1.3 8.3 0 19.4-2.9 29.7-2.8 10.4-2.7 21.5.3 31.8 1.8 6.3 4 16.7 4 30.2-.2 85.1-96.1 119.7-119.3 126.8z" fill="#49b04a"/><path d="m281.5 259.9c0-14.4-11.6-26.2-26.1-26.2s-26.2 11.6-26.2 26.1c0 12.2 8.4 22.8 20.4 25.5l-14.7 61.7 20.3 5.8 20.3-5.8-14.5-61.7c12-2.6 20.5-13.1 20.5-25.4z" fill="#35393b"/><g fill="#49b04a"><path d="m210.9 101.8c-15.2 0-27.6 12.3-27.6 27.6h55.2c0-15.2-12.3-27.6-27.6-27.6z"/><path d="m296.2 101.8c-15.2 0-27.6 12.3-27.6 27.6h55.2c0-15.2-12.4-27.6-27.6-27.6z"/><circle cx="223.8" cy="146.5" r="5.2"/><circle cx="244.4" cy="146.5" r="5.2"/><circle cx="265" cy="146.5" r="5.2"/><circle cx="285.6" cy="146.5" r="5.2"/></g></svg>