Merge branch 'release/1.7.3'

New translations strings.properties

Belarusian; Catalan; Chinese Simplified; Chinese Traditional; Chinese Traditional, Hong Kong; French; German; Hebrew; Norwegian Bokmal; Russian; Swahili, Tanzania; Turkish; 

[ci skip]

.github/ISSUE_TEMPLATE/bug.yml

@@ -37,12 +37,17 @@ body:
     id: volume-type
     attributes:
       label: Volume Type
-      description: What is selected under Settings → Virtual Drive?
-      multiple: true
+      description: What volume type is selected under Settings → Virtual Drive?
       options:
-        - FUSE
-        - Dokany
-        - WebDAV
+        - WinFsp
+        - WinFsp (Local Drive)
+        - FUSE-T
+        - macFUSE
+        - WebDAV (Windows Explorer)
+        - WebDAV (AppleScript)
+        - WebDAV (gio)
+        - WebDAV (HTTP Address)
+        - Dokany (1.5)
     validations:
       required: false
   - type: textarea

.github/workflows/appimage.yml

@@ -13,46 +13,40 @@ env:
   JAVA_VERSION: 19
 
 jobs:
+  get-version:
+    uses: ./.github/workflows/get-version.yml
+    with:
+      version: ${{ inputs.version }}
+
   build:
     name: Build AppImage
     runs-on: ubuntu-latest
+    needs: [get-version]
     steps:
       - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
       - name: Setup Java
         uses: actions/setup-java@v3
         with:
           distribution: 'zulu'
           java-version: ${{ env.JAVA_VERSION }}
+          java-package: 'jdk+fx'
           cache: 'maven'
-      - id: versions 
-        name: Apply version information
+      - name: Ensure major jfx version in pom equals in jdk
+        shell: pwsh
         run: |
-          if [[ $GITHUB_REF =~ refs/tags/[0-9]+\.[0-9]+\.[0-9]+.* ]]; then
-            SEM_VER_STR=${GITHUB_REF##*/}
-            mvn versions:set -DnewVersion=${SEM_VER_STR}
-          elif [[ "${{ github.event.inputs.version }}" =~ [0-9]+\.[0-9]+\.[0-9]+.* ]]; then
-            SEM_VER_STR="${{ github.event.inputs.version }}"
-            mvn versions:set -DnewVersion=${SEM_VER_STR}
-          else
-            SEM_VER_STR=`mvn help:evaluate -Dexpression=project.version -q -DforceStdout`
-          fi
-          SEM_VER_NUM=`echo ${SEM_VER_STR} | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/'`
-          REVCOUNT=`git rev-list --count HEAD`
-          echo "::set-output name=semVerStr::${SEM_VER_STR}"
-          echo "::set-output name=semVerNum::${SEM_VER_NUM}"
-          echo "::set-output name=revNum::${REVCOUNT}"
-      - name: Validate Version
-        uses: skymatic/semver-validation-action@v1
-        with:
-          version: ${{ steps.versions.outputs.semVerStr }}
+          $jfxPomVersion = (&mvn help:evaluate "-Dexpression=javafx.version" -q -DforceStdout) -split "\."
+          $jfxJdkVersion = ((Get-Content -path "${env:JAVA_HOME}/lib/javafx.properties" | Where-Object {$_ -like 'javafx.version=*' }) -replace '.*=','') -split "\."
+          if ($jfxPomVersion[0] -ne $jfxJdkVersion[0]) {
+            Write-Error "Major part of JavaFX version in pom($($jfxPomVersion[0])) does not match the version in JDK($($jfxJdkVersion[0])) "
+            exit 1
+          }
+      - name: Set version
+        run : mvn versions:set -DnewVersion=${{ needs.get-version.outputs.semVerStr }}
       - name: Run maven
         run: mvn -B clean package -Pdependency-check,linux -DskipTests
       - name: Patch target dir
         run: |
           cp LICENSE.txt target
-          cp dist/linux/launcher.sh target
           cp target/cryptomator-*.jar target/mods
       - name: Run jlink
         run: >
@@ -60,7 +54,7 @@ jobs:
           --verbose
           --output runtime
           --module-path "${JAVA_HOME}/jmods"
-          --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,jdk.unsupported,jdk.crypto.ec,jdk.accessibility,jdk.management.jfr
+          --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.unsupported,jdk.crypto.ec,jdk.security.auth,jdk.accessibility,jdk.management.jfr
           --strip-native-commands
           --no-header-files
           --no-man-pages
@@ -69,8 +63,8 @@ jobs:
       - name: Prepare additional launcher
         run: envsubst '${SEMVER_STR} ${REVISION_NUM}' < dist/linux/launcher-gtk2.properties > launcher-gtk2.properties
         env:
-          SEMVER_STR: ${{  steps.versions.outputs.semVerStr }}
-          REVISION_NUM: ${{  steps.versions.outputs.revNum }}
+          SEMVER_STR: ${{  needs.get-version.outputs.semVerStr }}
+          REVISION_NUM: ${{  needs.get-version.outputs.revNum }}
       - name: Run jpackage
         run: >
           ${JAVA_HOME}/bin/jpackage
@@ -83,11 +77,13 @@ jobs:
           --dest appdir
           --name Cryptomator
           --vendor "Skymatic GmbH"
-          --copyright "(C) 2016 - 2022 Skymatic GmbH"
-          --app-version "${{  steps.versions.outputs.semVerNum }}.${{  steps.versions.outputs.revNum }}"
+          --copyright "(C) 2016 - 2023 Skymatic GmbH"
+          --app-version "${{  needs.get-version.outputs.semVerNum }}.${{  needs.get-version.outputs.revNum }}"
+          --java-options "--enable-preview"
+          --java-options "--enable-native-access=org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64"
           --java-options "-Xss5m"
           --java-options "-Xmx256m"
-          --java-options "-Dcryptomator.appVersion=\"${{  steps.versions.outputs.semVerStr }}\""
+          --java-options "-Dcryptomator.appVersion=\"${{  needs.get-version.outputs.semVerStr }}\""
           --java-options "-Dfile.encoding=\"utf-8\""
           --java-options "-Dcryptomator.logDir=\"~/.local/share/Cryptomator/logs\""
           --java-options "-Dcryptomator.pluginDir=\"~/.local/share/Cryptomator/plugins\""
@@ -96,7 +92,7 @@ jobs:
           --java-options "-Dcryptomator.ipcSocketPath=\"~/.config/Cryptomator/ipc.socket\""
           --java-options "-Dcryptomator.mountPointsDir=\"~/.local/share/Cryptomator/mnt\""
           --java-options "-Dcryptomator.showTrayIcon=false"
-          --java-options "-Dcryptomator.buildNumber=\"appimage-${{  steps.versions.outputs.revNum }}\""
+          --java-options "-Dcryptomator.buildNumber=\"appimage-${{  needs.get-version.outputs.revNum }}\""
           --add-launcher Cryptomator-gtk2=launcher-gtk2.properties
           --resource-dir dist/linux/resources
       - name: Patch Cryptomator.AppDir
@@ -114,12 +110,6 @@ jobs:
           ln -s usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg Cryptomator.AppDir/.DirIcon
           ln -s usr/share/applications/org.cryptomator.Cryptomator.desktop Cryptomator.AppDir/Cryptomator.desktop
           ln -s bin/cryptomator.sh Cryptomator.AppDir/AppRun
-      - name: Extract libjffi.so # workaround for https://github.com/cryptomator/cryptomator-linux/issues/27
-        run: |
-          JFFI_NATIVE_JAR=`ls lib/app/ | grep -e 'jffi-[1-9]\.[0-9]\{1,2\}.[0-9]\{1,2\}-native.jar'`
-          ${JAVA_HOME}/bin/jar -xf lib/app/${JFFI_NATIVE_JAR} /jni/x86_64-Linux/
-          mv jni/x86_64-Linux/* lib/app/libjffi.so
-        working-directory: Cryptomator.AppDir
       - name: Download AppImageKit
         run: |
           curl -L https://github.com/AppImage/AppImageKit/releases/download/13/appimagetool-x86_64.AppImage -o appimagetool.AppImage
@@ -134,7 +124,7 @@ jobs:
           GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
       - name: Build AppImage
         run: >
-          ./squashfs-root/AppRun Cryptomator.AppDir cryptomator-${{  steps.versions.outputs.semVerStr }}-x86_64.AppImage
+          ./squashfs-root/AppRun Cryptomator.AppDir cryptomator-${{  needs.get-version.outputs.semVerStr }}-x86_64.AppImage
           -u 'gh-releases-zsync|cryptomator|cryptomator|latest|cryptomator-*-x86_64.AppImage.zsync'
           --sign --sign-key=615D449FE6E6A235 --sign-args="--batch --pinentry-mode loopback"
       - name: Create detached GPG signatures

.github/workflows/build.yml

@@ -42,15 +42,6 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-      - name: Sign source tarball with key 615D449FE6E6A235
-        if: startsWith(github.ref, 'refs/tags/')
-        run: |
-          git archive --prefix="cryptomator-${{ github.ref_name }}/" -o "cryptomator-${{ github.ref_name }}.tar.gz" ${{ github.ref }}
-          echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
-          echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator-*.tar.gz
-        env:
-          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
-          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
       - name: Draft a release
         if: startsWith(github.ref, 'refs/tags/')
         uses: softprops/action-gh-release@v1
@@ -59,9 +50,6 @@ jobs:
           discussion_category_name: releases
           token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
           generate_release_notes: true
-          files: |
-            cryptomator-*.tar.gz.asc
-          fail_on_unmatched_files: true
           body: |-
             :construction: Work in Progress
             

.github/workflows/debian.yml

@@ -1,21 +1,27 @@
 name: Build Debian Package
 
 on:
-  release:
-    types: [published]
   workflow_dispatch:
     inputs:
+      ref:
+        description: 'GitHub Ref (e.g. refs/tags/1.6.16)'
+        required: true
+      semver:
+        description: 'SemVer String (e.g. 1.7.0-beta1)'
+        required: true
+      ppaver:
+        description: 'Base PPA Version String (e.g. 1.6.16+1.7.0~beta1) without -0ppa1'
+        required: true
       dput:
         description: 'Upload to PPA'
         required: true
         default: false
         type: boolean
-      version:
-        description: 'Version'
-        required: false
 
 env:
   JAVA_VERSION: 19
+  OPENJFX_JMODS_AMD64: 'https://download2.gluonhq.com/openjfx/19.0.2.1/openjfx-19.0.2.1_linux-x64_bin-jmods.zip'
+  OPENJFX_JMODS_AARCH64: 'https://download2.gluonhq.com/openjfx/19.0.2.1/openjfx-19.0.2.1_linux-aarch64_bin-jmods.zip'
 
 jobs:
   build:
@@ -24,50 +30,69 @@ jobs:
     steps:
       - uses: actions/checkout@v3
         with:
+          ref: ${{ inputs.ref }}
           fetch-depth: 0
+      - id: versions
+        name: Get version information
+        run: |
+          SEM_VER_STR="${{ inputs.semver }}"
+          SEM_VER_NUM=`echo ${SEM_VER_STR} | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/'`
+          REVCOUNT=`git rev-list --count HEAD`
+          echo "semVerStr=${SEM_VER_STR}" >> $GITHUB_OUTPUT
+          echo "semVerNum=${SEM_VER_NUM}" >> $GITHUB_OUTPUT
+          echo "revNum=${REVCOUNT}" >> $GITHUB_OUTPUT
       - name: Install build tools
         run: |
           sudo add-apt-repository ppa:coffeelibs/openjdk
           sudo apt-get update
-          sudo apt-get install debhelper devscripts dput coffeelibs-jdk-19
+          sudo apt-get install debhelper devscripts dput coffeelibs-jdk-19 libgtk2.0-0
       - name: Setup Java
         uses: actions/setup-java@v3
         with:
           distribution: 'zulu'
           java-version: ${{ env.JAVA_VERSION }}
           cache: 'maven'
-      - id: versions 
-        name: Apply version information
-        run: |
-          if [[ $GITHUB_REF =~ refs/tags/[0-9]+\.[0-9]+\.[0-9]+.* ]]; then
-            SEM_VER_STR=${GITHUB_REF##*/}
-            mvn versions:set -DnewVersion=${SEM_VER_STR}
-          elif [[ "${{ github.event.inputs.version }}" =~ [0-9]+\.[0-9]+\.[0-9]+.* ]]; then
-            SEM_VER_STR="${{ github.event.inputs.version }}"
-            mvn versions:set -DnewVersion=${SEM_VER_STR}
-          else
-            SEM_VER_STR=`mvn help:evaluate -Dexpression=project.version -q -DforceStdout`
-          fi
-          SEM_VER_NUM=`echo ${SEM_VER_STR} | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/'`
-          REVCOUNT=`git rev-list --count HEAD`
-          echo "::set-output name=semVerStr::${SEM_VER_STR}"
-          echo "::set-output name=semVerNum::${SEM_VER_NUM}"
-          echo "::set-output name=revNum::${REVCOUNT}"
-          echo "::set-output name=ppaVerStr::${SEM_VER_STR/-/\~}-${REVCOUNT}"
-      - name: Validate Version
-        uses: skymatic/semver-validation-action@v1
-        with:
-          version: ${{ steps.versions.outputs.semVerStr }}
       - name: Run maven
         run: mvn -B clean package -Pdependency-check,linux -DskipTests
-      - name: Create orig.tar.gz with common/ libs/ mods/
+      - name: Download OpenJFX jmods
+        id: download-jmods
+        run: |
+          curl -L ${{ env.OPENJFX_JMODS_AMD64 }} -o openjfx-amd64.zip
+          mkdir -p jmods/amd64
+          unzip -j openjfx-amd64.zip \*/javafx.base.jmod \*/javafx.controls.jmod \*/javafx.fxml.jmod \*/javafx.graphics.jmod -d jmods/amd64
+          curl -L ${{ env.OPENJFX_JMODS_AARCH64 }} -o openjfx-aarch64.zip
+          mkdir -p jmods/aarch64
+          unzip -j openjfx-aarch64.zip \*/javafx.base.jmod \*/javafx.controls.jmod \*/javafx.fxml.jmod \*/javafx.graphics.jmod -d jmods/aarch64
+      - name: Ensure major jfx version in pom and in jmods is the same
+        run: |
+          JMOD_VERSION_AMD64=$(jmod describe jmods/amd64/javafx.base.jmod | head -1)
+          JMOD_VERSION_AMD64=${JMOD_VERSION_AMD64#*@}
+          JMOD_VERSION_AMD64=${JMOD_VERSION_AMD64%%.*}
+          JMOD_VERSION_AARCH64=$(jmod describe jmods/aarch64/javafx.base.jmod | head -1)
+          JMOD_VERSION_AARCH64=${JMOD_VERSION_AARCH64#*@}
+          JMOD_VERSION_AARCH64=${JMOD_VERSION_AARCH64%%.*}
+          POM_JFX_VERSION=$(mvn help:evaluate "-Dexpression=javafx.version" -q -DforceStdout)
+          POM_JFX_VERSION=${POM_JFX_VERSION#*@}
+          POM_JFX_VERSION=${POM_JFX_VERSION%%.*}
+
+          if [ $POM_JFX_VERSION -ne $JMOD_VERSION_AMD64 ]; then
+            >&2 echo "Major JavaFX version in pom.xml (${POM_JFX_VERSION}) != amd64 jmod version (${JMOD_VERSION_AMD64})"
+            exit 1
+          fi
+
+          if [ $POM_JFX_VERSION -ne $JMOD_VERSION_AARCH64 ]; then
+            >&2 echo "Major JavaFX version in pom.xml (${POM_JFX_VERSION}) != aarch64 jmod version (${JMOD_VERSION_AARCH64})"
+            exit 1
+          fi
+      - name: Create orig.tar.gz with common/ libs/ mods/ jmods/
         run: |
           mkdir pkgdir
           cp -r target/libs pkgdir
           cp -r target/mods pkgdir
+          cp -r jmods pkgdir
           cp -r dist/linux/common/ pkgdir
           cp target/cryptomator-*.jar pkgdir/mods
-          tar -cJf cryptomator_${{ steps.versions.outputs.ppaVerStr }}.orig.tar.xz -C pkgdir .
+          tar -cJf cryptomator_${{ inputs.ppaver }}.orig.tar.xz -C pkgdir .
       - name: Patch and rename pkgdir
         run: |
           cp -r dist/linux/debian/ pkgdir
@@ -75,12 +100,12 @@ jobs:
           envsubst '${SEMVER_STR} ${VERSION_NUM} ${REVISION_NUM}' < dist/linux/debian/rules > pkgdir/debian/rules
           envsubst '${PPA_VERSION} ${RFC2822_TIMESTAMP}' < dist/linux/debian/changelog > pkgdir/debian/changelog
           find . -name "*.jar" >> pkgdir/debian/source/include-binaries
-          mv pkgdir cryptomator_${{ steps.versions.outputs.ppaVerStr }}
+          mv pkgdir cryptomator_${{ inputs.ppaver }}
         env:
           SEMVER_STR: ${{ steps.versions.outputs.semVerStr }}
           VERSION_NUM: ${{ steps.versions.outputs.semVerNum }}
           REVISION_NUM: ${{ steps.versions.outputs.revNum }}
-          PPA_VERSION: ${{ steps.versions.outputs.ppaVerStr }}-0ppa1
+          PPA_VERSION: ${{ inputs.ppaver }}-0ppa1
       - name: Prepare GPG-Agent for signing with key 615D449FE6E6A235
         run: |
           echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
@@ -95,7 +120,7 @@ jobs:
         env:
           DEBSIGN_PROGRAM: gpg --batch --pinentry-mode loopback
           DEBSIGN_KEYID: 615D449FE6E6A235
-        working-directory: cryptomator_${{ steps.versions.outputs.ppaVerStr }}
+        working-directory: cryptomator_${{ inputs.ppaver }}
       - name: Create detached GPG signatures
         run: |
           gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator_*_amd64.deb
@@ -112,14 +137,19 @@ jobs:
             cryptomator_*_amd64.deb
             cryptomator_*.asc
       - name: Publish on PPA
-        if: startsWith(github.ref, 'refs/tags/') || inputs.dput
+        if: inputs.dput
         run: dput ppa:sebastian-stenzel/cryptomator-beta cryptomator_*_source.changes
+      
+      # If ref is a tag, also upload to GitHub Releases:
+      - name: Determine tag name
+        if: startsWith(inputs.ref, 'refs/tags/')
+        run: |
+          REF=${{ inputs.ref }}
+          echo "TAG_NAME=${REF##*/}" >> $GITHUB_ENV
       - name: Publish Debian package on GitHub Releases
-        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v1
-        with:
-          fail_on_unmatched_files: true
-          token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
-          files: |
-            cryptomator_*_amd64.deb
-            cryptomator_*.asc
+        if: startsWith(inputs.ref, 'refs/tags/')
+        env:
+          GITHUB_TOKEN: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
+        run: |
+          artifacts=$(ls | grep cryptomator*.deb)
+          gh release upload ${{ env.TAG_NAME }} $artifacts

.github/workflows/dl-stats.yml

@@ -48,7 +48,7 @@ jobs:
           jq -c 'select(.filename|endswith(".dmg")) | select(.filename|endswith("-arm64.dmg")|not) | {name: "github.releases.downloads", tags: ["file=dmg", "version=\(.release)", "arch=amd64"], value: .downloads, interval: .interval, time: .time}' input.json >> output.json
 
           RESULT=$(jq -s -c "." output.json)
-          echo "::set-output name=result::${RESULT}"
+          echo "result=${RESULT}" >> $GITHUB_OUTPUT
         env:
           INTERVAL: 900
           JSON_DATA: ${{ steps.get-stats.outputs.result }}

.github/workflows/get-version.yml

@@ -0,0 +1,77 @@
+name: Parse and Validate a version string or tag
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: "A specific version to use"
+        required: false
+        type: string
+    outputs:
+      semVerStr:
+        description: "The full version string."
+        value: ${{ jobs.determine-version.outputs.semVerStr}}
+      semVerNum:
+        description: "The numerical part of the version string"
+        value: ${{ jobs.determine-version.outputs.semVerNum}}
+      revNum:
+        description: "The revision number"
+        value: ${{ jobs.determine-version.outputs.revNum}}
+      versionType:
+        description: "Type of the version. Values are [stable, alpha, beta, rc, unknown]"
+        value: ${{ jobs.determine-version.outputs.type }}
+
+env:
+  JAVA_VERSION: 19
+  JAVA_DIST: 'temurin'
+  JAVA_CACHE: 'maven'
+
+jobs:
+  determine-version:
+    name: 'Determines the version following semver'
+    runs-on: ubuntu-latest
+    outputs:
+      semVerNum: ${{ steps.versions.outputs.semVerNum }}
+      semVerStr: ${{ steps.versions.outputs.semVerStr }}
+      revNum: ${{ steps.versions.outputs.revNum }}
+      type: ${{ steps.versions.outputs.type}}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Setup Java
+        uses: actions/setup-java@v3
+        with:
+          distribution: ${{ env.JAVA_DIST }}
+          java-version: ${{ env.JAVA_VERSION }}
+          cache: ${{ env.JAVA_CACHE }}
+      - id: versions
+        name: Get version information
+        run: |
+          if [[ $GITHUB_REF =~ refs/tags/[0-9]+\.[0-9]+\.[0-9]+.* ]]; then
+            SEM_VER_STR=${GITHUB_REF##*/}
+          elif [[ "${{ inputs.version }}" =~ [0-9]+\.[0-9]+\.[0-9]+.* ]]; then
+            SEM_VER_STR="${{ github.event.inputs.version }}"
+          else
+            SEM_VER_STR=`mvn help:evaluate -Dexpression=project.version -q -DforceStdout`
+          fi
+          SEM_VER_NUM=`echo ${SEM_VER_STR} | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/'`
+          REVCOUNT=`git rev-list --count HEAD`
+          TYPE="unknown"
+          if [[ $SEM_VER_STR =~ [0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            TYPE="stable"
+          elif [[ $SEM_VER_STR =~ [0-9]+\.[0-9]+\.[0-9]+-alpha[1-9]+$ ]]; then
+            TYPE="alpha"
+          elif [[ $SEM_VER_STR =~ [0-9]+\.[0-9]+\.[0-9]+-beta[1-9]+$ ]]; then
+            TYPE="beta"
+          elif [[ $SEM_VER_STR =~ [0-9]+\.[0-9]+\.[0-9]+-rc[1-9]$ ]]; then
+            TYPE="rc"
+          fi
+          echo "semVerStr=${SEM_VER_STR}" >> $GITHUB_OUTPUT
+          echo "semVerNum=${SEM_VER_NUM}" >> $GITHUB_OUTPUT
+          echo "revNum=${REVCOUNT}" >> $GITHUB_OUTPUT
+          echo "type=${TYPE}" >> $GITHUB_OUTPUT
+      - name: Validate Version
+        uses: skymatic/semver-validation-action@v2
+        with:
+          version: ${{ steps.versions.outputs.semVerStr }} 

.github/workflows/mac-dmg.yml

@@ -13,9 +13,15 @@ env:
   JAVA_VERSION: 19
 
 jobs:
+  get-version:
+    uses: ./.github/workflows/get-version.yml
+    with:
+      version: ${{ inputs.version }}
+
   build:
     name: Build Cryptomator.app for ${{ matrix.output-suffix }}
     runs-on: ${{ matrix.os }}
+    needs: [get-version]
     strategy:
       fail-fast: false
       matrix:
@@ -24,48 +30,39 @@ jobs:
           architecture: x64
           output-suffix: x64
           xcode-path: '/Applications/Xcode_13.2.1.app'
+          fuse-lib: macFUSE
         - os: [self-hosted, macOS, ARM64]
           architecture: aarch64
           output-suffix: arm64
           xcode-path: '/Applications/Xcode_13.2.1.app'
+          fuse-lib: FUSE-T
     steps:
       - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
       - name: Setup Java
         uses: actions/setup-java@v3
         with:
           distribution: 'zulu'
           java-version: ${{ env.JAVA_VERSION }}
+          java-package: 'jdk+fx'
           architecture: ${{ matrix.architecture }}
           cache: 'maven'
-      - id: versions
-        name: Apply version information
+      - name: Ensure major jfx version in pom equals in jdk
+        if: ${{ !contains(matrix.os, 'self-hosted') }}
+        shell: pwsh
         run: |
-          if [[ $GITHUB_REF =~ refs/tags/[0-9]+\.[0-9]+\.[0-9]+.* ]]; then
-            SEM_VER_STR=${GITHUB_REF##*/}
-            mvn versions:set -DnewVersion=${SEM_VER_STR}
-          elif [[ "${{ github.event.inputs.version }}" =~ [0-9]+\.[0-9]+\.[0-9]+.* ]]; then
-            SEM_VER_STR="${{ github.event.inputs.version }}"
-            mvn versions:set -DnewVersion=${SEM_VER_STR}
-          else
-            SEM_VER_STR=`mvn help:evaluate -Dexpression=project.version -q -DforceStdout`
-          fi
-          SEM_VER_NUM=`echo ${SEM_VER_STR} | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/'`
-          REVCOUNT=`git rev-list --count HEAD`
-          echo "::set-output name=semVerStr::${SEM_VER_STR}"
-          echo "::set-output name=semVerNum::${SEM_VER_NUM}"
-          echo "::set-output name=revNum::${REVCOUNT}"
-      - name: Validate Version
-        uses: skymatic/semver-validation-action@v1
-        with:
-          version: ${{ steps.versions.outputs.semVerStr }}
+          $jfxPomVersion = (&mvn help:evaluate "-Dexpression=javafx.version" -q -DforceStdout) -split "\."
+          $jfxJdkVersion = ((Get-Content -path "${env:JAVA_HOME}/lib/javafx.properties" | Where-Object {$_ -like 'javafx.version=*' }) -replace '.*=','') -split "\."
+          if ($jfxPomVersion[0] -ne $jfxJdkVersion[0]) {
+            Write-Error "Major part of JavaFX version in pom($($jfxPomVersion[0])) does not match the version in JDK($($jfxJdkVersion[0])) "
+            exit 1
+          }
+      - name: Set version
+        run : mvn versions:set -DnewVersion=${{ needs.get-version.outputs.semVerStr }}
       - name: Run maven
         run: mvn -B clean package -Pdependency-check,mac -DskipTests
       - name: Patch target dir
         run: |
           cp LICENSE.txt target
-          cp dist/mac/launcher.sh target
           cp target/cryptomator-*.jar target/mods
       - name: Run jlink
         run: >
@@ -73,7 +70,7 @@ jobs:
           --verbose
           --output runtime
           --module-path "${JAVA_HOME}/jmods"
-          --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,jdk.unsupported,jdk.crypto.ec,jdk.accessibility,jdk.management.jfr
+          --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.unsupported,jdk.crypto.ec,jdk.accessibility,jdk.management.jfr
           --strip-native-commands
           --no-header-files
           --no-man-pages
@@ -91,22 +88,25 @@ jobs:
           --dest appdir
           --name Cryptomator
           --vendor "Skymatic GmbH"
-          --copyright "(C) 2016 - 2022 Skymatic GmbH"
-          --app-version "${{ steps.versions.outputs.semVerNum }}"
+          --copyright "(C) 2016 - 2023 Skymatic GmbH"
+          --app-version "${{ needs.get-version.outputs.semVerNum }}"
+          --java-options "--enable-preview"
+          --java-options "--enable-native-access=org.cryptomator.jfuse.mac"
           --java-options "-Xss5m"
           --java-options "-Xmx256m"
           --java-options "-Dfile.encoding=\"utf-8\""
           --java-options "-Dapple.awt.enableTemplateImages=true"
           --java-options "-Dsun.java2d.metal=true"
-          --java-options "-Dcryptomator.appVersion=\"${{ steps.versions.outputs.semVerStr }}\""
+          --java-options "-Dcryptomator.appVersion=\"${{ needs.get-version.outputs.semVerStr }}\""
           --java-options "-Dcryptomator.logDir=\"~/Library/Logs/Cryptomator\""
           --java-options "-Dcryptomator.pluginDir=\"~/Library/Application Support/Cryptomator/Plugins\""
           --java-options "-Dcryptomator.settingsPath=\"~/Library/Application Support/Cryptomator/settings.json\""
           --java-options "-Dcryptomator.p12Path=\"~/Library/Application Support/Cryptomator/key.p12\""
           --java-options "-Dcryptomator.ipcSocketPath=\"~/Library/Application Support/Cryptomator/ipc.socket\""
           --java-options "-Dcryptomator.integrationsMac.keychainServiceName=\"Cryptomator\""
+          --java-options "-Dcryptomator.mountPointsDir=\"~/Cryptomator\""
           --java-options "-Dcryptomator.showTrayIcon=true"
-          --java-options "-Dcryptomator.buildNumber=\"dmg-${{ steps.versions.outputs.revNum }}\""
+          --java-options "-Dcryptomator.buildNumber=\"dmg-${{ needs.get-version.outputs.revNum }}\""
           --mac-package-identifier org.cryptomator
           --resource-dir dist/mac/resources
       - name: Patch Cryptomator.app
@@ -116,8 +116,8 @@ jobs:
           sed -i '' "s|###BUNDLE_SHORT_VERSION_STRING###|${VERSION_NO}|g" Cryptomator.app/Contents/Info.plist
           sed -i '' "s|###BUNDLE_VERSION###|${REVISION_NO}|g" Cryptomator.app/Contents/Info.plist
         env:
-          VERSION_NO: ${{ steps.versions.outputs.semVerNum }}
-          REVISION_NO: ${{ steps.versions.outputs.revNum }}
+          VERSION_NO: ${{ needs.get-version.outputs.semVerNum }}
+          REVISION_NO: ${{ needs.get-version.outputs.revNum }}
       - name: Generate license for dmg
         run: >
           mvn -B license:add-third-party
@@ -151,6 +151,10 @@ jobs:
           CODESIGN_TMP_KEYCHAIN_PW: ${{ secrets.MACOS_CODESIGN_TMP_KEYCHAIN_PW }}
       - name: Codesign
         run: |
+          echo "Codesigning jdk files..."
+          find Cryptomator.app/Contents/runtime/Contents/Home/lib/ -name '*.dylib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
+          find Cryptomator.app/Contents/runtime/Contents/Home/lib/ -name 'jspawnhelper' -exec codesign --force -o runtime -s ${CODESIGN_IDENTITY} {} \;
+          echo "Codesigning jar contents..."
           find Cryptomator.app/Contents/runtime/Contents/MacOS -name '*.dylib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
           for JAR_PATH in `find Cryptomator.app -name "*.jar"`; do
             if [[ `unzip -l ${JAR_PATH} | grep '.dylib\|.jnilib'` ]]; then
@@ -175,7 +179,7 @@ jobs:
         run: |
           mkdir dmg
           mv Cryptomator.app dmg
-          cp dist/mac/dmg/resources/macFUSE.webloc dmg
+          cp dist/mac/dmg/resources/${{ matrix.fuse-lib }}.webloc dmg
           ls -l dmg
       - name: Install create-dmg
         run: |
@@ -186,14 +190,14 @@ jobs:
           create-dmg
           --volname Cryptomator
           --volicon "dist/mac/dmg/resources/Cryptomator-Volume.icns"
-          --background "dist/mac/dmg/resources/Cryptomator-background.tiff"
+          --background "dist/mac/dmg/resources/Cryptomator-${{ matrix.fuse-lib }}-background.tiff"
           --window-pos 400 100
           --window-size 640 694
           --icon-size 128
           --icon "Cryptomator.app" 128 245
           --hide-extension "Cryptomator.app"
-          --icon "macFUSE.webloc" 320 501
-          --hide-extension "macFUSE.webloc"
+          --icon "${{ matrix.fuse-lib }}.webloc" 320 501
+          --hide-extension "${{ matrix.fuse-lib }}.webloc"
           --app-drop-link 512 245
           --eula "dist/mac/dmg/resources/license.rtf"
           --icon ".background" 128 758
@@ -201,7 +205,7 @@ jobs:
           --icon ".VolumeIcon.icns" 512 758
           Cryptomator-${VERSION_NO}-${{ matrix.output-suffix }}.dmg dmg
         env:
-          VERSION_NO: ${{ steps.versions.outputs.semVerNum }}
+          VERSION_NO: ${{ needs.get-version.outputs.semVerNum }}
       - name: Notarize .dmg
         if: startsWith(github.ref, 'refs/tags/')
         uses: cocoalibs/xcode-notarization-action@v1
@@ -212,7 +216,7 @@ jobs:
           team-id: ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }}
           xcode-path: ${{ matrix.xcode-path }}
       - name: Add possible alpha/beta tags to installer name
-        run: mv Cryptomator-*.dmg Cryptomator-${{ steps.versions.outputs.semVerStr }}-${{ matrix.output-suffix }}.dmg
+        run: mv Cryptomator-*.dmg Cryptomator-${{ needs.get-version.outputs.semVerStr }}-${{ matrix.output-suffix }}.dmg
       - name: Create detached GPG signature with key 615D449FE6E6A235
         run: |
           echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import

.github/workflows/post-publish.yml

@@ -0,0 +1,39 @@
+name: Post Release Publish Tasks
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  get-version:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download source tarball
+        run: |
+          curl -L -H "Accept: application/vnd.github+json" https://github.com/cryptomator/cryptomator/archive/refs/tags/${{ github.event.release.tag_name }}.tar.gz --output cryptomator-${{ github.event.release.tag_name }}.tar.gz
+      - name: Sign source tarball with key 615D449FE6E6A235
+        run: |
+          echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
+          echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator-*.tar.gz
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
+          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
+      - name: Publish asc on GitHub Releases
+        uses: softprops/action-gh-release@v1
+        with:
+          fail_on_unmatched_files: true
+          token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
+          files: |
+            cryptomator-*.tar.gz.asc
+      - name: Slack Notification
+        uses: rtCamp/action-slack-notify@v2
+        env:
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
+          SLACK_USERNAME: 'Cryptobot'
+          SLACK_ICON: false
+          SLACK_ICON_EMOJI: ':bot:'
+          SLACK_CHANNEL: 'cryptomator-desktop'
+          SLACK_TITLE: "Release ${{ github.event.repository.name }} ${{ github.event.release.tag_name }} published."
+          SLACK_MESSAGE: "Ready to <https://github.com/${{ github.repository }}/actions/workflows/debian.yml|build deb Package>."
+          SLACK_FOOTER: false
+          MSG_MINIMAL: true

.github/workflows/release-check.yml

@@ -30,7 +30,7 @@ jobs:
           fi
 
           if [[ ${SEM_VER_STR} == `mvn help:evaluate -Dexpression=project.version -q -DforceStdout` ]]; then
-            echo "::set-output name=semVerStr::${SEM_VER_STR}"
+            echo "semVerStr=${SEM_VER_STR}" >> $GITHUB_OUTPUT
           else
             echo "Version not set in POM"
             exit 1

.github/workflows/win-exe.yml

@@ -19,46 +19,42 @@ defaults:
     shell: bash
 
 jobs:
+  get-version:
+    uses: ./.github/workflows/get-version.yml
+    with:
+      version: ${{ inputs.version }}
+
   build-msi:
     name: Build .msi Installer
     runs-on: windows-latest
+    needs: [get-version]
+    env:
+      LOOPBACK_ALIAS: 'cryptomator-vault'
     steps:
       - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
       - name: Setup Java
         uses: actions/setup-java@v3
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}
+          java-package: 'jdk+fx'
           cache: ${{ env.JAVA_CACHE }}
-      - id: versions 
-        name: Apply version information
+      - name: Ensure major jfx version in pom equals in jdk
+        shell: pwsh
         run: |
-          if [[ $GITHUB_REF =~ refs/tags/[0-9]+\.[0-9]+\.[0-9]+.* ]]; then
-            SEM_VER_STR=${GITHUB_REF##*/}
-            mvn versions:set -DnewVersion=${SEM_VER_STR}
-          elif [[ "${{ github.event.inputs.version }}" =~ [0-9]+\.[0-9]+\.[0-9]+.* ]]; then
-            SEM_VER_STR="${{ github.event.inputs.version }}"
-            mvn versions:set -DnewVersion=${SEM_VER_STR}
-          else
-            SEM_VER_STR=`mvn help:evaluate -Dexpression=project.version -q -DforceStdout`
-          fi
-          SEM_VER_NUM=`echo ${SEM_VER_STR} | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/'`
-          REVCOUNT=`git rev-list --count HEAD`
-          echo "::set-output name=semVerStr::${SEM_VER_STR}"
-          echo "::set-output name=semVerNum::${SEM_VER_NUM}"
-          echo "::set-output name=revNum::${REVCOUNT}"
-      - name: Validate Version
-        uses: skymatic/semver-validation-action@v1
-        with:
-          version: ${{ steps.versions.outputs.semVerStr }}
+          $jfxPomVersion = (&mvn help:evaluate "-Dexpression=javafx.version" -q -DforceStdout) -split "\."
+          $jfxJdkVersion = ((Get-Content -path "${env:JAVA_HOME}/lib/javafx.properties" | Where-Object {$_ -like 'javafx.version=*' }) -replace '.*=','') -split "\."
+          if ($jfxPomVersion[0] -ne $jfxJdkVersion[0]) {
+            Write-Error "Major part of JavaFX version in pom($($jfxPomVersion[0])) does not match the version in JDK($($jfxJdkVersion[0])) "
+            exit 1
+          }
+      - name: Set version
+        run : mvn versions:set -DnewVersion=${{ needs.get-version.outputs.semVerStr }}
       - name: Run maven
         run: mvn -B clean package -Pdependency-check,win -DskipTests
       - name: Patch target dir
         run: |
           cp LICENSE.txt target
-          cp dist/linux/launcher.sh target
           cp target/cryptomator-*.jar target/mods
       - name: Run jlink
         run: >
@@ -66,7 +62,7 @@ jobs:
           --verbose
           --output runtime
           --module-path "${JAVA_HOME}/jmods"
-          --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,jdk.unsupported,jdk.crypto.ec,jdk.accessibility,jdk.management.jfr
+          --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.unsupported,jdk.crypto.ec,jdk.accessibility,jdk.management.jfr
           --strip-native-commands
           --no-header-files
           --no-man-pages
@@ -84,11 +80,13 @@ jobs:
           --dest appdir
           --name Cryptomator
           --vendor "Skymatic GmbH"
-          --copyright "(C) 2016 - 2022 Skymatic GmbH"
-          --app-version "${{ steps.versions.outputs.semVerNum }}.${{ steps.versions.outputs.revNum }}"
+          --copyright "(C) 2016 - 2023 Skymatic GmbH"
+          --app-version "${{ needs.get-version.outputs.semVerNum }}.${{ needs.get-version.outputs.revNum }}"
+          --java-options "--enable-preview"
+          --java-options "--enable-native-access=org.cryptomator.jfuse.win"
           --java-options "-Xss5m"
           --java-options "-Xmx256m"
-          --java-options "-Dcryptomator.appVersion=\"${{ steps.versions.outputs.semVerStr }}\""
+          --java-options "-Dcryptomator.appVersion=\"${{ needs.get-version.outputs.semVerStr }}\""
           --java-options "-Dfile.encoding=\"utf-8\""
           --java-options "-Dcryptomator.logDir=\"~/AppData/Roaming/Cryptomator\""
           --java-options "-Dcryptomator.pluginDir=\"~/AppData/Roaming/Cryptomator/Plugins\""
@@ -96,8 +94,9 @@ jobs:
           --java-options "-Dcryptomator.p12Path=\"~/AppData/Roaming/Cryptomator/key.p12\""
           --java-options "-Dcryptomator.ipcSocketPath=\"~/AppData/Roaming/Cryptomator/ipc.socket\""
           --java-options "-Dcryptomator.mountPointsDir=\"~/Cryptomator\""
+          --java-options "-Dcryptomator.loopbackAlias=\"${{ env.LOOPBACK_ALIAS }}\""
           --java-options "-Dcryptomator.showTrayIcon=true"
-          --java-options "-Dcryptomator.buildNumber=\"msi-${{ steps.versions.outputs.revNum }}\""
+          --java-options "-Dcryptomator.buildNumber=\"msi-${{ needs.get-version.outputs.revNum }}\""
           --java-options "-Dcryptomator.integrationsWin.autoStartShellLinkName=\"Cryptomator\""
           --java-options "-Dcryptomator.integrationsWin.keychainPaths=\"~/AppData/Roaming/Cryptomator/keychain.json\""
           --resource-dir dist/win/resources
@@ -105,11 +104,24 @@ jobs:
       - name: Patch Application Directory
         run: |
           cp dist/win/contrib/* appdir/Cryptomator
+      - name: Set LOOPBACK_ALIAS in patchWebDAV.bat
+        shell: pwsh
+        run: |
+          $patchScript = "appdir\Cryptomator\patchWebDAV.bat"
+          try {
+            (Get-Content $patchScript ) -replace '::REPLACE ME', "SET LOOPBACK_ALIAS=`"${{ env.LOOPBACK_ALIAS}}`"" | Set-Content $patchScript
+          } catch {
+            Write-Host "Failed to set LOOPBACK_ALIAS for patchWebDAV.bat"
+            exit 1
+          }
       - name: Fix permissions
         run: attrib -r appdir/Cryptomator/Cryptomator.exe
         shell: pwsh
+      - name: Extract integrations DLL for code signing
+        shell: pwsh
+        run: gci ./appdir/Cryptomator/app/mods/ -File integrations-win-*.jar | ForEach-Object {Set-Location -Path $_.Directory; jar --file=$($_.FullName) --extract integrations.dll }
       - name: Codesign
-        uses: skymatic/code-sign-action@v1
+        uses: skymatic/code-sign-action@v2
         with:
           certificate: ${{ secrets.WIN_CODESIGN_P12_BASE64 }}
           password: ${{ secrets.WIN_CODESIGN_P12_PW }}
@@ -118,6 +130,10 @@ jobs:
           timestampUrl: 'http://timestamp.digicert.com'
           folder: appdir/Cryptomator
           recursive: true
+      - name: Repack signed DLL into jar
+        shell: pwsh
+        run: |
+          gci ./appdir/Cryptomator/app/mods/ -File integrations-win-*.jar | ForEach-Object {Set-Location -Path $_.Directory; jar --file=$($_.FullName) --update integrations.dll; Remove-Item integrations.dll}
       - name: Generate license for MSI
         run: >
           mvn -B license:add-third-party
@@ -139,8 +155,8 @@ jobs:
           --dest installer
           --name Cryptomator
           --vendor "Skymatic GmbH"
-          --copyright "(C) 2016 - 2022 Skymatic GmbH"
-          --app-version "${{ steps.versions.outputs.semVerNum }}"
+          --copyright "(C) 2016 - 2023 Skymatic GmbH"
+          --app-version "${{ needs.get-version.outputs.semVerNum }}.${{ needs.get-version.outputs.revNum}}"
           --win-menu
           --win-dir-chooser
           --win-shortcut-prompt
@@ -152,7 +168,7 @@ jobs:
         env:
           JP_WIXWIZARD_RESOURCES: ${{ github.workspace }}/dist/win/resources # requires abs path, used in resources/main.wxs
       - name: Codesign MSI
-        uses: skymatic/code-sign-action@v1
+        uses: skymatic/code-sign-action@v2
         with:
           certificate: ${{ secrets.WIN_CODESIGN_P12_BASE64 }}
           password: ${{ secrets.WIN_CODESIGN_P12_PW }}
@@ -161,7 +177,7 @@ jobs:
           timestampUrl: 'http://timestamp.digicert.com'
           folder: installer
       - name: Add possible alpha/beta tags to installer name
-        run: mv installer/Cryptomator-*.msi Cryptomator-${{ steps.versions.outputs.semVerStr }}-x64.msi
+        run: mv installer/Cryptomator-*.msi Cryptomator-${{ needs.get-version.outputs.semVerStr }}-x64.msi
       - name: Create detached GPG signature with key 615D449FE6E6A235
         run: |
           echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
@@ -186,23 +202,11 @@ jobs:
           files: |
             *.msi
             *.asc
-    outputs:
-      semVerNum: ${{ steps.versions.outputs.semVerNum }}
-      semVerStr: ${{ steps.versions.outputs.semVerStr }}
-      revNum: ${{ steps.versions.outputs.revNum }}
-
-  call-winget-flow:
-    needs: [build-msi]
-    if: github.event.action == 'published'
-    uses: ./.github/workflows/winget.yml
-    with:
-      releaseTag: ${{ github.event.release.tag_name }}
-
 
   build-exe:
     name: Build .exe installer
     runs-on: windows-latest
-    needs: [build-msi]
+    needs: [get-version, build-msi]
     steps:
       - uses: actions/checkout@v3
       - name: Download .msi
@@ -230,17 +234,18 @@ jobs:
         shell: pwsh
       - name: Download WinFsp
         run: |
-          $winfspUrl= (Select-String -Path ".\dist\win\bundle\resources\winfsp-download.url" -Pattern 'https:.*').Matches.Value
+          $winfspUrl = (Select-String -Path ".\dist\win\bundle\resources\winFspMetaData.wxi" -Pattern '<\?define BundledWinFspDownloadLink="(.+)".*?>').Matches.Groups[1].Value
           curl --output dist/win/bundle/resources/winfsp.msi -L $winfspUrl
         shell: pwsh
       - name: Compile to wixObj file
         run: >
           "${WIX}/bin/candle.exe" dist/win/bundle/bundleWithWinfsp.wxs
           -ext WixBalExtension
+          -ext WixUtilExtension
           -out dist/win/bundle/
-          -dBundleVersion="${{ needs.build-msi.outputs.semVerNum }}.${{ needs.build-msi.outputs.revNum }}"
+          -dBundleVersion="${{ needs.get-version.outputs.semVerNum }}.${{ needs.get-version.outputs.revNum }}"
           -dBundleVendor="Skymatic GmbH"
-          -dBundleCopyright="(C) 2016 - 2022 Skymatic GmbH"
+          -dBundleCopyright="(C) 2016 - 2023 Skymatic GmbH"
           -dAboutUrl="https://cryptomator.org"
           -dHelpUrl="https://cryptomator.org/contact"
           -dUpdateUrl="https://cryptomator.org/downloads/"
@@ -248,6 +253,7 @@ jobs:
         run: >
           "${WIX}/bin/light.exe" -b dist/win/ dist/win/bundle/bundleWithWinfsp.wixobj
           -ext WixBalExtension
+          -ext WixUtilExtension
           -out installer/unsigned/Cryptomator-Installer.exe
       - name: Detach burn engine in preparation to sign
         run: >
@@ -255,7 +261,7 @@ jobs:
           -ib installer/unsigned/Cryptomator-Installer.exe
           -o tmp/engine.exe
       - name: Codesign burn engine
-        uses: skymatic/code-sign-action@v1
+        uses: skymatic/code-sign-action@v2
         with:
           certificate: ${{ secrets.WIN_CODESIGN_P12_BASE64 }}
           password: ${{ secrets.WIN_CODESIGN_P12_PW }}
@@ -269,7 +275,7 @@ jobs:
           -ab tmp/engine.exe installer/unsigned/Cryptomator-Installer.exe
           -o installer/Cryptomator-Installer.exe
       - name: Codesign EXE
-        uses: skymatic/code-sign-action@v1
+        uses: skymatic/code-sign-action@v2
         with:
           certificate: ${{ secrets.WIN_CODESIGN_P12_BASE64 }}
           password: ${{ secrets.WIN_CODESIGN_P12_PW }}
@@ -278,7 +284,7 @@ jobs:
           timestampUrl: 'http://timestamp.digicert.com'
           folder: installer
       - name: Add possible alpha/beta tags to installer name
-        run: mv installer/Cryptomator-Installer.exe Cryptomator-${{ needs.build-msi.outputs.semVerStr }}-x64.exe
+        run: mv installer/Cryptomator-Installer.exe Cryptomator-${{ needs.get-version.outputs.semVerStr }}-x64.exe
       - name: Create detached GPG signature with key 615D449FE6E6A235
         run: |
           echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
@@ -311,12 +317,12 @@ jobs:
     needs: [build-msi, build-exe]
     steps:
       - name: Download .msi
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
         with:
           name: msi
           path: msi
       - name: Download .exe
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
         with:
           name: exe
           path: exe
@@ -326,7 +332,7 @@ jobs:
           cp msi/*.msi files
           cp exe/*.exe files
       - name: Upload to Kaspersky
-        uses: SamKirkland/FTP-Deploy-Action@4.3.0
+        uses: SamKirkland/FTP-Deploy-Action@4.3.3
         with:
           protocol: ftps
           server: allowlist.kaspersky-labs.com

.github/workflows/winget.yml

@@ -18,7 +18,7 @@ jobs:
     name: Publish on winget repo
     runs-on: windows-latest
     steps:
-      - name: Get download url for msi artifacts
+      - name: Get download url for release assets
         id: get-release-assets
         uses: actions/github-script@v6
         with:

.idea/compiler.xml

@@ -14,10 +14,10 @@
         <option name="dagger.fastInit" value="enabled" />
         <option name="dagger.formatGeneratedSource" value="enabled" />
         <processorPath useClasspath="false">
-          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger-compiler/2.44/dagger-compiler-2.44.jar" />
-          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger/2.44/dagger-2.44.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger-compiler/2.45/dagger-compiler-2.45.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger/2.45/dagger-2.45.jar" />
           <entry name="$MAVEN_REPOSITORY$/javax/inject/javax.inject/1/javax.inject-1.jar" />
-          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger-producers/2.44/dagger-producers-2.44.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger-producers/2.45/dagger-producers-2.45.jar" />
           <entry name="$MAVEN_REPOSITORY$/com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.jar" />
           <entry name="$MAVEN_REPOSITORY$/com/google/guava/guava/31.0.1-jre/guava-31.0.1-jre.jar" />
           <entry name="$MAVEN_REPOSITORY$/com/google/guava/listenablefuture/9999.0-empty-to-avoid-conflict-with-guava/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar" />
@@ -26,14 +26,16 @@
           <entry name="$MAVEN_REPOSITORY$/com/google/errorprone/error_prone_annotations/2.7.1/error_prone_annotations-2.7.1.jar" />
           <entry name="$MAVEN_REPOSITORY$/com/google/j2objc/j2objc-annotations/1.3/j2objc-annotations-1.3.jar" />
           <entry name="$MAVEN_REPOSITORY$/org/checkerframework/checker-compat-qual/2.5.5/checker-compat-qual-2.5.5.jar" />
-          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger-spi/2.44/dagger-spi-2.44.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger-spi/2.45/dagger-spi-2.45.jar" />
           <entry name="$MAVEN_REPOSITORY$/com/google/devtools/ksp/symbol-processing-api/1.7.0-1.0.6/symbol-processing-api-1.7.0-1.0.6.jar" />
           <entry name="$MAVEN_REPOSITORY$/org/jetbrains/kotlin/kotlin-stdlib/1.7.0/kotlin-stdlib-1.7.0.jar" />
           <entry name="$MAVEN_REPOSITORY$/org/jetbrains/kotlin/kotlin-stdlib-common/1.7.0/kotlin-stdlib-common-1.7.0.jar" />
           <entry name="$MAVEN_REPOSITORY$/org/jetbrains/annotations/13.0/annotations-13.0.jar" />
           <entry name="$MAVEN_REPOSITORY$/com/squareup/javapoet/1.13.0/javapoet-1.13.0.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/squareup/kotlinpoet/1.11.0/kotlinpoet-1.11.0.jar" />
           <entry name="$MAVEN_REPOSITORY$/org/jetbrains/kotlin/kotlin-stdlib-jdk8/1.7.0/kotlin-stdlib-jdk8-1.7.0.jar" />
           <entry name="$MAVEN_REPOSITORY$/org/jetbrains/kotlin/kotlin-stdlib-jdk7/1.7.0/kotlin-stdlib-jdk7-1.7.0.jar" />
+          <entry name="$MAVEN_REPOSITORY$/org/jetbrains/kotlin/kotlin-reflect/1.6.10/kotlin-reflect-1.6.10.jar" />
           <entry name="$MAVEN_REPOSITORY$/com/google/googlejavaformat/google-java-format/1.5/google-java-format-1.5.jar" />
           <entry name="$MAVEN_REPOSITORY$/com/google/errorprone/javac-shaded/9-dev-r4023-3/javac-shaded-9-dev-r4023-3.jar" />
           <entry name="$MAVEN_REPOSITORY$/net/ltgt/gradle/incap/incap/0.2/incap-0.2.jar" />

README.md

@@ -33,6 +33,7 @@ Cryptomator is provided free of charge as an open-source project despite the hig
     <tr>
       <td><a href="https://mowcapital.com/"><img src="https://cryptomator.org/img/sponsors/mowcapital.svg" alt="Mow Capital" height="40"></a></td>
       <td><a href="https://www.easeus.com/"><img src="https://cryptomator.org/img/sponsors/easeus.png" alt="EaseUS" height="40"></a></td>
+      <td><a href="https://www.hassmann-it-forensik.de/"><img src="https://cryptomator.org/img/sponsors/hassmannitforensik.png" alt="Hassmann IT-Forensik" height="40"></a></td>
     </tr>
   </tbody>
 </table>
@@ -61,7 +62,7 @@ Download native binaries of Cryptomator on [cryptomator.org](https://cryptomator
 - File names get encrypted
 - Folder structure gets obfuscated
 - Use as many vaults in your Dropbox as you want, each having individual passwords
-- Three thousand commits for the security of your data!! :tada:
+- Four thousand commits for the security of your data!! :tada:
 
 ### Privacy
 
@@ -73,7 +74,7 @@ Download native binaries of Cryptomator on [cryptomator.org](https://cryptomator
 
 ### Consistency
 
-- HMAC over file contents to recognize changed ciphertext before decryption
+- Authenticated encryption is used for file content to recognize changed ciphertext before decryption
 - I/O operations are transactional and atomic, if the filesystems support it
 - Each file contains all information needed for decryption (except for the key of course), no common metadata means no [SPOF](http://en.wikipedia.org/wiki/Single_point_of_failure)
 
@@ -85,7 +86,7 @@ For more information on the security details visit [cryptomator.org](https://doc
 
 ### Dependencies
 
-* JDK 17 (e.g. temurin)
+* JDK 19 (e.g. temurin)
 * Maven 3
 
 ### Run Maven
@@ -99,10 +100,6 @@ mvn clean install
 
 This will build all the jars and bundle them together with their OS-specific dependencies under `target`. This can now be used to build native packages.
 
-### Start Cryptomator
-
-If you unzip the buildkit for your OS, you will find a launcher script with some basic settings. You might want to adjust these to your needs. To start Cryptomator, simply execute the launcher script from a terminal, e.g. `launcher-linux.sh`, if you're on a Linux system.
-
 ## License
 
 This project is dual-licensed under the GPLv3 for FOSS projects as well as a commercial license for independent software vendors and resellers. If you want to modify this application under different conditions, feel free to contact our support team.

dist/linux/appimage/build.sh

@@ -11,15 +11,20 @@ command -v curl >/dev/null 2>&1 || { echo >&2 "curl not found."; exit 1; }
 VERSION=$(mvn -f ../../../pom.xml help:evaluate -Dexpression=project.version -q -DforceStdout)
 SEMVER_STR=${VERSION}
 
+mvn -f ../../../pom.xml versions:set -DnewVersion=${SEMVER_STR}
+
 # compile
-mvn -B -f ../../../pom.xml clean package -DskipTests -Plinux
+mvn -B -f ../../../pom.xml clean package -Plinux -DskipTests
+cp ../../../LICENSE.txt ../../../target
+cp ../launcher.sh ../../../target
 cp ../../../target/cryptomator-*.jar ../../../target/mods
 
 # add runtime
 ${JAVA_HOME}/bin/jlink \
+    --verbose \
     --output runtime \
     --module-path "${JAVA_HOME}/jmods" \
-    --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,jdk.unsupported,jdk.crypto.ec,jdk.accessibility,jdk.management.jfr \
+    --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.unsupported,jdk.crypto.ec,jdk.security.auth,jdk.accessibility,jdk.management.jfr \
     --strip-native-commands \
     --no-header-files \
     --no-man-pages \
@@ -27,7 +32,7 @@ ${JAVA_HOME}/bin/jlink \
     --compress=1
 
 # create app dir
-envsubst '${SEMVER_STR} ${REVISION_NUM}' < dist/linux/launcher-gtk2.properties > launcher-gtk2.properties
+envsubst '${SEMVER_STR} ${REVISION_NUM}' < ../launcher-gtk2.properties > launcher-gtk2.properties
 ${JAVA_HOME}/bin/jpackage \
     --verbose \
     --type app-image \
@@ -35,10 +40,12 @@ ${JAVA_HOME}/bin/jpackage \
     --input ../../../target/libs \
     --module-path ../../../target/mods \
     --module org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator \
-    --dest . \
+    --dest appdir \
     --name Cryptomator \
     --vendor "Skymatic GmbH" \
-    --copyright "(C) 2016 - 2022 Skymatic GmbH" \
+    --java-options "--enable-preview" \
+    --java-options "--enable-native-access=org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64" \
+    --copyright "(C) 2016 - 2023 Skymatic GmbH" \
     --java-options "-Xss5m" \
     --java-options "-Xmx256m" \
     --app-version "${VERSION}.${REVISION_NO}" \
@@ -46,6 +53,7 @@ ${JAVA_HOME}/bin/jpackage \
     --java-options "-Dcryptomator.logDir=\"~/.local/share/Cryptomator/logs\"" \
     --java-options "-Dcryptomator.pluginDir=\"~/.local/share/Cryptomator/plugins\"" \
     --java-options "-Dcryptomator.settingsPath=\"~/.config/Cryptomator/settings.json:~/.Cryptomator/settings.json\"" \
+    --java-options "-Dcryptomator.p12Path=\"~/.config/Cryptomator/key.p12\"" \
     --java-options "-Dcryptomator.ipcSocketPath=\"~/.config/Cryptomator/ipc.socket\"" \
     --java-options "-Dcryptomator.mountPointsDir=\"~/.local/share/Cryptomator/mnt\"" \
     --java-options "-Dcryptomator.showTrayIcon=false" \
@@ -54,9 +62,8 @@ ${JAVA_HOME}/bin/jpackage \
     --resource-dir ../resources
 
 # transform AppDir
-mv Cryptomator Cryptomator.AppDir
+mv appdir/Cryptomator Cryptomator.AppDir
 cp -r resources/AppDir/* Cryptomator.AppDir/
-chmod +x Cryptomator.AppDir/lib/runtime/bin/java
 envsubst '${REVISION_NO}' < resources/AppDir/bin/cryptomator.sh > Cryptomator.AppDir/bin/cryptomator.sh
 cp ../common/org.cryptomator.Cryptomator256.png Cryptomator.AppDir/usr/share/icons/hicolor/256x256/apps/org.cryptomator.Cryptomator.png
 cp ../common/org.cryptomator.Cryptomator512.png Cryptomator.AppDir/usr/share/icons/hicolor/512x512/apps/org.cryptomator.Cryptomator.png
@@ -70,12 +77,6 @@ ln -s usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg Cryp
 ln -s usr/share/applications/org.cryptomator.Cryptomator.desktop Cryptomator.AppDir/Cryptomator.desktop
 ln -s bin/cryptomator.sh Cryptomator.AppDir/AppRun
 
-# extract jffi
-JFFI_NATIVE_JAR=`ls Cryptomator.AppDir/lib/app | grep -e 'jffi-[1-9]\.[0-9]\{1,2\}.[0-9]\{1,2\}-native.jar'`
-${JAVA_HOME}/bin/jar -xf Cryptomator.AppDir/lib/app/${JFFI_NATIVE_JAR} /jni/x86_64-Linux/
-mv jni/x86_64-Linux/* Cryptomator.AppDir/lib/app/libjffi.so
-rm -r jni/x86_64-Linux
-
 # load AppImageTool
 curl -L https://github.com/AppImage/AppImageKit/releases/download/13/appimagetool-x86_64.AppImage -o /tmp/appimagetool.AppImage
 chmod +x /tmp/appimagetool.AppImage
@@ -83,5 +84,11 @@ chmod +x /tmp/appimagetool.AppImage
 # create AppImage
 /tmp/appimagetool.AppImage \
     Cryptomator.AppDir \
-    cryptomator-SNAPSHOT-x86_64.AppImage \
+    cryptomator-${SEMVER_STR}-x86_64.AppImage  \
     -u 'gh-releases-zsync|cryptomator|cryptomator|latest|cryptomator-*-x86_64.AppImage.zsync'
+
+echo ""
+echo "Done. AppImage successfully created: cryptomator-${SEMVER_STR}-x86_64.AppImage"
+echo ""
+echo >&2 "To clean up, run: rm -rf Cryptomator.AppDir appdir jni runtime squashfs-root; rm launcher-gtk2.properties /tmp/appimagetool.AppImage"
+echo ""

dist/linux/appimage/resources/AppDir/bin/cryptomator.sh

@@ -15,9 +15,6 @@ elif command -v pacman &> /dev/null; then # don't forget arch
 	GTK3_PRESENT=`pacman -Qi gtk3 &> /dev/null; echo $?`
 fi
 
-# workaround for https://github.com/cryptomator/cryptomator-linux/issues/27
-export LD_PRELOAD=lib/app/libjffi.so
-
 if [ "$GTK2_PRESENT" -eq 0 ] && [ "$GTK3_PRESENT" -ne 0 ]; then
 	bin/Cryptomator-gtk2 $@
 else

dist/linux/common/org.cryptomator.Cryptomator.metainfo.xml

@@ -66,6 +66,12 @@
 	</content_rating>
 
 	<releases>
+		<release date="2023-03-15" version="1.7.3"/>
+		<release date="2023-03-07" version="1.7.2"/>
+		<release date="2023-03-03" version="1.7.1"/>
+		<release date="2023-03-01" version="1.7.0"/>
+		<release date="2022-12-14" version="1.6.17"/>
+		<release date="2022-12-06" version="1.6.16"/>
 		<release date="2022-10-06" version="1.6.15"/>
 		<release date="2022-08-31" version="1.6.14"/>
 		<release date="2022-07-27" version="1.6.12"/>

dist/linux/debian/control

@@ -2,7 +2,7 @@ Source: cryptomator
 Maintainer: Cryptobot <releases@cryptomator.org>
 Section: utils
 Priority: optional
-Build-Depends: debhelper (>=10), coffeelibs-jdk-19
+Build-Depends: debhelper (>=10), coffeelibs-jdk-19, libgtk2.0-0, libgtk-3-0,  libxxf86vm1, libgl1
 Standards-Version: 4.5.0
 Homepage: https://cryptomator.org
 Vcs-Git: https://github.com/cryptomator/cryptomator.git
@@ -12,7 +12,7 @@ Package: cryptomator
 Architecture: any
 Section: utils
 Priority: optional
-Depends: ${shlibs:Depends}, ${misc:Depends}, libfuse2, xdg-utils, libjffi-jni
+Depends: ${shlibs:Depends}, ${misc:Depends}, fuse3
 Recommends: gvfs-backends, gvfs-fuse, gnome-keyring
 XB-AppName: Cryptomator
 XB-Category: Utility;Security;FileTools;

dist/linux/debian/copyright

@@ -4,11 +4,11 @@ Upstream-Contact: Cryptomator <info@cryptomator.org>
 Source: https://cryptomator.org
 
 Files: *
-Copyright: 2016-2022 Skymatic GmbH
+Copyright: 2016-2023 Skymatic GmbH
 License: GPL-3+
 
 Files: debian/org.cryptomator.Cryptomator.appdata.xml
-Copyright: 2016-2022 Skymatic GmbH
+Copyright: 2016-2023 Skymatic GmbH
 License: FSFAP
 
 License: GPL-3+

dist/linux/debian/cryptomator.install

@@ -1,5 +1,4 @@
 cryptomator usr/lib
-debian/cryptomator.sh usr/lib/cryptomator/bin
 common/org.cryptomator.Cryptomator.desktop usr/share/applications
 common/org.cryptomator.Cryptomator.svg usr/share/icons/hicolor/scalable/apps
 common/org.cryptomator.Cryptomator256.png usr/share/icons/hicolor/256x256/apps

dist/linux/debian/cryptomator.links

@@ -1 +1 @@
-usr/lib/cryptomator/bin/cryptomator.sh usr/bin/cryptomator
+usr/lib/cryptomator/bin/cryptomator usr/bin/cryptomator

dist/linux/debian/cryptomator.sh

@@ -1,6 +0,0 @@
-#!/bin/sh
-
-# fix for https://github.com/cryptomator/cryptomator/issues/1370
-export LD_PRELOAD=/usr/lib/x86_64-linux-gnu/jni/libjffi-1.2.so
-
-/usr/lib/cryptomator/bin/cryptomator $@

dist/linux/debian/rules

@@ -5,6 +5,12 @@
 #export DH_VERBOSE=1
 
 JAVA_HOME = /usr/lib/jvm/java-19-coffeelibs
+DEB_BUILD_ARCH ?= $(shell dpkg-architecture -qDEB_BUILD_ARCH)
+ifeq ($(DEB_BUILD_ARCH),amd64)
+JMODS_PATH = jmods/amd64:${JAVA_HOME}/jmods
+else ifeq ($(DEB_BUILD_ARCH),arm64)
+JMODS_PATH = jmods/aarch64:${JAVA_HOME}/jmods
+endif
 
 %:
 	dh $@
@@ -20,7 +26,8 @@ override_dh_auto_build:
 	ln -s ../common/org.cryptomator.Cryptomator512.png resources/cryptomator.png
 	$(JAVA_HOME)/bin/jlink \
 		--output runtime \
-		--add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,jdk.unsupported,jdk.crypto.ec,jdk.accessibility,jdk.management.jfr \
+		--module-path "${JMODS_PATH}" \
+		--add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.unsupported,jdk.crypto.ec,jdk.security.auth,jdk.accessibility,jdk.management.jfr \
 		--strip-native-commands \
 		--no-header-files \
 		--no-man-pages \
@@ -35,7 +42,9 @@ override_dh_auto_build:
 		--dest . \
 		--name cryptomator \
 		--vendor "Skymatic GmbH" \
-		--copyright "(C) 2016 - 2022 Skymatic GmbH" \
+		--java-options "--enable-preview" \
+		--java-options "--enable-native-access=org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64" \
+		--copyright "(C) 2016 - 2023 Skymatic GmbH" \
 		--java-options "-Xss5m" \
 		--java-options "-Xmx256m" \
 		--java-options "-Dfile.encoding=\"utf-8\"" \
@@ -51,10 +60,3 @@ override_dh_auto_build:
 		--app-version "${VERSION_NUM}.${REVISION_NUM}" \
 		--resource-dir resources \
 		--verbose
-
-override_dh_fixperms:
-	dh_fixperms
-	chmod +x debian/cryptomator/usr/lib/cryptomator/bin/cryptomator.sh
-
-# override_dh_strip:
-	# no-op

dist/linux/launcher-gtk2.properties

@@ -1,5 +1,7 @@
 java-options=-Xss5m \
             -Xmx256m \
+            --enable-preview \
+            --enable-native-access=org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64 \
             -Dfile.encoding=\"utf-8\" \
             -Dcryptomator.appVersion=\"${SEMVER_STR}\" \
             -Dcryptomator.logDir=\"~/.local/share/Cryptomator/logs\" \

dist/linux/launcher.sh

@@ -1,13 +0,0 @@
-#!/bin/sh
-cd $(dirname $0)
-java \
-	-p "mods" \
-	-cp "libs/*" \
-	-Dcryptomator.settingsPath="~/.config/Cryptomator/settings.json" \
-	-Dcryptomator.ipcSocketPath="~/.config/Cryptomator/ipc.socket" \
-	-Dcryptomator.logDir="~/.local/share/Cryptomator/logs" \
-	-Dcryptomator.mountPointsDir="~/.local/share/Cryptomator/mnt" \
-	-Djdk.gtk.version=2 \
-	-Xss2m \
-	-Xmx512m \
-	-m org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator

dist/mac/dmg/build.sh

@@ -21,12 +21,13 @@ rm -rf runtime dmg *.app *.dmg
 # set variables
 APP_NAME="Cryptomator"
 VENDOR="Skymatic GmbH"
-COPYRIGHT_YEARS="2016 - 2022"
+COPYRIGHT_YEARS="2016 - 2023"
 PACKAGE_IDENTIFIER="org.cryptomator"
 MAIN_JAR_GLOB="cryptomator-*.jar"
 MODULE_AND_MAIN_CLASS="org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator"
 REVISION_NO=`git rev-list --count HEAD`
 VERSION_NO=`mvn -f../../../pom.xml help:evaluate -Dexpression=project.version -q -DforceStdout | sed -rn 's/.*([0-9]+\.[0-9]+\.[0-9]+).*/\1/p'`
+FUSE_LIB="FUSE-T"
 
 # check preconditions
 if [ -z "${JAVA_HOME}" ]; then echo "JAVA_HOME not set. Run using JAVA_HOME=/path/to/jdk ./build.sh"; exit 1; fi
@@ -65,6 +66,8 @@ ${JAVA_HOME}/bin/jpackage \
     --vendor "${VENDOR}" \
     --copyright "(C) ${COPYRIGHT_YEARS} ${VENDOR}" \
     --app-version "${VERSION_NO}" \
+    --java-options "--enable-preview" \
+    --java-options "--enable-native-access=org.cryptomator.jfuse.mac" \
     --java-options "-Xss5m" \
     --java-options "-Xmx256m" \
     --java-options "-Dfile.encoding=\"utf-8\"" \
@@ -77,6 +80,7 @@ ${JAVA_HOME}/bin/jpackage \
     --java-options "-Dcryptomator.ipcSocketPath=\"~/Library/Application Support/${APP_NAME}/ipc.socket\"" \
     --java-options "-Dcryptomator.p12Path=\"~/Library/Application Support/${APP_NAME}/key.p12\"" \
     --java-options "-Dcryptomator.integrationsMac.keychainServiceName=\"${APP_NAME}\"" \
+    --java-options "-Dcryptomator.mountPointsDir=\"~/${APP_NAME}\"" \
     --java-options "-Dcryptomator.showTrayIcon=true" \
     --java-options "-Dcryptomator.buildNumber=\"dmg-${REVISION_NO}\"" \
     --mac-package-identifier ${PACKAGE_IDENTIFIER} \
@@ -122,20 +126,20 @@ fi
 # prepare dmg contents
 mkdir dmg
 mv ${APP_NAME}.app dmg
-cp resources/macFUSE.webloc dmg
+cp resources/${FUSE_LIB}.webloc dmg
 
 # create dmg
 create-dmg \
     --volname ${APP_NAME} \
     --volicon "resources/${APP_NAME}-Volume.icns" \
-    --background "resources/${APP_NAME}-background.tiff" \
+    --background "resources/${APP_NAME}-${FUSE_LIB}-background.tiff" \
     --window-pos 400 100 \
     --window-size 640 694 \
     --icon-size 128 \
     --icon "${APP_NAME}.app" 128 245 \
     --hide-extension "${APP_NAME}.app" \
-    --icon "macFUSE.webloc" 320 501 \
-    --hide-extension "macFUSE.webloc" \
+    --icon "${FUSE_LIB}.webloc" 320 501 \
+    --hide-extension "${FUSE_LIB}.webloc" \
     --app-drop-link 512 245 \
     --eula "resources/license.rtf" \
     --icon ".background" 128 758 \

dist/mac/dmg/resources/FUSE-T.webloc

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>URL</key>
+	<string>https://www.fuse-t.org/</string>
+</dict>
+</plist>

dist/mac/dmg/resources/licenseTemplate.ftl

@@ -17,7 +17,7 @@
 \f1\b0 \
 \
 
-\f0\b \'a9 2016 \'96 2022 Skymatic GmbH
+\f0\b \'a9 2016 \'96 2023 Skymatic GmbH
 \f1\b0 \
 \
 This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.\

dist/mac/launcher.sh

@@ -1,12 +0,0 @@
-#!/bin/sh
-cd $(dirname $0)
-java \
-	-p "mods" \
-	-cp "libs/*" \
-	-Dcryptomator.settingsPath="~/Library/Application Support/Cryptomator/settings.json" \
-	-Dcryptomator.ipcSocketPath="~/Library/Application Support/Cryptomator/ipc.socket" \
-	-Dcryptomator.logDir="~/Library/Logs/Cryptomator" \
-	-Dcryptomator.mountPointsDir="/Volumes" \
-	-Xss20m \
-	-Xmx512m \
-	-m org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator

dist/win/build.bat

@@ -9,8 +9,9 @@ SET ABOUT_URL="https://cryptomator.org"
 SET UPDATE_URL="https://cryptomator.org/downloads/"
 SET HELP_URL="https://cryptomator.org/contact/"
 SET MODULE_AND_MAIN_CLASS="org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator"
+SET LOOPBACK_ALIAS="cryptomator-vault"
 
-powershell -NoLogo -NoExit -ExecutionPolicy Unrestricted -Command .\build.ps1^
+powershell -NoLogo -ExecutionPolicy Unrestricted -Command .\build.ps1^
  -AppName %APPNAME%^
  -MainJarGlob "%MAIN_JAR_GLOB%"^
  -ModuleAndMainClass "%MODULE_AND_MAIN_CLASS%"^
@@ -20,4 +21,5 @@ powershell -NoLogo -NoExit -ExecutionPolicy Unrestricted -Command .\build.ps1^
  -AboutUrl "%ABOUT_URL%"^
  -HelpUrl "%HELP_URL%"^
  -UpdateUrl "%UPDATE_URL%"^
+ -LoopbackAlias "%LOOPBACK_ALIAS%"^
  -Clean 1

dist/win/build.ps1

@@ -8,6 +8,7 @@ Param(
 	[Parameter(Mandatory, HelpMessage="Please provide a help url")][string] $HelpUrl,
 	[Parameter(Mandatory, HelpMessage="Please provide an update url")][string] $UpdateUrl,
 	[Parameter(Mandatory, HelpMessage="Please provide an about url")][string] $AboutUrl,
+	[Parameter(Mandatory, HelpMessage="Please provide an alias for localhost")][string] $LoopbackAlias,
 	[bool] $clean
 )
 
@@ -74,6 +75,8 @@ if ($clean -and (Test-Path -Path $appPath)) {
 	--name $AppName `
 	--vendor $Vendor `
 	--copyright $copyright `
+	--java-options "--enable-preview" `
+	--java-options "--enable-native-access=org.cryptomator.jfuse.win" `
 	--java-options "-Xss5m" `
 	--java-options "-Xmx256m" `
 	--java-options "-Dcryptomator.appVersion=`"$semVerNo`"" `
@@ -85,6 +88,7 @@ if ($clean -and (Test-Path -Path $appPath)) {
 	--java-options "-Dcryptomator.ipcSocketPath=`"~/AppData/Roaming/$AppName/ipc.socket`"" `
 	--java-options "-Dcryptomator.p12Path=`"~/AppData/Roaming/$AppName/key.p12`"" `
 	--java-options "-Dcryptomator.mountPointsDir=`"~/$AppName`"" `
+	--java-options "-Dcryptomator.loopbackAlias=`"$LoopbackAlias`"" `
 	--java-options "-Dcryptomator.integrationsWin.autoStartShellLinkName=`"$AppName`"" `
 	--java-options "-Dcryptomator.integrationsWin.keychainPaths=`"~/AppData/Roaming/$AppName/keychain.json`"" `
 	--java-options "-Dcryptomator.showTrayIcon=true" `
@@ -105,6 +109,14 @@ if ($clean -and (Test-Path -Path $appPath)) {
 # patch app dir
 Copy-Item "contrib\*" -Destination "$AppName"
 attrib -r "$AppName\$AppName.exe"
+# patch batch script to set hostfile
+$webDAVPatcher = "$AppName\patchWebDAV.bat"
+try {
+	(Get-Content $webDAVPatcher ) -replace '::REPLACE ME', "SET LOOPBACK_ALIAS=`"$LoopbackAlias`"" | Set-Content $webDAVPatcher
+} catch {
+   Write-Host "Failed to set LOOPBACK_ALIAS for patchWebDAV.bat"
+   exit 1
+}
 
 # create .msi
 $Env:JP_WIXWIZARD_RESOURCES = "$buildDir\resources"
@@ -117,7 +129,7 @@ $Env:JP_WIXWIZARD_RESOURCES = "$buildDir\resources"
 	--name $AppName `
 	--vendor $Vendor `
 	--copyright $copyright `
-	--app-version "$semVerNo" `
+	--app-version "$semVerNo.$revisionNo" `
 	--win-menu `
 	--win-dir-chooser `
 	--win-shortcut-prompt `
@@ -141,7 +153,7 @@ $Env:JP_WIXWIZARD_RESOURCES = "$buildDir\resources"
 # download Winfsp
 [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
 $ProgressPreference = 'SilentlyContinue' # disables Invoke-WebRequest's progress bar, which slows down downloads to a few bytes/s
-$winfspMsiUrl= (Select-String -Path ".\bundle\resources\winfsp-download.url" -Pattern 'https:.*').Matches.Value
+$winfspMsiUrl= (Select-String -Path ".\bundle\resources\winFspMetaData.wxi" -Pattern '<\?define BundledWinFspDownloadLink="(.+)".*?>').Matches.Groups[1].Value
 Write-Output "Downloading ${winfspMsiUrl}..."
 Invoke-WebRequest $winfspMsiUrl -OutFile ".\bundle\resources\winfsp.msi" # redirects are followed by default
 
@@ -149,11 +161,11 @@ Invoke-WebRequest $winfspMsiUrl -OutFile ".\bundle\resources\winfsp.msi" # redir
 Copy-Item ".\installer\$AppName-*.msi" -Destination ".\bundle\resources\$AppName.msi"
 
 # create bundle including winfsp
-& "$env:WIX\bin\candle.exe" .\bundle\bundleWithWinfsp.wxs -ext WixBalExtension -out bundle\ `
+& "$env:WIX\bin\candle.exe" .\bundle\bundleWithWinfsp.wxs -ext WixBalExtension -ext WixUtilextension -out bundle\ `
 	-dBundleVersion="$semVerNo.$revisionNo" `
 	-dBundleVendor="$Vendor" `
 	-dBundleCopyright="$copyright" `
 	-dAboutUrl="$AboutUrl" `
 	-dHelpUrl="$HelpUrl" `
 	-dUpdateUrl="$UpdateUrl"
-& "$env:WIX\bin\light.exe" -b . .\bundle\BundlewithWinfsp.wixobj -ext WixBalExtension -out installer\$AppName-Installer.exe
+& "$env:WIX\bin\light.exe" -b . .\bundle\BundlewithWinfsp.wixobj -ext WixBalExtension -ext WixUtilextension -out installer\$AppName-Installer.exe

dist/win/bundle/bundleWithWinfsp.wxs

@@ -1,13 +1,31 @@
 <?xml version="1.0"?>
 
-<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi" xmlns:bal="http://schemas.microsoft.com/wix/BalExtension">
+<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi" xmlns:bal="http://schemas.microsoft.com/wix/BalExtension" xmlns:util="http://schemas.microsoft.com/wix/UtilExtension">
     <!-- see https://wixtoolset.org/documentation/manual/v3/xsd/wix/bundle.html-->
     <!-- Attributes explicitly not used:
         Condition - the single msi files have their own install conditions, no need to copy them here
     -->
+
     <Bundle Name="Cryptomator" UpgradeCode="29eea626-2e5b-4449-b5f8-4602925ddf7b" Version="$(var.BundleVersion)" Manufacturer="$(var.BundleVendor)"
      AboutUrl="$(var.AboutUrl)" HelpUrl="$(var.HelpUrl)" UpdateUrl="$(var.UpdateUrl)" Copyright="$(var.BundleCopyright)" IconSourceFile="bundle\resources\Cryptomator.ico">
 
+        <!-- detect outdated WinFsp installations -->
+        <?include "resources\winFspMetaData.wxi" ?>
+        <util:ProductSearch
+            Variable="InstalledWinFspVersion"
+            Result="version"
+            UpgradeCode="82F812D9-4083-4EF1-8BC8-0F1EDA05B46B"
+        />
+        <!-- Note: The bundle engine takes the Message format literaly -->
+        <bal:Condition Message=
+"The WinFsp driver used by Cryptomator is outdated and must be removed before the installation.
+
+1. Open the view of installed apps
+2. Search for &quot;WinFsp&quot;
+3. Uninstall the listed application
+4. Reboot your device
+5. Restart this installer">(InstalledWinFspVersion = v0.0.0.0) OR ($(var.BundledWinFspVersion) &lt;= InstalledWinFspVersion)</bal:Condition>
+
         <!-- for definition of the standard themes, see https://github.com/wixtoolset/wix3/blob/master/src/ext/BalExtension/wixstdba/Resources/-->
         <BootstrapperApplicationRef Id="WixStandardBootstrapperApplication.RtfLargeLicense">
             <!-- see https://wixtoolset.org/documentation/manual/v3/xsd/bal/wixstandardbootstrapperapplication.html -->

dist/win/bundle/customBootstrapperTheme.xml

@@ -10,6 +10,7 @@
     <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>
     <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>
     <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>
+    <Font Id="5" Height="-12" Weight="700" Foreground="000000" Background="FFFFFF">Segoe UI</Font>
 
     <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" />
     <Text X="80" Y="11" Width="-11" Height="64" FontId="1" DisablePrefix="yes">#(loc.Title)</Text>
@@ -82,7 +83,7 @@
         <Text Name="FailureUninstallHeader" X="185" Y="50" Width="-11" Height="30" FontId="2" HideWhenDisabled="yes" DisablePrefix="yes">#(loc.FailureUninstallHeader)</Text>
         <Text Name="FailureRepairHeader" X="185" Y="50" Width="-11" Height="30" FontId="2" HideWhenDisabled="yes" DisablePrefix="yes">#(loc.FailureRepairHeader)</Text>
         <Hypertext Name="FailureLogFileLink" X="185" Y="121" Width="-11" Height="68" FontId="3" TabStop="yes" HideWhenDisabled="yes">#(loc.FailureHyperlinkLogText)</Hypertext>
-        <Hypertext Name="FailureMessageText" X="185" Y="-115" Width="-11" Height="80" FontId="3" TabStop="yes" HideWhenDisabled="yes" />
+        <Hypertext Name="FailureMessageText" X="185" Y="-80" Width="-11" Height="140" FontId="5" TabStop="yes" HideWhenDisabled="yes" />
         <Text Name="FailureRestartText" X="185" Y="-57" Width="-11" Height="80" FontId="3" HideWhenDisabled="yes" DisablePrefix="yes">#(loc.FailureRestartText)</Text>
         <Button Name="FailureRestartButton" X="-91" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0" HideWhenDisabled="yes">#(loc.FailureRestartButton)</Button>
         <Button Name="FailureCloseButton" X="-11" Y="-11" Width="75" Height="23" TabStop="yes" FontId="0">#(loc.FailureCloseButton)</Button>

dist/win/bundle/resources/licenseTemplate.ftl

@@ -10,7 +10,7 @@
 \vieww12000\viewh15840\viewkind0
 \pard\tx283\tx567\tx850\tx2267\tx2834\tx3401\tx3968\tx4535\tx5102\tx5669\tx6236\tx6803\b\fs16\lang7 Cryptomator is distributed under the GPLv3 License, found below. Please see the bottom of this document for any other license applicable to code used within Cryptomator.\b0\par
 \par
-\b\'a9 2016 \'96 2022 Skymatic GmbH \b0\par
+\b\'a9 2016 \'96 2023 Skymatic GmbH \b0\par
 \par
 This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.\par
 \par

dist/win/bundle/resources/winFspMetaData.wxi

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<Include xmlns="http://schemas.microsoft.com/wix/2006/wi">
+  <!-- A version number MUST be prefixed with letter "v", otherwise it is considered a normal string -->
+  <?define BundledWinFspVersion="v1.12.22339" ?>
+  <?define BundledWinFspDownloadLink="https://github.com/winfsp/winfsp/releases/download/v1.12.22339/winfsp-1.12.22339.msi" ?> <!-- Only used by external build scripts -->
+</Include>

dist/win/bundle/resources/winfsp-download.url

@@ -1,2 +0,0 @@
-[InternetShortcut]
-URL=https://github.com/winfsp/winfsp/releases/download/v1.12/winfsp-1.12.22301.msi

dist/win/contrib/cryptomator.bat

@@ -1,12 +0,0 @@
-@echo off
-java ^
-	-p "app/mods" ^
-	-cp "app/*" ^
-	-Dcryptomator.settingsPath="~/AppData/Roaming/Cryptomator/settings.json" ^
-	-Dcryptomator.ipcSocketPath="~/AppData/Roaming/Cryptomator/ipc.socket" ^
-	-Dcryptomator.logDir="~/AppData/Roaming/Cryptomator" ^
-	-Dcryptomator.mountPointsDir="~/Cryptomator" ^
-	-Dcryptomator.keychainPath="~/AppData/Roaming/Cryptomator/keychain.json" ^
-	-Xss20m ^
-	-Xmx512m ^
-	-m org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator

dist/win/contrib/patchWebDAV.bat

@@ -1,6 +1,6 @@
 @echo off
 :: Default values for Cryptomator builds
-SET LOOPBACK_ALIAS="cryptomator-vault"
+::REPLACE ME
 
 cd %~dp0
 powershell -NoLogo -NonInteractive -ExecutionPolicy Unrestricted -Command .\patchWebDAV.ps1^

dist/win/contrib/version170-migrate-settings.bat

@@ -0,0 +1,5 @@
+@echo off
+:: see comments in file ./version170-migrate-settings.ps1
+
+cd %~dp0
+powershell -NoLogo -NonInteractive -ExecutionPolicy Unrestricted -Command .\version170-migrate-settings.ps1

dist/win/contrib/version170-migrate-settings.ps1

@@ -0,0 +1,35 @@
+# This script migrates Cryptomator settings for all local users on Windows in case the users uses custom directories as mountpoint
+# See also https://github.com/cryptomator/cryptomator/pull/2654.
+#
+# TODO: This script should be evaluated in a yearly interval if it is still needed and if not, should be removed
+#
+#Requires -RunAsAdministrator
+
+#Get all active, local user profiles
+$profileList = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList'
+Get-ChildItem $profileList | ForEach-Object {
+    $profilePath =  $_.GetValue("ProfileImagePath") 
+    $settingsPath = "$profilePath\AppData\Roaming\Cryptomator\settings.json"
+    if(!(Test-Path -Path $settingsPath -PathType Leaf)) {
+        #No settings file, nothing to do.
+        return;
+    }
+    $settings = Get-Content -Path $settingsPath | ConvertFrom-Json
+    if($settings.preferredVolumeImpl -ne "FUSE") {
+        #Fuse not used, nothing to do
+        return;
+    }
+
+    #check if customMountPoints are used
+    $atLeastOneCustomPath = $false;
+    foreach ($vault in $settings.directories){
+        $atLeastOneCustomPath = $atLeastOneCustomPath -or ($vault.useCustomMountPath -eq "True")
+    }
+
+    #if so, use WinFsp Local Drive
+    if( $atLeastOneCustomPath ) {
+        Add-Member -Force -InputObject $settings -Name "mountService" -Value "org.cryptomator.frontend.fuse.mount.WinFspMountProvider" -MemberType NoteProperty
+        $newSettings  = $settings | Select-Object * -ExcludeProperty "preferredVolumeImpl"
+        ConvertTo-Json $newSettings | Set-Content -Path $settingsPath
+    }
+}

dist/win/launcher.bat

@@ -9,4 +9,6 @@ java ^
 	-Dcryptomator.keychainPath="~/AppData/Roaming/Cryptomator/keychain.json" ^
 	-Xss20m ^
 	-Xmx512m ^
+	--enable-preview `
+	--enable-native-access=org.cryptomator.jfuse.win `
 	-m org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator

dist/win/resources/customWizard.wxi

@@ -65,13 +65,10 @@
 				<Control Id="Title" Type="Text" X="135" Y="20" Width="220" Height="60" Transparent="yes" NoPrefix="yes" Text="!(loc.ExitDialogTitle)" />
 				<!-- TODO: localize? -->
 				<Control Id="Suggestion" Type="Text" X="135" Y="100" Width="220" Height="60" Transparent="yes" NoPrefix="yes">
-					<Text>We recommend for the best user experience to download and install one of the following third party Windows drivers:</Text>
+					<Text>We recommend for the best user experience to download and install the following third party Windows driver:</Text>
 				</Control>
 				<Control Id="WinFsp" Type="Hyperlink" X="140" Y="125" Width="220" Height="60" Transparent="yes">
-					<Text><![CDATA[• WinFsp (<a href="http://www.secfs.net/winfsp/rel/">Homepage</a>)]]></Text>
-				</Control>
-				<Control Id="Dokany" Type="Hyperlink" X="140" Y="137" Width="220" Height="60" Transparent="yes">
-					<Text><![CDATA[• Dokany (<a href="https://dokan-dev.github.io/">Homepage</a>)]]></Text>
+					<Text><![CDATA[WinFsp (<a href="https://winfsp.dev/">Homepage</a>)]]></Text>
 				</Control>
 			</Dialog>
 

dist/win/resources/licenseTemplate.ftl

@@ -10,7 +10,7 @@
 \vieww12000\viewh15840\viewkind0
 \pard\tx283\tx567\tx850\tx2267\tx2834\tx3401\tx3968\tx4535\tx5102\tx5669\tx6236\tx6803\b\fs16\lang7 Cryptomator is distributed under the GPLv3 License, found below. Please see the bottom of this document for any other license applicable to code used within Cryptomator.\b0\par
 \par
-\b\'a9 2016 \'96 2022 Skymatic GmbH \b0\par
+\b\'a9 2016 \'96 2023 Skymatic GmbH \b0\par
 \par
 This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.\par
 \par

dist/win/resources/main.wxs

@@ -23,6 +23,11 @@
     <?define JpUpgradeVersionOnlyDetectDowngrade="yes"?>
   <?endif?>
 
+  <!-- Cryptomator defaults -->
+  <?define IconFileEncryptedData= "Cryptomator-Vault.ico" ?>
+  <?define ProgIdContentType= "application/vnd.cryptomator.encrypted" ?>
+  <?define CloseApplicationTarget= "cryptomator.exe" ?>
+
   <?include $(var.JpConfigDir)/overrides.wxi ?>
 
   <Product
@@ -49,7 +54,7 @@
         Property="JP_UPGRADABLE_FOUND"
         Maximum="$(var.JpAppVersion)"
         MigrateFeatures="yes"
-        IncludeMaximum="$(var.JpUpgradeVersionOnlyDetectUpgrade)" />
+        IncludeMaximum="yes" />  <!-- TODO: check if this needs to be set to yes-->
       <UpgradeVersion
         OnlyDetect="$(var.JpUpgradeVersionOnlyDetectDowngrade)"
         Property="JP_DOWNGRADABLE_FOUND"
@@ -65,16 +70,16 @@
     <CustomAction Id="JpDisallowDowngrade" Error="!(loc.DowngradeErrorMessage)" />
     <?endif?>
 
-
-    <!-- Looking for legacy Cryptomator versions-->
-    <Property Id="OLDEXEINSTALLER">
-      <RegistrySearch Id="InnoSetupInstallation" Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\Uninstall\Cryptomator_is1" Type="raw" Name="DisplayName" />
-    </Property>
-    <!-- Block installation if innosetup entry of Cryptomator is found -->
-    <!-- TODO: localize -->
-    <Condition Message="A lower version of [ProductName] is already installed. Uninstall it first and then start the setup again. Setup will now exit.">
-        <![CDATA[Installed OR NOT OLDEXEINSTALLER]]>
-    </Condition>
+    <?ifndef SkipCryptomatorLegacyCheck ?>
+      <!-- Block installation if innosetup entry of Cryptomator is found -->
+      <Property Id="OLDEXEINSTALLER">
+        <RegistrySearch Id="InnoSetupInstallation" Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\Uninstall\Cryptomator_is1" Type="raw" Name="DisplayName" />
+      </Property>
+      <!-- TODO: localize -->
+      <Condition Message="A lower version of [ProductName] is already installed. Uninstall it first and then start the setup again. Setup will now exit.">
+          <![CDATA[Installed OR NOT OLDEXEINSTALLER]]>
+      </Condition>
+    <?endif?>
     <!-- Cryptomator uses UNIX Sockets, which are supported starting with Windows 10 v1803-->
     <Property Id="WINDOWSBUILDNUMBER" Secure="yes">
       <RegistrySearch Id="BuildNumberSearch" Root="HKLM" Key="SOFTWARE\Microsoft\Windows NT\CurrentVersion" Name="CurrentBuildNumber" Type="raw" />
@@ -86,7 +91,7 @@
     <!-- Non-Opening ProgID -->
     <DirectoryRef Id="INSTALLDIR">
         <Component Win64="yes" Id="nonStartingProgID" >
-          <File Id="IconFileForEncryptedData" KeyPath="yes" Source="$(env.JP_WIXWIZARD_RESOURCES)\$(var.IconFileC9rC9s)" Name="$(var.IconFileC9rC9s)"></File>
+          <File Id="IconFileForEncryptedData" KeyPath="yes" Source="$(env.JP_WIXWIZARD_RESOURCES)\$(var.IconFileEncryptedData)" Name="$(var.IconFileEncryptedData)"></File>
           <ProgId Id="$(var.JpAppName).Encrypted.1" Description="$(var.JpAppName) Encrypted Data" Icon="IconFileForEncryptedData" IconIndex="0">
             <Extension Id="c9r" Advertise="no" ContentType="$(var.ProgIdContentType)">
               <MIME ContentType="$(var.ProgIdContentType)" Default="yes"></MIME>
@@ -127,6 +132,9 @@
     <!-- WebDAV patches -->
     <CustomAction Id="PatchWebDAV" Impersonate="no" ExeCommand="[INSTALLDIR]patchWebDAV.bat" Directory="INSTALLDIR" Execute="deferred" Return="asyncWait" />
 
+    <!-- Special Settings migration for 1.7.0,. Should be removed eventually, for more info, see ../contrib/version170-migrate-settings.ps1-->
+    <CustomAction Id="V170MigrateSettings" Impersonate="no" ExeCommand="[INSTALLDIR]version170-migrate-settings.bat" Directory="INSTALLDIR" Execute="deferred" Return="asyncWait" />
+
     <!-- Running App detection and exit -->
     <Property Id="FOUNDRUNNINGAPP" Admin="yes"/>
     <util:CloseApplication
@@ -135,11 +143,11 @@
       CloseMessage="no"
       RebootPrompt="no"
       PromptToContinue="yes"
-      Description="A running instance of $(var.JpAppName) is found. Please close it to continue."
+      Description="A running instance of $(var.JpAppName) is found, using files marked for update. Please close it to continue."
       Property="FOUNDRUNNINGAPP"
       >
     </util:CloseApplication>
-    <CustomAction Id="FailOnRunningApp" Impersonate="no" ExeCommand="[SystemFolder]\cmd.exe /c &quot;exit 1&quot;" Directory="INSTALLDIR" Execute="immediate" Return="check" />
+    <CustomAction Id="FailOnRunningApp" Error="Installation aborted, because files marked for update are used by a running instance of $(var.JpAppName)."/>
 
     <?ifdef JpIcon ?>
     <Property Id="ARPPRODUCTICON" Value="JpARPPRODUCTICON"/>
@@ -174,9 +182,10 @@
       <Custom Action="WixCloseApplications" Before="InstallValidate"></Custom>
       <Custom Action="FailOnRunningApp" After="WixCloseApplications" >FOUNDRUNNINGAPP</Custom>
 
-      <RemoveExistingProducts After="InstallValidate"/>
+      <RemoveExistingProducts After="InstallValidate"/> <!-- Moved from CostInitialize, due to WixCloseApplications -->
 
       <Custom Action="PatchWebDAV" After="InstallFiles">NOT Installed OR REINSTALL</Custom>
+      <Custom Action="V170MigrateSettings" After="InstallFiles">NOT Installed OR REINSTALL</Custom>
     </InstallExecuteSequence>
 
     <WixVariable Id="WixUIBannerBmp" Value="$(env.JP_WIXWIZARD_RESOURCES)\banner.bmp" />

dist/win/resources/overrides.wxi

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- Stub by design -->
 
-<!--
+<!-- jPackage Section
 overrides.wxi is a placeholder to set/alter WiX variables referenced from default
 main.wxs file.
 
@@ -30,10 +30,21 @@ Should be defined to enable upgrades and undefined to disable upgrades.
 Default value is `yes`.
 -->
 
-<!-- Non-opening ProgID settings-->
-<?define IconFileC9rC9s= "Cryptomator-Vault.ico" ?>
-<?define ProgIdContentType= "application/vnd.cryptomator.encrypted" ?>
+<!-- Cryptomator Section
 
-<!-- Close Application util -->
-<?define CloseApplicationTarget= "cryptomator.exe" ?>
+Non-opening ProgID settings:
+- IconFileEncryptedData
+Full file name of icon file used for encrypted data files. Default is "Cryptomator-Vault.ico"
+
+- ProgIdContentType
+Media Type of the encrypted data files. Default is "application/vnd.cryptomator.encrypted"
+
+Close Application settings:
+- CloseApplicationTarget
+Full name of executable to be checkd in the close application util. Default is "cryptomator.exe"
+
+Legacy Installation settings:
+- SkipCryptomatorLegacyCheck
+Should be defined to disable checking for the inno setup installation of Cryptomator and undefined, to enable it.
+ -->
 <Include/>

pom.xml

@@ -3,7 +3,7 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>org.cryptomator</groupId>
 	<artifactId>cryptomator</artifactId>
-	<version>1.7.0</version>
+	<version>1.7.3</version>
 	<name>Cryptomator Desktop App</name>
 
 	<organization>
@@ -17,6 +17,11 @@
 			<email>sebastian.stenzel@gmail.com</email>
 			<timezone>+1</timezone>
 		</developer>
+		<developer>
+			<name>Armin Schrenk</name>
+			<email>armin.schrenk+dev@mailbox.org</email>
+			<timezone>+1</timezone>
+		</developer>
 	</developers>
 
 	<properties>
@@ -24,52 +29,46 @@
 		<project.jdk.version>19</project.jdk.version>
 
 		<!-- Group IDs of jars that need to stay on the class path for now -->
-		<!-- Check progress on https://github.com/swiesend/secret-service/issues/31 to remove hypfvieh, swiesend and jnr -->
-		<nonModularGroupIds>com.github.jnr,org.ow2.asm,org.apache.jackrabbit,org.apache.httpcomponents,de.swiesend,org.purejava,com.github.hypfvieh</nonModularGroupIds>
+		<!-- Once hypfvieh, swiesend, purejava and integrations-linux have module-info, remove them-->
+		<nonModularGroupIds>org.ow2.asm,org.apache.jackrabbit,org.apache.httpcomponents,de.swiesend,org.purejava,com.github.hypfvieh</nonModularGroupIds>
 
 		<!-- cryptomator dependencies -->
-		<cryptomator.cryptolib.version>2.1.0-rc1</cryptomator.cryptolib.version>
-		<cryptomator.cryptofs.version>2.4.5</cryptomator.cryptofs.version>
-		<cryptomator.integrations.version>1.2.0-beta2</cryptomator.integrations.version>
-		<cryptomator.integrations.win.version>1.1.2</cryptomator.integrations.win.version>
-		<cryptomator.integrations.mac.version>1.1.2</cryptomator.integrations.mac.version>
-		<cryptomator.integrations.linux.version>1.1.0</cryptomator.integrations.linux.version>
-		<cryptomator.fuse.version>2.0.0-beta1</cryptomator.fuse.version>
-		<cryptomator.dokany.version>2.0.0-beta1</cryptomator.dokany.version>
-		<cryptomator.webdav.version>2.0.0-beta1</cryptomator.webdav.version>
+		<cryptomator.cryptofs.version>2.6.2</cryptomator.cryptofs.version>
+		<cryptomator.integrations.version>1.2.0</cryptomator.integrations.version>
+		<cryptomator.integrations.win.version>1.2.0</cryptomator.integrations.win.version>
+		<cryptomator.integrations.mac.version>1.2.0</cryptomator.integrations.mac.version>
+		<cryptomator.integrations.linux.version>1.2.0</cryptomator.integrations.linux.version>
+		<cryptomator.fuse.version>2.0.4</cryptomator.fuse.version>
+		<cryptomator.dokany.version>2.0.0</cryptomator.dokany.version>
+		<cryptomator.webdav.version>2.0.2</cryptomator.webdav.version>
 
 		<!-- 3rd party dependencies -->
 		<commons-lang3.version>3.12.0</commons-lang3.version>
-		<dagger.version>2.44</dagger.version>
+		<dagger.version>2.45</dagger.version>
 		<easybind.version>2.2</easybind.version>
 		<guava.version>31.1-jre</guava.version>
-		<gson.version>2.9.1</gson.version>
-		<javafx.version>19</javafx.version>
-		<jwt.version>4.2.1</jwt.version>
-		<nimbus-jose.version>9.25.4</nimbus-jose.version>
-		<logback.version>1.4.4</logback.version>
-		<slf4j.version>2.0.3</slf4j.version>
+		<gson.version>2.10.1</gson.version>
+		<javafx.version>19.0.2.1</javafx.version>
+		<jwt.version>4.3.0</jwt.version>
+		<nimbus-jose.version>9.31</nimbus-jose.version>
+		<logback.version>1.4.5</logback.version>
+		<slf4j.version>2.0.6</slf4j.version>
 		<tinyoauth2.version>0.5.1</tinyoauth2.version>
 		<zxcvbn.version>1.7.0</zxcvbn.version>
 
 		<!-- test dependencies -->
-		<junit.jupiter.version>5.9.1</junit.jupiter.version>
-		<mockito.version>4.8.0</mockito.version>
+		<junit.jupiter.version>5.9.2</junit.jupiter.version>
+		<mockito.version>5.1.1</mockito.version>
 		<hamcrest.version>2.2</hamcrest.version>
 
 		<!-- build-time dependencies -->
 		<jetbrains.annotations.version>23.0.0</jetbrains.annotations.version>
-		<dependency-check.version>7.2.1</dependency-check.version>
+		<dependency-check.version>8.1.0</dependency-check.version>
 		<jacoco.version>0.8.8</jacoco.version>
 	</properties>
 
 	<dependencies>
 		<!-- Cryptomator Libs -->
-		<dependency>
-			<groupId>org.cryptomator</groupId>
-			<artifactId>cryptolib</artifactId>
-			<version>${cryptomator.cryptolib.version}</version>
-		</dependency>
 		<dependency>
 			<groupId>org.cryptomator</groupId>
 			<artifactId>cryptofs</artifactId>
@@ -373,6 +372,7 @@
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-dependency-plugin</artifactId>
 				<executions>
+					<!-- sort jars into two buckets (classpath and modulepath). exclude openjfx, which gets jlinked separately -->
 					<execution>
 						<id>copy-mods</id>
 						<phase>prepare-package</phase>
@@ -382,7 +382,7 @@
 						<configuration>
 							<includeScope>runtime</includeScope>
 							<outputDirectory>${project.build.directory}/mods</outputDirectory>
-							<excludeGroupIds>${nonModularGroupIds}</excludeGroupIds>
+							<excludeGroupIds>org.openjfx,${nonModularGroupIds}</excludeGroupIds>
 						</configuration>
 					</execution>
 					<execution>

src/main/java/org/cryptomator/common/CommonsModule.java

@@ -16,6 +16,7 @@ import org.cryptomator.common.settings.SettingsProvider;
 import org.cryptomator.common.vaults.VaultComponent;
 import org.cryptomator.common.vaults.VaultListModule;
 import org.cryptomator.cryptolib.common.MasterkeyFileAccess;
+import org.cryptomator.integrations.revealpath.RevealPathService;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -26,6 +27,7 @@ import java.net.InetSocketAddress;
 import java.security.NoSuchAlgorithmException;
 import java.security.SecureRandom;
 import java.util.Comparator;
+import java.util.Optional;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.SynchronousQueue;
@@ -83,6 +85,13 @@ public abstract class CommonsModule {
 		return new SemVerComparator();
 	}
 
+	@Provides
+	@Singleton
+	static Optional<RevealPathService> provideRevealPathService() {
+		return RevealPathService.get().findFirst();
+	}
+
+
 	@Provides
 	@Singleton
 	static Settings provideSettings(SettingsProvider settingsProvider) {

src/main/java/org/cryptomator/common/Environment.java

@@ -26,6 +26,7 @@ public class Environment {
 	private static final String KEYCHAIN_PATHS_PROP_NAME = "cryptomator.integrationsWin.keychainPaths";
 	private static final String P12_PATH_PROP_NAME = "cryptomator.p12Path";
 	private static final String LOG_DIR_PROP_NAME = "cryptomator.logDir";
+	private static final String LOOPBACK_ALIAS_PROP_NAME = "cryptomator.loopbackAlias";
 	private static final String MOUNTPOINT_DIR_PROP_NAME = "cryptomator.mountPointsDir";
 	private static final String MIN_PW_LENGTH_PROP_NAME = "cryptomator.minPwLength";
 	private static final String APP_VERSION_PROP_NAME = "cryptomator.appVersion";
@@ -45,6 +46,7 @@ public class Environment {
 		logCryptomatorSystemProperty(IPC_SOCKET_PATH_PROP_NAME);
 		logCryptomatorSystemProperty(KEYCHAIN_PATHS_PROP_NAME);
 		logCryptomatorSystemProperty(LOG_DIR_PROP_NAME);
+		logCryptomatorSystemProperty(LOOPBACK_ALIAS_PROP_NAME);
 		logCryptomatorSystemProperty(PLUGIN_DIR_PROP_NAME);
 		logCryptomatorSystemProperty(MOUNTPOINT_DIR_PROP_NAME);
 		logCryptomatorSystemProperty(MIN_PW_LENGTH_PROP_NAME);
@@ -90,6 +92,10 @@ public class Environment {
 		return getPath(LOG_DIR_PROP_NAME).map(this::replaceHomeDir);
 	}
 
+	public Optional<String> getLoopbackAlias() {
+		return Optional.ofNullable(System.getProperty(LOOPBACK_ALIAS_PROP_NAME));
+	}
+
 	public Optional<Path> getPluginDir() {
 		return getPath(PLUGIN_DIR_PROP_NAME).map(this::replaceHomeDir);
 	}
@@ -112,22 +118,13 @@ public class Environment {
 	}
 
 	public int getMinPwLength() {
-		return getInt(MIN_PW_LENGTH_PROP_NAME, DEFAULT_MIN_PW_LENGTH);
+		return Integer.getInteger(MIN_PW_LENGTH_PROP_NAME, DEFAULT_MIN_PW_LENGTH);
 	}
 
 	public boolean showTrayIcon() {
 		return Boolean.getBoolean(TRAY_ICON_PROP_NAME);
 	}
 
-	private int getInt(String propertyName, int defaultValue) {
-		String value = System.getProperty(propertyName);
-		try {
-			return Integer.parseInt(value);
-		} catch (NumberFormatException e) { // includes "null" values
-			return defaultValue;
-		}
-	}
-
 	private Optional<Path> getPath(String propertyName) {
 		String value = System.getProperty(propertyName);
 		return Optional.ofNullable(value).map(Paths::get);

src/main/java/org/cryptomator/common/ObservableUtil.java

@@ -0,0 +1,18 @@
+package org.cryptomator.common;
+
+import javafx.beans.binding.Bindings;
+import javafx.beans.value.ObservableValue;
+import java.util.function.Function;
+
+public class ObservableUtil {
+
+	public static <T, U> ObservableValue<U> mapWithDefault(ObservableValue<T> observable, Function<? super T, ? extends U> mapper, U defaultValue) {
+		return Bindings.createObjectBinding(() -> {
+			if (observable.getValue() == null) {
+				return defaultValue;
+			} else {
+				return mapper.apply(observable.getValue());
+			}
+		}, observable);
+	}
+}

src/main/java/org/cryptomator/common/mount/ActualMountService.java

@@ -0,0 +1,6 @@
+package org.cryptomator.common.mount;
+
+import org.cryptomator.integrations.mount.MountService;
+
+public record ActualMountService(MountService service, boolean isDesired) {
+}

src/main/java/org/cryptomator/common/mount/IllegalMountPointException.java

@@ -0,0 +1,9 @@
+package org.cryptomator.common.mount;
+
+public class IllegalMountPointException extends IllegalArgumentException {
+
+	public IllegalMountPointException(String msg) {
+		super(msg);
+	}
+
+}

src/main/java/org/cryptomator/common/mount/MountModule.java

@@ -6,6 +6,7 @@ import org.cryptomator.common.settings.Settings;
 import org.cryptomator.integrations.mount.MountService;
 
 import javax.inject.Singleton;
+import javafx.beans.property.SimpleObjectProperty;
 import javafx.beans.value.ObservableValue;
 import java.util.List;
 
@@ -18,13 +19,33 @@ public class MountModule {
 		return MountService.get().toList();
 	}
 
+	//currently not used, because macFUSE and FUSE-T cannot be used in the same JVM
+	/*
 	@Provides
 	@Singleton
-	static ObservableValue<MountService> provideMountService(Settings settings, List<MountService> serviceImpls) {
-		return settings.mountService().map(desiredServiceImpl -> {
-			var fallbackProvider = serviceImpls.stream().findFirst().orElse(null);
-			return serviceImpls.stream().filter(serviceImpl -> serviceImpl.getClass().getName().equals(desiredServiceImpl)).findAny().orElse(fallbackProvider);
-		});
+	static ObservableValue<ActualMountService> provideMountService(Settings settings, List<MountService> serviceImpls) {
+		var fallbackProvider = serviceImpls.stream().findFirst().orElse(null);
+		return ObservableUtil.mapWithDefault(settings.mountService(), //
+				desiredServiceImpl -> { //
+					var desiredService = serviceImpls.stream().filter(serviceImpl -> serviceImpl.getClass().getName().equals(desiredServiceImpl)).findAny(); //
+					return new ActualMountService(desiredService.orElse(fallbackProvider), desiredService.isPresent()); //
+				}, //
+				new ActualMountService(fallbackProvider, true));
+	}
+	 */
+
+	@Provides
+	@Singleton
+	static ActualMountService provideActualMountService(Settings settings, List<MountService> serviceImpls) {
+		var fallbackProvider = serviceImpls.stream().findFirst().orElse(null);
+		var desiredService = serviceImpls.stream().filter(serviceImpl -> serviceImpl.getClass().getName().equals(settings.mountService().getValue())).findFirst(); //
+		return new ActualMountService(desiredService.orElse(fallbackProvider), desiredService.isPresent()); //
+	}
+
+	@Provides
+	@Singleton
+	static ObservableValue<ActualMountService> provideMountService(ActualMountService service) {
+		return new SimpleObjectProperty<>(service);
 	}
 
 }

src/main/java/org/cryptomator/common/mount/MountPointNotExistsException.java

@@ -0,0 +1,8 @@
+package org.cryptomator.common.mount;
+
+public class MountPointNotExistsException extends IllegalMountPointException {
+
+	public MountPointNotExistsException(String msg) {
+		super(msg);
+	}
+}

src/main/java/org/cryptomator/common/mount/MountPointNotSupportedException.java

@@ -0,0 +1,8 @@
+package org.cryptomator.common.mount;
+
+public class MountPointNotSupportedException extends IllegalMountPointException {
+
+	public MountPointNotSupportedException(String msg) {
+		super(msg);
+	}
+}

src/main/java/org/cryptomator/common/mount/MountPointPreparationException.java

@@ -0,0 +1,12 @@
+package org.cryptomator.common.mount;
+
+public class MountPointPreparationException extends RuntimeException {
+
+	public MountPointPreparationException(String msg) {
+		super(msg);
+	}
+
+	public MountPointPreparationException(Throwable cause) {
+		super(cause);
+	}
+}

src/main/java/org/cryptomator/common/mount/MountWithinParentUtil.java

@@ -0,0 +1,121 @@
+package org.cryptomator.common.mount;
+
+import org.apache.commons.lang3.SystemUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.nio.file.DirectoryNotEmptyException;
+import java.nio.file.FileAlreadyExistsException;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.NoSuchFileException;
+import java.nio.file.NotDirectoryException;
+import java.nio.file.Path;
+
+public final class MountWithinParentUtil {
+
+	private static final Logger LOG = LoggerFactory.getLogger(Mounter.class);
+	private static final String HIDEAWAY_PREFIX = ".~$";
+	private static final String HIDEAWAY_SUFFIX = ".tmp";
+	private static final String WIN_HIDDEN_ATTR = "dos:hidden";
+
+	private MountWithinParentUtil() {}
+
+	static void prepareParentNoMountPoint(Path mountPoint) throws MountPointPreparationException {
+		Path hideaway = getHideaway(mountPoint);
+		var mpExists = Files.exists(mountPoint, LinkOption.NOFOLLOW_LINKS);
+		var hideExists = Files.exists(hideaway, LinkOption.NOFOLLOW_LINKS);
+
+		//TODO: possible improvement by just deleting an _empty_ hideaway
+		if (mpExists && hideExists) { //both resources exist (whatever type)
+			throw new MountPointPreparationException(new FileAlreadyExistsException(hideaway.toString()));
+		} else if (!mpExists && !hideExists) { //neither mountpoint nor hideaway exist
+			throw new MountPointPreparationException(new NoSuchFileException(mountPoint.toString()));
+		} else if (!mpExists) { //only hideaway exists
+			checkIsDirectory(hideaway);
+			LOG.info("Mountpoint {} seems to be not properly cleaned up. Will be fixed on unmount.", mountPoint);
+			try {
+				if (SystemUtils.IS_OS_WINDOWS) {
+					Files.setAttribute(hideaway, WIN_HIDDEN_ATTR, true, LinkOption.NOFOLLOW_LINKS);
+				}
+			} catch (IOException e) {
+				throw new MountPointPreparationException(e);
+			}
+		} else { //only mountpoint exists
+			try {
+				checkIsDirectory(mountPoint);
+				checkIsEmpty(mountPoint);
+
+				Files.move(mountPoint, hideaway);
+				if (SystemUtils.IS_OS_WINDOWS) {
+					Files.setAttribute(hideaway, WIN_HIDDEN_ATTR, true, LinkOption.NOFOLLOW_LINKS);
+				}
+				int attempts = 0;
+				while (!Files.notExists(mountPoint)) {
+					if (attempts >= 10) {
+						throw new MountPointPreparationException("Path " + mountPoint + " could not be cleared");
+					}
+					Thread.sleep(1000);
+					attempts++;
+				}
+			} catch (IOException e) {
+				throw new MountPointPreparationException(e);
+			} catch (InterruptedException e) {
+				Thread.currentThread().interrupt();
+				throw new MountPointPreparationException(e);
+			}
+		}
+	}
+
+	static void cleanup(Path mountPoint) {
+		Path hideaway = getHideaway(mountPoint);
+		try {
+			waitForMountpointRestoration(mountPoint);
+			Files.move(hideaway, mountPoint);
+			if (SystemUtils.IS_OS_WINDOWS) {
+				Files.setAttribute(mountPoint, WIN_HIDDEN_ATTR, false);
+			}
+		} catch (IOException e) {
+			LOG.error("Unable to restore hidden directory to mountpoint {}.", mountPoint, e);
+		}
+	}
+
+	//on Windows removing the mountpoint takes some time, so we poll for at most 3 seconds
+	private static void waitForMountpointRestoration(Path mountPoint) throws FileAlreadyExistsException {
+		int attempts = 0;
+		while (!Files.notExists(mountPoint, LinkOption.NOFOLLOW_LINKS)) {
+			attempts++;
+			if (attempts >= 5) {
+				throw new FileAlreadyExistsException("Timeout waiting for mountpoint cleanup for " + mountPoint + " .");
+			}
+
+			try {
+				Thread.sleep(300);
+			} catch (InterruptedException e) {
+				Thread.currentThread().interrupt();
+				throw new FileAlreadyExistsException("Interrupted before mountpoint " + mountPoint + " was cleared");
+			}
+		}
+	}
+
+	private static void checkIsDirectory(Path toCheck) throws MountPointPreparationException {
+		if (!Files.isDirectory(toCheck, LinkOption.NOFOLLOW_LINKS)) {
+			throw new MountPointPreparationException(new NotDirectoryException(toCheck.toString()));
+		}
+	}
+
+	private static void checkIsEmpty(Path toCheck) throws MountPointPreparationException, IOException {
+		try (var dirStream = Files.list(toCheck)) {
+			if (dirStream.findFirst().isPresent()) {
+				throw new MountPointPreparationException(new DirectoryNotEmptyException(toCheck.toString()));
+			}
+		}
+	}
+
+	//visible for testing
+	static Path getHideaway(Path mountPoint) {
+		return mountPoint.resolveSibling(HIDEAWAY_PREFIX + mountPoint.getFileName().toString() + HIDEAWAY_SUFFIX);
+	}
+
+}

src/main/java/org/cryptomator/common/mount/Mounter.java

@@ -0,0 +1,141 @@
+package org.cryptomator.common.mount;
+
+import org.cryptomator.common.Environment;
+import org.cryptomator.common.settings.Settings;
+import org.cryptomator.common.settings.VaultSettings;
+import org.cryptomator.integrations.mount.Mount;
+import org.cryptomator.integrations.mount.MountBuilder;
+import org.cryptomator.integrations.mount.MountFailedException;
+import org.cryptomator.integrations.mount.MountService;
+
+import javax.inject.Inject;
+import javax.inject.Singleton;
+import javafx.beans.value.ObservableValue;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.cryptomator.integrations.mount.MountCapability.MOUNT_AS_DRIVE_LETTER;
+import static org.cryptomator.integrations.mount.MountCapability.MOUNT_TO_EXISTING_DIR;
+import static org.cryptomator.integrations.mount.MountCapability.MOUNT_TO_SYSTEM_CHOSEN_PATH;
+import static org.cryptomator.integrations.mount.MountCapability.MOUNT_WITHIN_EXISTING_PARENT;
+import static org.cryptomator.integrations.mount.MountCapability.UNMOUNT_FORCED;
+
+@Singleton
+public class Mounter {
+
+	private final Settings settings;
+	private final Environment env;
+	private final WindowsDriveLetters driveLetters;
+	private final ObservableValue<ActualMountService> mountServiceObservable;
+
+	@Inject
+	public Mounter(Settings settings, Environment env, WindowsDriveLetters driveLetters, ObservableValue<ActualMountService> mountServiceObservable) {
+		this.settings = settings;
+		this.env = env;
+		this.driveLetters = driveLetters;
+		this.mountServiceObservable = mountServiceObservable;
+	}
+
+	private class SettledMounter {
+
+		private MountService service;
+		private MountBuilder builder;
+		private VaultSettings vaultSettings;
+
+		public SettledMounter(MountService service, MountBuilder builder, VaultSettings vaultSettings) {
+			this.service = service;
+			this.builder = builder;
+			this.vaultSettings = vaultSettings;
+		}
+
+		Runnable prepare() throws IOException {
+			for (var capability : service.capabilities()) {
+				switch (capability) {
+					case FILE_SYSTEM_NAME -> builder.setFileSystemName("cryptoFs");
+					case LOOPBACK_PORT ->
+							builder.setLoopbackPort(settings.port().get()); //TODO: move port from settings to vaultsettings (see https://github.com/cryptomator/cryptomator/tree/feature/mount-setting-per-vault)
+					case LOOPBACK_HOST_NAME -> env.getLoopbackAlias().ifPresent(builder::setLoopbackHostName);
+					case READ_ONLY -> builder.setReadOnly(vaultSettings.usesReadOnlyMode().get());
+					case MOUNT_FLAGS -> {
+						var mountFlags = vaultSettings.mountFlags().get();
+						if (mountFlags == null || mountFlags.isBlank()) {
+							builder.setMountFlags(service.getDefaultMountFlags());
+						} else {
+							builder.setMountFlags(mountFlags);
+						}
+					}
+					case VOLUME_ID -> builder.setVolumeId(vaultSettings.getId());
+					case VOLUME_NAME -> builder.setVolumeName(vaultSettings.mountName().get());
+				}
+			}
+
+			return prepareMountPoint();
+		}
+
+		private Runnable prepareMountPoint() throws IOException {
+			Runnable cleanup = () -> {};
+			var userChosenMountPoint = vaultSettings.getMountPoint();
+			var defaultMountPointBase = env.getMountPointsDir().orElseThrow();
+			var canMountToDriveLetter = service.hasCapability(MOUNT_AS_DRIVE_LETTER);
+			var canMountToParent = service.hasCapability(MOUNT_WITHIN_EXISTING_PARENT);
+			var canMountToDir = service.hasCapability(MOUNT_TO_EXISTING_DIR);
+			var canMountToSystem = service.hasCapability(MOUNT_TO_SYSTEM_CHOSEN_PATH);
+
+			if (userChosenMountPoint == null) {
+				if (canMountToSystem) {
+					// no need to set a mount point
+				} else if (canMountToDriveLetter) {
+					builder.setMountpoint(driveLetters.getFirstDesiredAvailable().orElseThrow()); //TODO: catch exception and translate
+				} else if (canMountToParent) {
+					Files.createDirectories(defaultMountPointBase);
+					builder.setMountpoint(defaultMountPointBase);
+				} else if (canMountToDir) {
+					var mountPoint = defaultMountPointBase.resolve(vaultSettings.mountName().get());
+					Files.createDirectories(mountPoint);
+					builder.setMountpoint(mountPoint);
+				}
+			} else {
+				var mpIsDriveLetter = userChosenMountPoint.toString().matches("[A-Z]:\\\\");
+				if (!mpIsDriveLetter && canMountToParent && !canMountToDir) {
+					MountWithinParentUtil.prepareParentNoMountPoint(userChosenMountPoint);
+					cleanup = () -> {
+						MountWithinParentUtil.cleanup(userChosenMountPoint);
+					};
+				}
+				try {
+					builder.setMountpoint(userChosenMountPoint);
+				} catch (IllegalArgumentException | UnsupportedOperationException e) {
+					var configNotSupported = (!canMountToDriveLetter && mpIsDriveLetter) //mounting as driveletter, albeit not supported
+							|| (!canMountToDir && !mpIsDriveLetter) //mounting to directory, albeit not supported
+							|| (!canMountToParent && !mpIsDriveLetter) //
+							|| (!canMountToDir && !canMountToParent && !canMountToSystem && !canMountToDriveLetter);
+					if (configNotSupported) {
+						throw new MountPointNotSupportedException(e.getMessage());
+					} else if (canMountToDir && !canMountToParent && !Files.exists(userChosenMountPoint)) {
+						//mountpoint must exist
+						throw new MountPointNotExistsException(e.getMessage());
+					} else {
+						//TODO: add specific exception for !canMountToDir && canMountToParent && !Files.notExists(userChosenMountPoint)
+						throw new IllegalMountPointException(e.getMessage());
+					}
+				}
+			}
+			return cleanup;
+		}
+
+	}
+
+	public MountHandle mount(VaultSettings vaultSettings, Path cryptoFsRoot) throws IOException, MountFailedException {
+		var mountService = this.mountServiceObservable.getValue().service();
+		var builder = mountService.forFileSystem(cryptoFsRoot);
+		var internal = new SettledMounter(mountService, builder, vaultSettings);
+		var cleanup = internal.prepare();
+		return new MountHandle(builder.mount(), mountService.hasCapability(UNMOUNT_FORCED), cleanup);
+	}
+
+	public record MountHandle(Mount mountObj, boolean supportsUnmountForced, Runnable specialCleanup) {
+
+	}
+
+}

src/main/java/org/cryptomator/common/settings/DeviceKey.java

@@ -76,6 +76,11 @@ public class DeviceKey {
 
 	private P384KeyPair createAndStoreNewKeyPair(char[] passphrase, Path p12File) throws IOException {
 		var keyPair = P384KeyPair.generate();
+		var tmpFile = p12File.resolveSibling(p12File.getFileName().toString() + ".tmp");
+		if(Files.exists(tmpFile)) {
+			LOG.debug("Leftover from devicekey creation detected. Deleting {}", tmpFile);
+			Files.delete(tmpFile);
+		}
 		LOG.debug("Store new device key to {}", p12File);
 		keyPair.store(p12File, passphrase);
 		return keyPair;

src/main/java/org/cryptomator/common/settings/SettingsJsonAdapter.java

@@ -9,6 +9,7 @@ import com.google.gson.TypeAdapter;
 import com.google.gson.stream.JsonReader;
 import com.google.gson.stream.JsonToken;
 import com.google.gson.stream.JsonWriter;
+import org.apache.commons.lang3.SystemUtils;
 import org.cryptomator.common.Environment;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -36,29 +37,30 @@ public class SettingsJsonAdapter extends TypeAdapter<Settings> {
 	@Override
 	public void write(JsonWriter out, Settings value) throws IOException {
 		out.beginObject();
+		out.name("writtenByVersion").value(env.getAppVersion() + env.getBuildNumber().map("-"::concat).orElse(""));
 		out.name("directories");
 		writeVaultSettingsArray(out, value.getDirectories());
 		out.name("askedForUpdateCheck").value(value.askedForUpdateCheck().get());
-		out.name("checkForUpdatesEnabled").value(value.checkForUpdates().get());
-		out.name("startHidden").value(value.startHidden().get());
 		out.name("autoCloseVaults").value(value.autoCloseVaults().get());
-		out.name("port").value(value.port().get());
-		out.name("numTrayNotifications").value(value.numTrayNotifications().get());
+		out.name("checkForUpdatesEnabled").value(value.checkForUpdates().get());
 		out.name("debugMode").value(value.debugMode().get());
-		out.name("theme").value(value.theme().get().name());
-		out.name("uiOrientation").value(value.userInterfaceOrientation().get().name());
+		out.name("displayConfiguration").value((value.displayConfigurationProperty().get()));
 		out.name("keychainProvider").value(value.keychainProvider().get());
-		out.name("useKeychain").value(value.useKeychain().get());
+		out.name("language").value((value.languageProperty().get()));
 		out.name("licenseKey").value(value.licenseKey().get());
+		out.name("mountService").value(value.mountService().get());
+		out.name("numTrayNotifications").value(value.numTrayNotifications().get());
+		out.name("port").value(value.port().get());
 		out.name("showMinimizeButton").value(value.showMinimizeButton().get());
 		out.name("showTrayIcon").value(value.showTrayIcon().get());
+		out.name("startHidden").value(value.startHidden().get());
+		out.name("theme").value(value.theme().get().name());
+		out.name("uiOrientation").value(value.userInterfaceOrientation().get().name());
+		out.name("useKeychain").value(value.useKeychain().get());
+		out.name("windowHeight").value((value.windowHeightProperty().get()));
+		out.name("windowWidth").value((value.windowWidthProperty().get()));
 		out.name("windowXPosition").value((value.windowXPositionProperty().get()));
 		out.name("windowYPosition").value((value.windowYPositionProperty().get()));
-		out.name("windowWidth").value((value.windowWidthProperty().get()));
-		out.name("windowHeight").value((value.windowHeightProperty().get()));
-		out.name("displayConfiguration").value((value.displayConfigurationProperty().get()));
-		out.name("language").value((value.languageProperty().get()));
-		out.name("mountService").value(value.mountService().get());
 		out.endObject();
 	}
 
@@ -73,50 +75,84 @@ public class SettingsJsonAdapter extends TypeAdapter<Settings> {
 	@Override
 	public Settings read(JsonReader in) throws IOException {
 		Settings settings = new Settings(env);
-
+		//1.6.x legacy
+		String volumeImpl = null;
+		//legacy end
 		in.beginObject();
 		while (in.hasNext()) {
 			String name = in.nextName();
 			switch (name) {
+				case "writtenByVersion" -> in.skipValue(); //noop
 				case "directories" -> settings.getDirectories().addAll(readVaultSettingsArray(in));
 				case "askedForUpdateCheck" -> settings.askedForUpdateCheck().set(in.nextBoolean());
-				case "checkForUpdatesEnabled" -> settings.checkForUpdates().set(in.nextBoolean());
-				case "startHidden" -> settings.startHidden().set(in.nextBoolean());
 				case "autoCloseVaults" -> settings.autoCloseVaults().set(in.nextBoolean());
-				case "port" -> settings.port().set(in.nextInt());
-				case "numTrayNotifications" -> settings.numTrayNotifications().set(in.nextInt());
+				case "checkForUpdatesEnabled" -> settings.checkForUpdates().set(in.nextBoolean());
 				case "debugMode" -> settings.debugMode().set(in.nextBoolean());
-				case "theme" -> settings.theme().set(parseUiTheme(in.nextString()));
-				case "uiOrientation" -> settings.userInterfaceOrientation().set(parseUiOrientation(in.nextString()));
-				case "keychainProvider" -> settings.keychainProvider().set(in.nextString());
-				case "useKeychain" -> settings.useKeychain().set(in.nextBoolean());
-				case "licenseKey" -> settings.licenseKey().set(in.nextString());
-				case "showMinimizeButton" -> settings.showMinimizeButton().set(in.nextBoolean());
-				case "showTrayIcon" -> settings.showTrayIcon().set(in.nextBoolean());
-				case "windowXPosition" -> settings.windowXPositionProperty().set(in.nextInt());
-				case "windowYPosition" -> settings.windowYPositionProperty().set(in.nextInt());
-				case "windowWidth" -> settings.windowWidthProperty().set(in.nextInt());
-				case "windowHeight" -> settings.windowHeightProperty().set(in.nextInt());
 				case "displayConfiguration" -> settings.displayConfigurationProperty().set(in.nextString());
+				case "keychainProvider" -> settings.keychainProvider().set(in.nextString());
 				case "language" -> settings.languageProperty().set(in.nextString());
+				case "licenseKey" -> settings.licenseKey().set(in.nextString());
 				case "mountService" -> {
 					var token = in.peek();
 					if (JsonToken.STRING == token) {
 						settings.mountService().set(in.nextString());
 					}
 				}
-
+				case "numTrayNotifications" -> settings.numTrayNotifications().set(in.nextInt());
+				case "port" -> settings.port().set(in.nextInt());
+				case "showMinimizeButton" -> settings.showMinimizeButton().set(in.nextBoolean());
+				case "showTrayIcon" -> settings.showTrayIcon().set(in.nextBoolean());
+				case "startHidden" -> settings.startHidden().set(in.nextBoolean());
+				case "theme" -> settings.theme().set(parseUiTheme(in.nextString()));
+				case "uiOrientation" -> settings.userInterfaceOrientation().set(parseUiOrientation(in.nextString()));
+				case "useKeychain" -> settings.useKeychain().set(in.nextBoolean());
+				case "windowHeight" -> settings.windowHeightProperty().set(in.nextInt());
+				case "windowWidth" -> settings.windowWidthProperty().set(in.nextInt());
+				case "windowXPosition" -> settings.windowXPositionProperty().set(in.nextInt());
+				case "windowYPosition" -> settings.windowYPositionProperty().set(in.nextInt());
+				//1.6.x legacy
+				case "preferredVolumeImpl" -> volumeImpl = in.nextString();
+				//legacy end
 				default -> {
 					LOG.warn("Unsupported vault setting found in JSON: {}", name);
 					in.skipValue();
 				}
 			}
+
 		}
 		in.endObject();
 
+		//1.6.x legacy
+		if (volumeImpl != null) {
+			settings.mountService().set(convertLegacyVolumeImplToMountService(volumeImpl));
+		}
+		//legacy end
+
 		return settings;
 	}
 
+	private String convertLegacyVolumeImplToMountService(String volumeImpl) {
+		if (volumeImpl.equals("Dokany")) {
+			return "org.cryptomator.frontend.dokany.mount.DokanyMountProvider";
+		} else if (volumeImpl.equals("FUSE")) {
+			if (SystemUtils.IS_OS_WINDOWS) {
+				return "org.cryptomator.frontend.fuse.mount.WinFspNetworkMountProvider";
+			} else if (SystemUtils.IS_OS_MAC) {
+				return "org.cryptomator.frontend.fuse.mount.MacFuseMountProvider";
+			} else {
+				return "org.cryptomator.frontend.fuse.mount.LinuxFuseMountProvider";
+			}
+		} else {
+			if (SystemUtils.IS_OS_WINDOWS) {
+				return "org.cryptomator.frontend.webdav.mount.WindowsMounter";
+			} else if (SystemUtils.IS_OS_MAC) {
+				return "org.cryptomator.frontend.webdav.mount.MacAppleScriptMounter";
+			} else {
+				return "org.cryptomator.frontend.webdav.mount.LinuxGioMounter";
+			}
+		}
+	}
+
 	private UiTheme parseUiTheme(String uiThemeName) {
 		try {
 			return UiTheme.valueOf(uiThemeName.toUpperCase());

src/main/java/org/cryptomator/common/settings/VaultSettings.java

@@ -45,7 +45,7 @@ public class VaultSettings {
 	private final BooleanProperty unlockAfterStartup = new SimpleBooleanProperty(DEFAULT_UNLOCK_AFTER_STARTUP);
 	private final BooleanProperty revealAfterMount = new SimpleBooleanProperty(DEFAULT_REVEAL_AFTER_MOUNT);
 	private final BooleanProperty usesReadOnlyMode = new SimpleBooleanProperty(DEFAULT_USES_READONLY_MODE);
-	private final StringProperty mountFlags = new SimpleStringProperty(DEFAULT_MOUNT_FLAGS);
+	private final StringProperty mountFlags = new SimpleStringProperty(DEFAULT_MOUNT_FLAGS); //TODO: remove empty default mount flags and let this property be null if not used
 	private final IntegerProperty maxCleartextFilenameLength = new SimpleIntegerProperty(DEFAULT_MAX_CLEARTEXT_FILENAME_LENGTH);
 	private final ObjectProperty<WhenUnlocked> actionAfterUnlock = new SimpleObjectProperty<>(DEFAULT_ACTION_AFTER_UNLOCK);
 	private final BooleanProperty autoLockWhenIdle = new SimpleBooleanProperty(DEFAULT_AUTOLOCK_WHEN_IDLE);

src/main/java/org/cryptomator/common/settings/VaultSettingsJsonAdapter.java

@@ -38,8 +38,6 @@ class VaultSettingsJsonAdapter {
 		out.endObject();
 	}
 
-	//TODO: usesCustomMountPath, customMountPath and winDriveLetter removed
-	//	-> migration required
 	public VaultSettings read(JsonReader in) throws IOException {
 		String id = null;
 		String path = null;
@@ -55,6 +53,12 @@ class VaultSettingsJsonAdapter {
 		boolean autoLockWhenIdle = VaultSettings.DEFAULT_AUTOLOCK_WHEN_IDLE;
 		int autoLockIdleSeconds = VaultSettings.DEFAULT_AUTOLOCK_IDLE_SECONDS;
 
+		//legacy from 1.6.x
+		boolean useCustomMountPath = false;
+		String customMountPath = "";
+		String winDriveLetter = "";
+		//legacy end
+
 		in.beginObject();
 		while (in.hasNext()) {
 			String name = in.nextName();
@@ -78,6 +82,11 @@ class VaultSettingsJsonAdapter {
 				case "actionAfterUnlock" -> actionAfterUnlock = parseActionAfterUnlock(in.nextString());
 				case "autoLockWhenIdle" -> autoLockWhenIdle = in.nextBoolean();
 				case "autoLockIdleSeconds" -> autoLockIdleSeconds = in.nextInt();
+				//legacy from 1.6.x
+				case "winDriveLetter" -> winDriveLetter = in.nextString();
+				case "usesIndividualMountPath", "useCustomMountPath" -> useCustomMountPath = in.nextBoolean();
+				case "individualMountPath", "customMountPath" -> customMountPath = in.nextString();
+				//legacy end
 				default -> {
 					LOG.warn("Unsupported vault setting found in JSON: {}", name);
 					in.skipValue();
@@ -102,6 +111,13 @@ class VaultSettingsJsonAdapter {
 		vaultSettings.autoLockWhenIdle().set(autoLockWhenIdle);
 		vaultSettings.autoLockIdleSeconds().set(autoLockIdleSeconds);
 		vaultSettings.mountPoint().set(mountPoint);
+		//legacy from 1.6.x
+		if(useCustomMountPath && !customMountPath.isBlank()) {
+			vaultSettings.mountPoint().set(parseMountPoint(customMountPath));
+		} else if(!winDriveLetter.isBlank() ) {
+			vaultSettings.mountPoint().set(parseMountPoint(winDriveLetter+":\\"));
+		}
+		//legacy end
 		return vaultSettings;
 	}
 

src/main/java/org/cryptomator/common/settings/VolumeImpl.java

@@ -1,18 +0,0 @@
-package org.cryptomator.common.settings;
-
-public enum VolumeImpl {
-	WEBDAV("WebDAV"),
-	FUSE("FUSE"),
-	DOKANY("Dokany");
-
-	private String displayName;
-
-	VolumeImpl(String displayName) {
-		this.displayName = displayName;
-	}
-
-	public String getDisplayName() {
-		return displayName;
-	}
-
-}

src/main/java/org/cryptomator/common/vaults/AutoLocker.java

@@ -6,6 +6,7 @@ import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javax.inject.Singleton;
+import javafx.application.Platform;
 import javafx.collections.ObservableList;
 import java.io.IOException;
 import java.time.Instant;
@@ -40,6 +41,7 @@ public class AutoLocker {
 	private void autolock(Vault vault) {
 		try {
 			vault.lock(false);
+			Platform.runLater(() -> vault.stateProperty().set(VaultState.Value.LOCKED));
 			LOG.info("Autolocked {} after idle timeout", vault.getDisplayName());
 		} catch (UnmountFailedException | IOException e) {
 			LOG.error("Autolocking failed.", e);

src/main/java/org/cryptomator/common/vaults/Vault.java

@@ -8,12 +8,10 @@
  *******************************************************************************/
 package org.cryptomator.common.vaults;
 
-import com.google.common.base.Strings;
 import org.apache.commons.lang3.SystemUtils;
 import org.cryptomator.common.Constants;
-import org.cryptomator.common.Environment;
+import org.cryptomator.common.mount.Mounter;
 import org.cryptomator.common.mount.WindowsDriveLetters;
-import org.cryptomator.common.settings.Settings;
 import org.cryptomator.common.settings.VaultSettings;
 import org.cryptomator.cryptofs.CryptoFileSystem;
 import org.cryptomator.cryptofs.CryptoFileSystemProperties;
@@ -23,11 +21,7 @@ import org.cryptomator.cryptofs.common.FileSystemCapabilityChecker;
 import org.cryptomator.cryptolib.api.CryptoException;
 import org.cryptomator.cryptolib.api.MasterkeyLoader;
 import org.cryptomator.cryptolib.api.MasterkeyLoadingFailedException;
-import org.cryptomator.integrations.mount.Mount;
-import org.cryptomator.integrations.mount.MountBuilder;
-import org.cryptomator.integrations.mount.MountCapability;
 import org.cryptomator.integrations.mount.MountFailedException;
-import org.cryptomator.integrations.mount.MountService;
 import org.cryptomator.integrations.mount.Mountpoint;
 import org.cryptomator.integrations.mount.UnmountFailedException;
 import org.slf4j.Logger;
@@ -44,9 +38,7 @@ import javafx.beans.property.BooleanProperty;
 import javafx.beans.property.ObjectProperty;
 import javafx.beans.property.ReadOnlyStringProperty;
 import javafx.beans.property.SimpleBooleanProperty;
-import javafx.beans.value.ObservableValue;
 import java.io.IOException;
-import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.EnumSet;
@@ -54,11 +46,6 @@ import java.util.Objects;
 import java.util.Set;
 import java.util.concurrent.atomic.AtomicReference;
 
-import static org.cryptomator.integrations.mount.MountCapability.MOUNT_AS_DRIVE_LETTER;
-import static org.cryptomator.integrations.mount.MountCapability.MOUNT_TO_EXISTING_DIR;
-import static org.cryptomator.integrations.mount.MountCapability.MOUNT_TO_SYSTEM_CHOSEN_PATH;
-import static org.cryptomator.integrations.mount.MountCapability.MOUNT_WITHIN_EXISTING_PARENT;
-
 @PerVault
 public class Vault {
 
@@ -66,14 +53,10 @@ public class Vault {
 	private static final Path HOME_DIR = Paths.get(SystemUtils.USER_HOME);
 	private static final int UNLIMITED_FILENAME_LENGTH = Integer.MAX_VALUE;
 
-	private final Environment env;
-	private final Settings settings;
 	private final VaultSettings vaultSettings;
 	private final AtomicReference<CryptoFileSystem> cryptoFileSystem;
 	private final VaultState state;
 	private final ObjectProperty<Exception> lastKnownException;
-	private final ObservableValue<MountService> mountService;
-	private final ObservableValue<String> defaultMountFlags;
 	private final VaultConfigCache configCache;
 	private final VaultStats stats;
 	private final StringBinding displayablePath;
@@ -84,22 +67,18 @@ public class Vault {
 	private final BooleanBinding needsMigration;
 	private final BooleanBinding unknownError;
 	private final ObjectBinding<Mountpoint> mountPoint;
-	private final WindowsDriveLetters windowsDriveLetters;
+	private final Mounter mounter;
 	private final BooleanProperty showingStats;
 
-	private AtomicReference<MountHandle> mountHandle = new AtomicReference<>(null);
+	private AtomicReference<Mounter.MountHandle> mountHandle = new AtomicReference<>(null);
 
 	@Inject
-	Vault(Environment env, Settings settings, VaultSettings vaultSettings, VaultConfigCache configCache, AtomicReference<CryptoFileSystem> cryptoFileSystem, VaultState state, @Named("lastKnownException") ObjectProperty<Exception> lastKnownException, ObservableValue<MountService> mountService, VaultStats stats, WindowsDriveLetters windowsDriveLetters) {
-		this.env = env;
-		this.settings = settings;
+	Vault(VaultSettings vaultSettings, VaultConfigCache configCache, AtomicReference<CryptoFileSystem> cryptoFileSystem, VaultState state, @Named("lastKnownException") ObjectProperty<Exception> lastKnownException, VaultStats stats, WindowsDriveLetters windowsDriveLetters, Mounter mounter) {
 		this.vaultSettings = vaultSettings;
 		this.configCache = configCache;
 		this.cryptoFileSystem = cryptoFileSystem;
 		this.state = state;
 		this.lastKnownException = lastKnownException;
-		this.mountService = mountService;
-		this.defaultMountFlags = mountService.map(MountService::getDefaultMountFlags);
 		this.stats = stats;
 		this.displayablePath = Bindings.createStringBinding(this::getDisplayablePath, vaultSettings.path());
 		this.locked = Bindings.createBooleanBinding(this::isLocked, state);
@@ -109,7 +88,7 @@ public class Vault {
 		this.needsMigration = Bindings.createBooleanBinding(this::isNeedsMigration, state);
 		this.unknownError = Bindings.createBooleanBinding(this::isUnknownError, state);
 		this.mountPoint = Bindings.createObjectBinding(this::getMountPoint, state);
-		this.windowsDriveLetters = windowsDriveLetters;
+		this.mounter = mounter;
 		this.showingStats = new SimpleBooleanProperty(false);
 	}
 
@@ -159,45 +138,6 @@ public class Vault {
 		}
 	}
 
-	private MountBuilder prepareMount(Path cryptoRoot) throws IOException {
-		var mountProvider = mountService.getValue();
-		var builder = mountProvider.forFileSystem(cryptoRoot);
-
-		for (var capability : mountProvider.capabilities()) {
-			switch (capability) {
-				case FILE_SYSTEM_NAME -> builder.setFileSystemName("crypto");
-				case LOOPBACK_PORT -> builder.setLoopbackPort(settings.port().get()); //TODO: move port from settings to vaultsettings?
-				case LOOPBACK_HOST_NAME -> builder.setLoopbackHostName("cryptomator-vault"); //TODO: Read from system property
-				case READ_ONLY -> builder.setReadOnly(vaultSettings.usesReadOnlyMode().get());
-				case MOUNT_FLAGS -> builder.setMountFlags(defaultMountFlags.getValue()); // TODO use custom mount flags (pre-populated with default mount flags)
-				case VOLUME_ID -> builder.setVolumeId(vaultSettings.getId());
-				case VOLUME_NAME -> builder.setVolumeName(vaultSettings.mountName().get());
-			}
-		}
-
-		var userChosenMountPoint = vaultSettings.getMountPoint();
-		var defaultMountPointBase = env.getMountPointsDir().orElseThrow();
-		if (userChosenMountPoint == null) {
-			if (mountProvider.hasCapability(MOUNT_TO_SYSTEM_CHOSEN_PATH)) {
-				// no need to set a mount point
-			} else if (mountProvider.hasCapability(MOUNT_AS_DRIVE_LETTER)) {
-				builder.setMountpoint(windowsDriveLetters.getFirstDesiredAvailable().orElseThrow());
-			} else if (mountProvider.hasCapability(MOUNT_WITHIN_EXISTING_PARENT)) {
-				Files.createDirectories(defaultMountPointBase);
-				builder.setMountpoint(defaultMountPointBase);
-			} else if (mountProvider.hasCapability(MOUNT_TO_EXISTING_DIR) ) {
-				var mountPoint = defaultMountPointBase.resolve(vaultSettings.mountName().get());
-				Files.createDirectories(mountPoint);
-				builder.setMountpoint(mountPoint);
-			}
-		} else if (mountProvider.hasCapability(MOUNT_TO_EXISTING_DIR) || mountProvider.hasCapability(MOUNT_WITHIN_EXISTING_PARENT) || mountProvider.hasCapability(MOUNT_AS_DRIVE_LETTER)) {
-			// TODO: move the mount point away in case of MOUNT_WITHIN_EXISTING_PARENT?
-			builder.setMountpoint(userChosenMountPoint);
-		}
-
-		return builder;
-	}
-
 	public synchronized void unlock(MasterkeyLoader keyLoader) throws CryptoException, IOException, MountFailedException {
 		if (cryptoFileSystem.get() != null) {
 			throw new IllegalStateException("Already unlocked.");
@@ -207,8 +147,7 @@ public class Vault {
 		try {
 			cryptoFileSystem.set(fs);
 			var rootPath = fs.getRootDirectories().iterator().next();
-			var supportsForcedUnmount = mountService.getValue().hasCapability(MountCapability.UNMOUNT_FORCED);
-			var mountHandle = new MountHandle(prepareMount(rootPath).mount(), supportsForcedUnmount);
+			var mountHandle = mounter.mount(vaultSettings, rootPath);
 			success = this.mountHandle.compareAndSet(null, mountHandle);
 		} finally {
 			if (!success) {
@@ -217,7 +156,6 @@ public class Vault {
 		}
 	}
 
-
 	public synchronized void lock(boolean forced) throws UnmountFailedException, IOException {
 		var mountHandle = this.mountHandle.get();
 		if (mountHandle == null) {
@@ -225,14 +163,15 @@ public class Vault {
 			return;
 		}
 
-		if (forced && mountHandle.supportsUnmountForced) {
-			mountHandle.mount.unmountForced();
+		if (forced && mountHandle.supportsUnmountForced()) {
+			mountHandle.mountObj().unmountForced();
 		} else {
-			mountHandle.mount.unmount();
+			mountHandle.mountObj().unmount();
 		}
 
 		try {
-			mountHandle.mount.close();
+			mountHandle.mountObj().close();
+			mountHandle.specialCleanup().run();
 		} finally {
 			destroyCryptoFileSystem();
 		}
@@ -327,7 +266,7 @@ public class Vault {
 
 	public Mountpoint getMountPoint() {
 		var handle = mountHandle.get();
-		return handle == null ? null : handle.mount.getMountpoint();
+		return handle == null ? null : handle.mountObj().getMountpoint();
 	}
 
 	public StringBinding displayablePathProperty() {
@@ -375,24 +314,30 @@ public class Vault {
 		return vaultSettings.path().getValue();
 	}
 
-	public boolean isHavingCustomMountFlags() {
-		return !Strings.isNullOrEmpty(vaultSettings.mountFlags().get());
-	}
+	/**
+	 * Gets from the cleartext path its ciphertext counterpart.
+	 *
+	 * @return Local os path to the ciphertext resource
+	 * @throws IOException if an I/O error occurs
+	 * @throws IllegalStateException if the vault is not unlocked
+	 */
+	public Path getCiphertextPath(Path cleartextPath) throws IOException {
+		if (!state.getValue().equals(VaultState.Value.UNLOCKED)) {
+			throw new IllegalStateException("Vault is not unlocked");
+		}
+		var fs = cryptoFileSystem.get();
+		var osPathSeparator = cleartextPath.getFileSystem().getSeparator();
+		var cryptoFsPathSeparator = fs.getSeparator();
 
-	public ObservableValue<String> defaultMountFlagsProperty() {
-		return defaultMountFlags;
-	}
-
-	public String getDefaultMountFlags() {
-		return defaultMountFlags.getValue();
-	}
-
-	public String getEffectiveMountFlags() {
-		String mountFlags = vaultSettings.mountFlags().get();
-		if (Strings.isNullOrEmpty(mountFlags)) {
-			return ""; //TODO: should the provider provide dem defaults??
+		if (getMountPoint() instanceof Mountpoint.WithPath mp) {
+			var absoluteCryptoFsPath = cryptoFsPathSeparator + mp.path().relativize(cleartextPath).toString();
+			if (!cryptoFsPathSeparator.equals(osPathSeparator)) {
+				absoluteCryptoFsPath = absoluteCryptoFsPath.replace(osPathSeparator, cryptoFsPathSeparator);
+			}
+			var cryptoPath = fs.getPath(absoluteCryptoFsPath);
+			return fs.getCiphertextPath(cryptoPath);
 		} else {
-			return mountFlags;
+			throw new UnsupportedOperationException("URI mount points not supported.");
 		}
 	}
 
@@ -400,10 +345,6 @@ public class Vault {
 		return configCache;
 	}
 
-	public void setCustomMountFlags(String mountFlags) {
-		vaultSettings.mountFlags().set(mountFlags);
-	}
-
 	public String getId() {
 		return vaultSettings.getId();
 	}
@@ -426,15 +367,12 @@ public class Vault {
 		}
 	}
 
-
-	/* TODO: reactivate/ needed at all?
 	public boolean supportsForcedUnmount() {
-		return volume.supportsForcedUnmount();
+		var mh = mountHandle.get();
+		if (mh == null) {
+			throw new IllegalStateException("Vault is not mounted");
+		}
+		return mountHandle.get().supportsUnmountForced();
 	}
 
-	 */
-
-	private record MountHandle(Mount mount, boolean supportsUnmountForced) {
-
-	}
 }

src/main/java/org/cryptomator/common/vaults/VaultStats.java

@@ -41,6 +41,8 @@ public class VaultStats {
 	private final LongProperty totalBytesDecrypted = new SimpleLongProperty();
 	private final LongProperty filesRead = new SimpleLongProperty();
 	private final LongProperty filesWritten = new SimpleLongProperty();
+	private final LongProperty filesAccessed = new SimpleLongProperty();
+	private final LongProperty totalFilesAccessed = new SimpleLongProperty();
 	private final ObjectProperty<Instant> lastActivity = new SimpleObjectProperty<>();
 
 	@Inject
@@ -82,6 +84,8 @@ public class VaultStats {
 		var oldAccessCount = filesRead.get() + filesWritten.get();
 		filesRead.set(stats.map(CryptoFileSystemStats::pollAmountOfAccessesRead).orElse(0L));
 		filesWritten.set(stats.map(CryptoFileSystemStats::pollAmountOfAccessesWritten).orElse(0L));
+		filesAccessed.set(stats.map(CryptoFileSystemStats::pollAmountOfAccesses).orElse(0L));
+		totalFilesAccessed.set(stats.map(CryptoFileSystemStats::pollTotalAmountOfAccesses).orElse(0L));
 		var newAccessCount = filesRead.get() + filesWritten.get();
 
 		// check for any I/O activity
@@ -188,6 +192,19 @@ public class VaultStats {
 
 	public long getFilesWritten() {return filesWritten.get();}
 
+	public LongProperty filesAccessed() {
+		return filesAccessed;}
+
+	public long getFilesAccessed() {return filesAccessed.get();}
+
+	public LongProperty totalFilesAccessed(){
+		return totalFilesAccessed;
+	}
+
+	public long getTotalFilesAccessed(){
+		return totalFilesAccessed.get();
+	}
+
 	public ObjectProperty<Instant> lastActivityProperty() {
 		return lastActivity;
 	}

src/main/java/org/cryptomator/logging/LogbackConfigurator.java

@@ -84,6 +84,10 @@ public class LogbackConfigurator extends ContextAwareBase implements Configurato
 			upgrades.addAppender(upgrade);
 			upgrades.addAppender(file);
 			upgrades.setAdditive(false);
+
+			// configure fuse file locking logger:
+			Logger fuseLocking = context.getLogger("org.cryptomator.frontend.fuse.locks");
+			fuseLocking.setLevel(Level.OFF);
 		}
 		return ExecutionStatus.DO_NOT_INVOKE_NEXT_IF_ANY;
 	}

src/main/java/org/cryptomator/ui/addvaultwizard/ChooseExistingVaultController.java

@@ -2,19 +2,20 @@ package org.cryptomator.ui.addvaultwizard;
 
 import dagger.Lazy;
 import org.apache.commons.lang3.SystemUtils;
-import org.cryptomator.common.settings.Settings;
-import org.cryptomator.common.settings.UiTheme;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.common.vaults.VaultListManager;
+import org.cryptomator.integrations.uiappearance.Theme;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxmlFile;
 import org.cryptomator.ui.common.FxmlScene;
+import org.cryptomator.ui.fxapp.FxApplicationStyle;
 import org.cryptomator.ui.fxapp.FxApplicationWindows;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javafx.beans.property.ObjectProperty;
+import javafx.beans.value.ObservableValue;
 import javafx.fxml.FXML;
 import javafx.scene.Scene;
 import javafx.scene.image.Image;
@@ -23,6 +24,7 @@ import javafx.stage.Stage;
 import java.io.File;
 import java.io.IOException;
 import java.nio.file.Path;
+import java.util.Objects;
 import java.util.ResourceBundle;
 
 import static org.cryptomator.common.Constants.CRYPTOMATOR_FILENAME_GLOB;
@@ -40,12 +42,10 @@ public class ChooseExistingVaultController implements FxController {
 	private final ObjectProperty<Vault> vault;
 	private final VaultListManager vaultListManager;
 	private final ResourceBundle resourceBundle;
-	private final Settings settings;
-
-	private Image screenshot;
+	private final ObservableValue<Image> screenshot;
 
 	@Inject
-	ChooseExistingVaultController(@AddVaultWizardWindow Stage window, @FxmlScene(FxmlFile.ADDVAULT_WELCOME) Lazy<Scene> welcomeScene, @FxmlScene(FxmlFile.ADDVAULT_SUCCESS) Lazy<Scene> successScene, FxApplicationWindows appWindows, ObjectProperty<Path> vaultPath, @AddVaultWizardWindow ObjectProperty<Vault> vault, VaultListManager vaultListManager, ResourceBundle resourceBundle, Settings settings) {
+	ChooseExistingVaultController(@AddVaultWizardWindow Stage window, @FxmlScene(FxmlFile.ADDVAULT_WELCOME) Lazy<Scene> welcomeScene, @FxmlScene(FxmlFile.ADDVAULT_SUCCESS) Lazy<Scene> successScene, FxApplicationWindows appWindows, ObjectProperty<Path> vaultPath, @AddVaultWizardWindow ObjectProperty<Vault> vault, VaultListManager vaultListManager, ResourceBundle resourceBundle, FxApplicationStyle applicationStyle) {
 		this.window = window;
 		this.welcomeScene = welcomeScene;
 		this.successScene = successScene;
@@ -54,16 +54,20 @@ public class ChooseExistingVaultController implements FxController {
 		this.vault = vault;
 		this.vaultListManager = vaultListManager;
 		this.resourceBundle = resourceBundle;
-		this.settings = settings;
+		this.screenshot = applicationStyle.appliedThemeProperty().map(this::selectScreenshot);
 	}
 
-	@FXML
-	public void initialize() {
+	private Image selectScreenshot(Theme theme) {
+		String imageResourcePath;
 		if (SystemUtils.IS_OS_MAC) {
-			this.screenshot = new Image(getClass().getResource("/img/select-masterkey-mac"+(UiTheme.LIGHT == settings.theme().get()? "":"-dark")+".png").toString());
+			imageResourcePath = switch (theme) {
+				case LIGHT -> "/img/select-masterkey-mac.png";
+				case DARK -> "/img/select-masterkey-mac-dark.png";
+			};
 		} else {
-			this.screenshot = new Image(getClass().getResource("/img/select-masterkey-win.png").toString());
+			imageResourcePath = "/img/select-masterkey-win.png";
 		}
+		return new Image((Objects.requireNonNull(getClass().getResource(imageResourcePath)).toString()));
 	}
 
 	@FXML
@@ -92,8 +96,13 @@ public class ChooseExistingVaultController implements FxController {
 
 	/* Getter */
 
-	public Image getScreenshot() {
+	public ObservableValue<Image> screenshotProperty() {
 		return screenshot;
 	}
 
+	public Image getScreenshot() {
+		return screenshot.getValue();
+	}
+
+
 }

src/main/java/org/cryptomator/ui/addvaultwizard/CreateNewVaultPasswordController.java

@@ -176,7 +176,7 @@ public class CreateNewVaultPasswordController implements FxController {
 			// 2. initialize vault:
 			try {
 				MasterkeyLoader loader = ignored -> masterkey.copy();
-				CryptoFileSystemProperties fsProps = CryptoFileSystemProperties.cryptoFileSystemProperties().withCipherCombo(CryptorProvider.Scheme.SIV_CTRMAC).withKeyLoader(loader).build();
+				CryptoFileSystemProperties fsProps = CryptoFileSystemProperties.cryptoFileSystemProperties().withCipherCombo(CryptorProvider.Scheme.SIV_GCM).withKeyLoader(loader).build();
 				CryptoFileSystemProvider.initialize(path, fsProps, DEFAULT_KEY_ID);
 
 				// 3. write vault-internal readme file:

src/main/java/org/cryptomator/ui/common/ErrorController.java

@@ -29,9 +29,13 @@ public class ErrorController implements FxController {
 			OS: %s / %s
 			App: %s / %s
 			
-			<!-- ✏️ Please describe what happened as accurately as possible. -->
+			<!-- ✏ Please describe what happened as accurately as possible. -->
 			
 			<!-- 📋 Please also copy and paste the detail text from the error window. -->
+			
+			<!-- ℹ Text enclosed like this (chevrons, exclamation mark, two dashes) is not visible to others! -->
+			
+			<!-- ❗ If the description or the detail text is missing, the discussion will be deleted. -->
 			""";
 
 	private final Application application;

src/main/java/org/cryptomator/ui/common/FxmlFile.java

@@ -13,8 +13,9 @@ public enum FxmlFile {
 	FORGET_PASSWORD("/fxml/forget_password.fxml"), //
 	HEALTH_START("/fxml/health_start.fxml"), //
 	HEALTH_CHECK_LIST("/fxml/health_check_list.fxml"), //
+	HUB_NO_KEYCHAIN("/fxml/hub_no_keychain.fxml"), //
 	HUB_AUTH_FLOW("/fxml/hub_auth_flow.fxml"), //
-	HUB_LICENSE_EXCEEDED("/fxml/hub_license_exceeded.fxml"), //
+	HUB_INVALID_LICENSE("/fxml/hub_invalid_license.fxml"), //
 	HUB_RECEIVE_KEY("/fxml/hub_receive_key.fxml"), //
 	HUB_REGISTER_DEVICE("/fxml/hub_register_device.fxml"), //
 	HUB_REGISTER_SUCCESS("/fxml/hub_register_success.fxml"), //

src/main/java/org/cryptomator/ui/controls/FontAwesome5Icon.java

@@ -25,8 +25,10 @@ public enum FontAwesome5Icon {
 	EYE_SLASH("\uF070"), //
 	FAST_FORWARD("\uF050"), //
 	FILE("\uF15B"), //
+	FILE_DOWNLOAD("\uF56D"), //
 	FILE_IMPORT("\uF56F"), //
 	FOLDER_OPEN("\uF07C"), //
+	FUNNEL("\uF0B0"), //
 	HAND_HOLDING_HEART("\uF4BE"), //
 	HEART("\uF004"), //
 	HDD("\uF0A0"), //
@@ -40,6 +42,7 @@ public enum FontAwesome5Icon {
 	PLUS("\uF067"), //
 	PRINT("\uF02F"), //
 	QUESTION("\uF128"), //
+	QUESTION_CIRCLE("\uf059"), //
 	REDO("\uF01E"), //
 	SEARCH("\uF002"), //
 	SPINNER("\uF110"), //

src/main/java/org/cryptomator/ui/fxapp/FxApplicationStyle.java

@@ -12,6 +12,8 @@ import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javafx.application.Application;
+import javafx.beans.property.ObjectProperty;
+import javafx.beans.property.SimpleObjectProperty;
 import javafx.beans.value.ObservableValue;
 import java.util.Optional;
 
@@ -24,9 +26,10 @@ public class FxApplicationStyle {
 	private final Optional<UiAppearanceProvider> appearanceProvider;
 	private final LicenseHolder licenseHolder;
 	private final UiAppearanceListener systemInterfaceThemeListener = this::systemInterfaceThemeChanged;
+	private final ObjectProperty<Theme> appliedTheme = new SimpleObjectProperty<>(Theme.LIGHT);
 
 	@Inject
-	public FxApplicationStyle(Settings settings, Optional<UiAppearanceProvider> appearanceProvider, LicenseHolder licenseHolder){
+	public FxApplicationStyle(Settings settings, Optional<UiAppearanceProvider> appearanceProvider, LicenseHolder licenseHolder) {
 		this.settings = settings;
 		this.appearanceProvider = appearanceProvider;
 		this.licenseHolder = licenseHolder;
@@ -91,6 +94,7 @@ public class FxApplicationStyle {
 		} else {
 			Application.setUserAgentStylesheet(stylesheet.toString());
 			appearanceProvider.ifPresent(provider -> provider.adjustToTheme(Theme.LIGHT));
+			appliedTheme.set(Theme.LIGHT);
 		}
 	}
 
@@ -103,6 +107,11 @@ public class FxApplicationStyle {
 		} else {
 			Application.setUserAgentStylesheet(stylesheet.toString());
 			appearanceProvider.ifPresent(provider -> provider.adjustToTheme(Theme.DARK));
+			appliedTheme.set(Theme.DARK);
 		}
 	}
+
+	public ObjectProperty<Theme> appliedThemeProperty() {
+		return appliedTheme;
+	}
 }

src/main/java/org/cryptomator/ui/health/CheckDetailController.java

@@ -8,15 +8,34 @@ import org.cryptomator.ui.common.FxController;
 
 import javax.inject.Inject;
 import javafx.beans.binding.Binding;
+import javafx.beans.binding.Bindings;
+import javafx.beans.binding.BooleanBinding;
 import javafx.beans.binding.BooleanExpression;
+import javafx.beans.property.BooleanProperty;
 import javafx.beans.property.ObjectProperty;
+import javafx.beans.property.SimpleBooleanProperty;
+import javafx.beans.property.SimpleObjectProperty;
 import javafx.beans.value.ObservableValue;
 import javafx.collections.FXCollections;
 import javafx.fxml.FXML;
+import javafx.scene.control.ChoiceBox;
 import javafx.scene.control.ListView;
+import javafx.scene.input.Clipboard;
+import javafx.scene.input.ClipboardContent;
+import javafx.util.StringConverter;
+import java.util.Arrays;
+import java.util.ResourceBundle;
 import java.util.function.Function;
+import java.util.function.Predicate;
 import java.util.stream.Stream;
 
+import static org.cryptomator.cryptofs.health.api.DiagnosticResult.Severity;
+import static org.cryptomator.ui.health.Result.FixState.FIXABLE;
+import static org.cryptomator.ui.health.Result.FixState.FIXED;
+import static org.cryptomator.ui.health.Result.FixState.FIXING;
+import static org.cryptomator.ui.health.Result.FixState.FIX_FAILED;
+import static org.cryptomator.ui.health.Result.FixState.NOT_FIXABLE;
+
 @HealthCheckScoped
 public class CheckDetailController implements FxController {
 
@@ -35,30 +54,48 @@ public class CheckDetailController implements FxController {
 	private final Binding<Number> countOfCritSeverity;
 	private final Binding<Boolean> warnOrCritsExist;
 	private final ResultListCellFactory resultListCellFactory;
+	private final ResultFixApplier resultFixApplier;
+	private final ResourceBundle resourceBundle;
+
+	private final BooleanProperty fixAllInfoResultsExecuted;
+	private final BooleanBinding fixAllInfoResultsPossible;
+	private final ObjectProperty<Predicate<Result>> resultsFilter;
 
 	public ListView<Result> resultsListView;
+	public ChoiceBox<DiagnosticResult.Severity> severityChoiceBox;
+	public ChoiceBox<Result.FixState> fixStateChoiceBox;
 	private Subscription resultSubscription;
 
 	@Inject
-	public CheckDetailController(ObjectProperty<Check> selectedTask, ResultListCellFactory resultListCellFactory) {
+	public CheckDetailController(ObjectProperty<Check> selectedTask, ResultListCellFactory resultListCellFactory, ResultFixApplier resultFixApplier, ResourceBundle resourceBundle) {
 		this.resultListCellFactory = resultListCellFactory;
+		this.resultFixApplier = resultFixApplier;
+		this.resourceBundle = resourceBundle;
 		this.results = EasyBind.wrapList(FXCollections.observableArrayList());
 		this.check = selectedTask;
 		this.checkState = selectedTask.flatMap(Check::stateProperty);
 		this.checkName = selectedTask.map(Check::getName).orElse("");
 		this.checkRunning = BooleanExpression.booleanExpression(checkState.map(Check.CheckState.RUNNING::equals).orElse(false));
 		this.checkScheduled = BooleanExpression.booleanExpression(checkState.map(Check.CheckState.SCHEDULED::equals).orElse(false));
-		this.checkSkipped =BooleanExpression.booleanExpression(checkState.map(Check.CheckState.SKIPPED::equals).orElse(false));
+		this.checkSkipped = BooleanExpression.booleanExpression(checkState.map(Check.CheckState.SKIPPED::equals).orElse(false));
 		this.checkSucceeded = BooleanExpression.booleanExpression(checkState.map(Check.CheckState.SUCCEEDED::equals).orElse(false));
 		this.checkFailed = BooleanExpression.booleanExpression(checkState.map(Check.CheckState.ERROR::equals).orElse(false));
 		this.checkCancelled = BooleanExpression.booleanExpression(checkState.map(Check.CheckState.CANCELLED::equals).orElse(false));
 		this.checkFinished = checkSucceeded.or(checkFailed).or(checkCancelled);
-		this.countOfWarnSeverity = results.reduce(countSeverity(DiagnosticResult.Severity.WARN));
-		this.countOfCritSeverity = results.reduce(countSeverity(DiagnosticResult.Severity.CRITICAL));
-		this.warnOrCritsExist = EasyBind.combine(checkSucceeded, countOfWarnSeverity, countOfCritSeverity, (suceeded, warns, crits) -> suceeded && (warns.longValue() > 0 || crits.longValue() > 0) );
+		this.countOfWarnSeverity = results.reduce(countSeverity(Severity.WARN));
+		this.countOfCritSeverity = results.reduce(countSeverity(Severity.CRITICAL));
+		this.warnOrCritsExist = EasyBind.combine(checkSucceeded, countOfWarnSeverity, countOfCritSeverity, (suceeded, warns, crits) -> suceeded && (warns.longValue() > 0 || crits.longValue() > 0));
+		this.fixAllInfoResultsExecuted = new SimpleBooleanProperty(false);
+		this.fixAllInfoResultsPossible = Bindings.createBooleanBinding(() -> results.stream().anyMatch(this::isFixableInfoResult), results) //
+				.and(fixAllInfoResultsExecuted.not());
+		this.resultsFilter = new SimpleObjectProperty<>(r -> true);
 		selectedTask.addListener(this::selectedTaskChanged);
 	}
 
+	private boolean isFixableInfoResult(Result r) {
+		return r.diagnosis().getSeverity() == Severity.INFO && r.getState() == FIXABLE;
+	}
+
 	private void selectedTaskChanged(ObservableValue<? extends Check> observable, Check oldValue, Check newValue) {
 		if (resultSubscription != null) {
 			resultSubscription.unsubscribe();
@@ -66,6 +103,8 @@ public class CheckDetailController implements FxController {
 		if (newValue != null) {
 			resultSubscription = EasyBind.bindContent(results, newValue.getResults());
 		}
+		severityChoiceBox.setValue(null);
+		fixStateChoiceBox.setValue(null);
 	}
 
 	private Function<Stream<? extends Result>, Long> countSeverity(DiagnosticResult.Severity severity) {
@@ -74,8 +113,110 @@ public class CheckDetailController implements FxController {
 
 	@FXML
 	public void initialize() {
-		resultsListView.setItems(results);
+		resultsListView.setItems(results.filtered(resultsFilter));
 		resultsListView.setCellFactory(resultListCellFactory);
+
+		severityChoiceBox.getItems().add(null);
+		severityChoiceBox.getItems().addAll(Arrays.stream(DiagnosticResult.Severity.values()).toList());
+		severityChoiceBox.setConverter(new SeverityStringifier());
+		severityChoiceBox.setValue(null);
+
+		fixStateChoiceBox.getItems().add(null);
+		fixStateChoiceBox.getItems().addAll(Arrays.stream(Result.FixState.values()).toList());
+		fixStateChoiceBox.setConverter(new FixStateStringifier());
+		fixStateChoiceBox.setValue(null);
+
+		resultsFilter.bind(Bindings.createObjectBinding(() -> this::filterResults, severityChoiceBox.valueProperty(), fixStateChoiceBox.valueProperty()));
+	}
+
+	private boolean filterResults(Result r) {
+		var desiredFixState = fixStateChoiceBox.getValue();
+		var desiredSeverity = severityChoiceBox.getValue();
+		return (desiredFixState == null || r.getState() == desiredFixState) && (desiredSeverity == null || r.diagnosis().getSeverity() == desiredSeverity);
+	}
+
+	@FXML
+	public void fixAllInfoResults() {
+		fixAllInfoResultsExecuted.setValue(true);
+		results.stream().filter(this::isFixableInfoResult).forEach(resultFixApplier::fix);
+	}
+
+
+	@FXML
+	public void copyResultDetails() {
+		var result = resultsListView.getSelectionModel().getSelectedItem();
+		if (result != null) {
+			ClipboardContent clipboardContent = new ClipboardContent();
+			clipboardContent.putString(result.diagnosis().toString());
+			Clipboard.getSystemClipboard().setContent(clipboardContent);
+		}
+	}
+
+	/* -- Internal classes -- */
+
+	class SeverityStringifier extends StringConverter<Severity> {
+
+		@Override
+		public String toString(Severity object) {
+			if (object == null) {
+				return resourceBundle.getString("health.result.severityFilter.all");
+			}
+			return switch (object) {
+				case GOOD -> resourceBundle.getString("health.result.severityFilter.good");
+				case INFO -> resourceBundle.getString("health.result.severityFilter.info");
+				case WARN -> resourceBundle.getString("health.result.severityFilter.warn");
+				case CRITICAL -> resourceBundle.getString("health.result.severityFilter.crit");
+			};
+		}
+
+		@Override
+		public Severity fromString(String string) {
+			if (resourceBundle.getString("health.result.severityFilter.good").equals(string)) {
+				return Severity.GOOD;
+			} else if (resourceBundle.getString("health.result.severityFilter.info").equals(string)) {
+				return Severity.INFO;
+			} else if (resourceBundle.getString("health.result.severityFilter.warn").equals(string)) {
+				return Severity.WARN;
+			} else if (resourceBundle.getString("health.result.severityFilter.crit").equals(string)) {
+				return Severity.CRITICAL;
+			} else {
+				return null;
+			}
+		}
+	}
+
+	class FixStateStringifier extends StringConverter<Result.FixState> {
+
+		@Override
+		public String toString(Result.FixState object) {
+			if (object == null) {
+				return resourceBundle.getString("health.result.fixStateFilter.all");
+			}
+			return switch (object) {
+				case FIXABLE -> resourceBundle.getString("health.result.fixStateFilter.fixable");
+				case NOT_FIXABLE -> resourceBundle.getString("health.result.fixStateFilter.notFixable");
+				case FIXING -> resourceBundle.getString("health.result.fixStateFilter.fixing");
+				case FIXED -> resourceBundle.getString("health.result.fixStateFilter.fixed");
+				case FIX_FAILED -> resourceBundle.getString("health.result.fixStateFilter.fixFailed");
+			};
+		}
+
+		@Override
+		public Result.FixState fromString(String string) {
+			if (resourceBundle.getString("health.result.fixStateFilter.fixable").equals(string)) {
+				return FIXABLE;
+			} else if (resourceBundle.getString("health.result.fixStateFilter.notFixable").equals(string)) {
+				return NOT_FIXABLE;
+			} else if (resourceBundle.getString("health.result.fixStateFilter.fixing").equals(string)) {
+				return FIXING;
+			} else if (resourceBundle.getString("health.result.fixStateFilter.fixed").equals(string)) {
+				return FIXED;
+			} else if (resourceBundle.getString("health.result.fixStateFilter.fixFailed").equals(string)) {
+				return FIX_FAILED;
+			} else {
+				return null;
+			}
+		}
 	}
 
 	/* Getter/Setter */
@@ -175,4 +316,12 @@ public class CheckDetailController implements FxController {
 	public Check getCheck() {
 		return check.get();
 	}
+
+	public ObservableValue<Boolean> fixAllInfoResultsPossibleProperty() {
+		return fixAllInfoResultsPossible;
+	}
+
+	public boolean getFixAllInfoResultsPossible() {
+		return fixAllInfoResultsPossible.getValue();
+	}
 }

src/main/java/org/cryptomator/ui/health/CheckExecutor.java

@@ -70,7 +70,7 @@ public class CheckExecutor {
 			try (var masterkeyClone = masterkey.copy(); //
 				 var cryptor = CryptorProvider.forScheme(vaultConfig.getCipherCombo()).provide(masterkeyClone, csprng)) {
 				c.getHealthCheck().check(vaultPath, vaultConfig, masterkeyClone, cryptor, diagnosis -> {
-					Platform.runLater(() -> c.getResults().add(Result.create(diagnosis)));
+					Platform.runLater(() -> c.getResults().add(Result.create(diagnosis, vaultPath, vaultConfig, masterkeyClone, cryptor)));
 					highestResultSeverity = Comparators.max(highestResultSeverity, diagnosis.getSeverity());
 				});
 			}

src/main/java/org/cryptomator/ui/health/CheckStateIconView.java

@@ -31,7 +31,7 @@ public class CheckStateIconView extends FontAwesome5IconView {
 		this.severity = EasyBind.wrapNullable(check).mapObservable(Check::highestResultSeverityProperty).asOrdinary();
 		this.glyph.bind(Bindings.createObjectBinding(this::glyphForState, state, severity));
 		this.subscriptions = List.of( //
-				EasyBind.includeWhen(getStyleClass(), "glyph-icon-muted", Bindings.equal(state, Check.CheckState.SKIPPED).or(Bindings.equal(state, Check.CheckState.CANCELLED))), //
+				EasyBind.includeWhen(getStyleClass(), "glyph-icon-muted", Bindings.equal(state, Check.CheckState.SKIPPED).or(Bindings.equal(state, Check.CheckState.CANCELLED)).or(Bindings.equal(severity, DiagnosticResult.Severity.INFO))), //
 				EasyBind.includeWhen(getStyleClass(), "glyph-icon-primary", Bindings.equal(severity, DiagnosticResult.Severity.GOOD)), //
 				EasyBind.includeWhen(getStyleClass(), "glyph-icon-orange", Bindings.equal(severity, DiagnosticResult.Severity.WARN).or(Bindings.equal(severity, DiagnosticResult.Severity.CRITICAL))), //
 				EasyBind.includeWhen(getStyleClass(), "glyph-icon-red", Bindings.equal(state, Check.CheckState.ERROR)) //

src/main/java/org/cryptomator/ui/health/Result.java

@@ -1,10 +1,14 @@
 package org.cryptomator.ui.health;
 
+import org.cryptomator.cryptofs.VaultConfig;
 import org.cryptomator.cryptofs.health.api.DiagnosticResult;
+import org.cryptomator.cryptolib.api.Cryptor;
+import org.cryptomator.cryptolib.api.Masterkey;
 
 import javafx.beans.Observable;
 import javafx.beans.property.ObjectProperty;
 import javafx.beans.property.SimpleObjectProperty;
+import java.nio.file.Path;
 
 record Result(DiagnosticResult diagnosis, ObjectProperty<FixState> fixState) {
 
@@ -16,8 +20,8 @@ record Result(DiagnosticResult diagnosis, ObjectProperty<FixState> fixState) {
 		FIX_FAILED
 	}
 
-	public static Result create(DiagnosticResult diagnosis) {
-		FixState initialState = diagnosis.getSeverity() == DiagnosticResult.Severity.WARN ? FixState.FIXABLE : FixState.NOT_FIXABLE;
+	public static Result create(DiagnosticResult diagnosis, Path vaultPath, VaultConfig config, Masterkey masterkey, Cryptor cryptor) {
+		FixState initialState = diagnosis.getFix(vaultPath, config, masterkey, cryptor).map( _f -> FixState.FIXABLE).orElse(FixState.NOT_FIXABLE);
 		return new Result(diagnosis, new SimpleObjectProperty<>(initialState));
 	}
 

src/main/java/org/cryptomator/ui/health/ResultFixApplier.java

@@ -23,6 +23,8 @@ import java.util.concurrent.atomic.AtomicReference;
 @HealthCheckScoped
 class ResultFixApplier {
 
+	private static final Logger LOG = LoggerFactory.getLogger(ResultFixApplier.class);
+
 	private final Path vaultPath;
 	private final SecureRandom csprng;
 	private final Masterkey masterkey;
@@ -40,25 +42,34 @@ class ResultFixApplier {
 
 	public CompletionStage<Void> fix(Result result) {
 		Preconditions.checkArgument(result.getState() == Result.FixState.FIXABLE);
-		result.setState(Result.FixState.FIXING);
-		return CompletableFuture.runAsync(() -> fix(result.diagnosis()), sequentialExecutor)
+		return CompletableFuture.runAsync(() -> result.setState(Result.FixState.FIXING), Platform::runLater) //
+				.thenRunAsync(() -> fix(result.diagnosis()), sequentialExecutor) //
 				.whenCompleteAsync((unused, throwable) -> {
-					var fixed = throwable == null ? Result.FixState.FIXED : Result.FixState.FIX_FAILED;
-					result.setState(fixed);
+					final Result.FixState s;
+					if (throwable == null) {
+						LOG.debug("Fix for {} applied successful.", result.diagnosis().getClass().getName());
+						s = Result.FixState.FIXED;
+					} else {
+						LOG.error("Failed to apply fix for {}", result.diagnosis().getClass().getName(), throwable);
+						s = Result.FixState.FIX_FAILED;
+					}
+					result.setState(s);
 				}, Platform::runLater);
 	}
 
-	public void fix(DiagnosticResult diagnosis) {
-		Preconditions.checkArgument(diagnosis.getSeverity() == DiagnosticResult.Severity.WARN, "Unfixable result");
+	private void fix(DiagnosticResult diagnosis) {
 		try (var masterkeyClone = masterkey.copy(); //
 			 var cryptor = CryptorProvider.forScheme(vaultConfig.getCipherCombo()).provide(masterkeyClone, csprng)) {
-			diagnosis.fix(vaultPath, vaultConfig, masterkeyClone, cryptor);
+			diagnosis.getFix(vaultPath, vaultConfig, masterkeyClone, cryptor) //
+					.orElseThrow(() -> new IllegalStateException("No fix for diagnosis " + diagnosis.getClass().getName() + " implemented.")) //
+					.apply();
 		} catch (Exception e) {
 			throw new FixFailedException(e);
 		}
 	}
 
 	public static class FixFailedException extends CompletionException {
+
 		private FixFailedException(Throwable cause) {
 			super(cause);
 		}

src/main/java/org/cryptomator/ui/health/ResultListCellController.java

@@ -12,7 +12,6 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
-import javafx.application.Platform;
 import javafx.beans.binding.Bindings;
 import javafx.beans.binding.BooleanBinding;
 import javafx.beans.binding.ObjectBinding;
@@ -34,7 +33,6 @@ public class ResultListCellController implements FxController {
 	private static final FontAwesome5Icon WARN_ICON = FontAwesome5Icon.EXCLAMATION_TRIANGLE;
 	private static final FontAwesome5Icon CRIT_ICON = FontAwesome5Icon.TIMES;
 
-	private final Logger LOG = LoggerFactory.getLogger(ResultListCellController.class);
 
 	private final ObjectProperty<Result> result;
 	private final ObservableValue<DiagnosticResult.Severity> severity;
@@ -42,17 +40,17 @@ public class ResultListCellController implements FxController {
 	private final ResultFixApplier fixApplier;
 	private final ObservableValue<Result.FixState> fixState;
 	private final ObjectBinding<FontAwesome5Icon> severityGlyph;
-	private final ObjectBinding<FontAwesome5Icon> fixGlyph;
 	private final BooleanBinding fixable;
 	private final BooleanBinding fixing;
 	private final BooleanBinding fixed;
 	private final BooleanBinding fixFailed;
 	private final BooleanBinding fixRunningOrDone;
+	private final ObservableValue<FontAwesome5Icon> fixGlyph;
 	private final List<Subscription> subscriptions;
-	private final Tooltip fixSuccess;
-	private final Tooltip fixFail;
-
+	private final Tooltip fixStateTip;
+	private final Tooltip severityTip;
 	private AutoAnimator fixRunningRotator;
+	private final ResourceBundle resourceBundle;
 
 	/* FXML */
 	public FontAwesome5IconView severityView;
@@ -60,23 +58,54 @@ public class ResultListCellController implements FxController {
 
 	@Inject
 	public ResultListCellController(ResultFixApplier fixApplier, ResourceBundle resourceBundle) {
+		this.resourceBundle = resourceBundle;
 		this.result = new SimpleObjectProperty<>(null);
 		this.severity = result.map(Result::diagnosis).map(DiagnosticResult::getSeverity);
 		this.description = result.map(Result::getDescription).orElse("");
 		this.fixApplier = fixApplier;
 		this.fixState = result.flatMap(Result::fixState);
 		this.severityGlyph = Bindings.createObjectBinding(this::getSeverityGlyph, result);
-		this.fixGlyph = Bindings.createObjectBinding(this::getFixGlyph, fixState);
 		this.fixable = Bindings.createBooleanBinding(this::isFixable, fixState);
 		this.fixing = Bindings.createBooleanBinding(this::isFixing, fixState);
 		this.fixed = Bindings.createBooleanBinding(this::isFixed, fixState);
 		this.fixFailed = Bindings.createBooleanBinding(this::isFixFailed, fixState);
 		this.fixRunningOrDone = fixing.or(fixed).or(fixFailed);
+		this.fixGlyph = fixState.map(this::getFixGlyph);
 		this.subscriptions = new ArrayList<>();
-		this.fixSuccess = new Tooltip(resourceBundle.getString("health.fix.successTip"));
-		this.fixFail = new Tooltip(resourceBundle.getString("health.fix.failTip"));
-		fixSuccess.setShowDelay(Duration.millis(100));
-		fixFail.setShowDelay(Duration.millis(100));
+
+		this.fixStateTip = new Tooltip();
+		fixStateTip.textProperty().bind(fixState.map(this::getFixStateDescription));
+		fixStateTip.setShowDelay(Duration.millis(100));
+
+		this.severityTip = new Tooltip();
+		severityTip.textProperty().bind(severity.map(this::getSeverityDescription));
+		severityTip.setShowDelay(Duration.millis(150));
+	}
+
+	public FontAwesome5Icon getFixGlyph(Result.FixState state) {
+		return switch (state) {
+			case FIXING -> FontAwesome5Icon.SPINNER;
+			case FIXED -> FontAwesome5Icon.CHECK;
+			case FIX_FAILED -> FontAwesome5Icon.TIMES;
+			default -> null;
+		};
+	}
+
+	private String getFixStateDescription(Result.FixState fixState) {
+		return switch (fixState) {
+			case FIXED -> resourceBundle.getString("health.fix.successTip");
+			case FIX_FAILED -> resourceBundle.getString("health.fix.failTip");
+			default -> "";
+		};
+	}
+
+	private String getSeverityDescription(DiagnosticResult.Severity severity) {
+		return resourceBundle.getString(switch (severity) {
+			case GOOD -> "health.result.severityTip.good";
+			case INFO -> "health.result.severityTip.info";
+			case WARN -> "health.result.severityTip.warn";
+			case CRITICAL -> "health.result.severityTip.crit";
+		});
 	}
 
 	@FXML
@@ -93,22 +122,19 @@ public class ResultListCellController implements FxController {
 				.onCondition(fixing) //
 				.afterStop(() -> fixView.setRotate(0)) //
 				.build();
+		fixState.addListener(((observable, oldValue, newValue) -> {
+			if (newValue == Result.FixState.FIXED || newValue == Result.FixState.FIX_FAILED) {
+				Tooltip.install(fixView, fixStateTip);
+			}
+		}));
+		Tooltip.install(severityView, severityTip);
 	}
 
 	@FXML
 	public void fix() {
 		Result r = result.get();
 		if (r != null) {
-			fixApplier.fix(r).whenCompleteAsync(this::fixFinished, Platform::runLater);
-		}
-	}
-
-	private void fixFinished(Void unused, Throwable exception) {
-		if (exception != null) {
-			LOG.error("Failed to apply fix", exception);
-			Tooltip.install(fixView, fixFail);
-		} else {
-			Tooltip.install(fixView, fixSuccess);
+			fixApplier.fix(r);
 		}
 	}
 
@@ -152,20 +178,12 @@ public class ResultListCellController implements FxController {
 		};
 	}
 
-	public ObjectBinding<FontAwesome5Icon> fixGlyphProperty() {
+	public ObservableValue<FontAwesome5Icon> fixGlyphProperty() {
 		return fixGlyph;
 	}
 
 	public FontAwesome5Icon getFixGlyph() {
-		if (fixState.getValue() == null) {
-			return null;
-		}
-		return switch (fixState.getValue()) {
-			case NOT_FIXABLE, FIXABLE -> null;
-			case FIXING -> FontAwesome5Icon.SPINNER;
-			case FIXED -> FontAwesome5Icon.CHECK;
-			case FIX_FAILED -> FontAwesome5Icon.TIMES;
-		};
+		return fixGlyph.getValue();
 	}
 
 	public BooleanBinding fixableProperty() {

src/main/java/org/cryptomator/ui/keyloading/hub/HubKeyLoadingModule.java

@@ -87,6 +87,13 @@ public abstract class HubKeyLoadingModule {
 	@StringKey(HubKeyLoadingStrategy.SCHEME_HUB_HTTPS)
 	abstract KeyLoadingStrategy bindHubKeyLoadingStrategyToHubHttps(HubKeyLoadingStrategy strategy);
 
+	@Provides
+	@FxmlScene(FxmlFile.HUB_NO_KEYCHAIN)
+	@KeyLoadingScoped
+	static Scene provideHubNoKeychainScene(@KeyLoading FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.HUB_NO_KEYCHAIN);
+	}
+
 	@Provides
 	@FxmlScene(FxmlFile.HUB_AUTH_FLOW)
 	@KeyLoadingScoped
@@ -95,10 +102,10 @@ public abstract class HubKeyLoadingModule {
 	}
 
 	@Provides
-	@FxmlScene(FxmlFile.HUB_LICENSE_EXCEEDED)
+	@FxmlScene(FxmlFile.HUB_INVALID_LICENSE)
 	@KeyLoadingScoped
-	static Scene provideLicenseExceededScene(@KeyLoading FxmlLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene(FxmlFile.HUB_LICENSE_EXCEEDED);
+	static Scene provideInvalidLicenseScene(@KeyLoading FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.HUB_INVALID_LICENSE);
 	}
 
 	@Provides
@@ -136,6 +143,11 @@ public abstract class HubKeyLoadingModule {
 		return fxmlLoaders.createScene(FxmlFile.HUB_UNAUTHORIZED_DEVICE);
 	}
 
+	@Binds
+	@IntoMap
+	@FxControllerKey(NoKeychainController.class)
+	abstract FxController bindNoKeychainController(NoKeychainController controller);
+
 	@Binds
 	@IntoMap
 	@FxControllerKey(AuthFlowController.class)
@@ -150,8 +162,8 @@ public abstract class HubKeyLoadingModule {
 
 	@Binds
 	@IntoMap
-	@FxControllerKey(LicenseExceededController.class)
-	abstract FxController bindLicenseExceededController(LicenseExceededController controller);
+	@FxControllerKey(InvalidLicenseController.class)
+	abstract FxController bindInvalidLicenseController(InvalidLicenseController controller);
 
 	@Binds
 	@IntoMap

src/main/java/org/cryptomator/ui/keyloading/hub/HubKeyLoadingStrategy.java

@@ -3,6 +3,8 @@ package org.cryptomator.ui.keyloading.hub;
 import com.google.common.base.Preconditions;
 import com.nimbusds.jose.JWEObject;
 import dagger.Lazy;
+import org.cryptomator.common.keychain.KeychainManager;
+import org.cryptomator.common.keychain.NoKeychainAccessProviderException;
 import org.cryptomator.common.settings.DeviceKey;
 import org.cryptomator.cryptolib.api.Masterkey;
 import org.cryptomator.cryptolib.api.MasterkeyLoadingFailedException;
@@ -31,15 +33,19 @@ public class HubKeyLoadingStrategy implements KeyLoadingStrategy {
 	static final String SCHEME_HUB_HTTPS = SCHEME_PREFIX + "https";
 
 	private final Stage window;
+	private final KeychainManager keychainManager;
 	private final Lazy<Scene> authFlowScene;
+	private final Lazy<Scene> noKeychainScene;
 	private final CompletableFuture<JWEObject> result;
 	private final DeviceKey deviceKey;
 
 	@Inject
-	public HubKeyLoadingStrategy(@KeyLoading Stage window, @FxmlScene(FxmlFile.HUB_AUTH_FLOW) Lazy<Scene> authFlowScene, CompletableFuture<JWEObject> result, DeviceKey deviceKey, @Named("windowTitle") String windowTitle) {
+	public HubKeyLoadingStrategy(@KeyLoading Stage window, @FxmlScene(FxmlFile.HUB_AUTH_FLOW) Lazy<Scene> authFlowScene, @FxmlScene(FxmlFile.HUB_NO_KEYCHAIN) Lazy<Scene> noKeychainScene, CompletableFuture<JWEObject> result, DeviceKey deviceKey, KeychainManager keychainManager, @Named("windowTitle") String windowTitle) {
 		this.window = window;
+		this.keychainManager = keychainManager;
 		window.setTitle(windowTitle);
 		this.authFlowScene = authFlowScene;
+		this.noKeychainScene = noKeychainScene;
 		this.result = result;
 		this.deviceKey = deviceKey;
 	}
@@ -48,9 +54,16 @@ public class HubKeyLoadingStrategy implements KeyLoadingStrategy {
 	public Masterkey loadKey(URI keyId) throws MasterkeyLoadingFailedException {
 		Preconditions.checkArgument(keyId.getScheme().startsWith(SCHEME_PREFIX));
 		try {
-			startAuthFlow();
+			if (!keychainManager.isSupported()) {
+				throw new NoKeychainAccessProviderException();
+			}
+			var keypair = deviceKey.get();
+			showWindow(authFlowScene);
 			var jwe = result.get();
-			return JWEHelper.decrypt(jwe, deviceKey.get().getPrivate());
+			return JWEHelper.decrypt(jwe, keypair.getPrivate());
+		} catch (NoKeychainAccessProviderException e) {
+			showWindow(noKeychainScene);
+			throw new UnlockCancelledException("Unlock canceled due to missing prerequisites", e);
 		} catch (DeviceKey.DeviceKeyRetrievalException e) {
 			throw new MasterkeyLoadingFailedException("Failed to load keypair", e);
 		} catch (CancellationException e) {
@@ -63,9 +76,9 @@ public class HubKeyLoadingStrategy implements KeyLoadingStrategy {
 		}
 	}
 
-	private void startAuthFlow() {
+	private void showWindow(Lazy<Scene> scene) {
 		Platform.runLater(() -> {
-			window.setScene(authFlowScene.get());
+			window.setScene(scene.get());
 			window.show();
 			Window owner = window.getOwner();
 			if (owner != null) {

src/main/java/org/cryptomator/ui/keyloading/hub/InvalidLicenseController.java

@@ -7,12 +7,12 @@ import javax.inject.Inject;
 import javafx.fxml.FXML;
 import javafx.stage.Stage;
 
-public class LicenseExceededController implements FxController {
+public class InvalidLicenseController implements FxController {
 
 	private final Stage window;
 
 	@Inject
-	public LicenseExceededController(@KeyLoading Stage window) {
+	public InvalidLicenseController(@KeyLoading Stage window) {
 		this.window = window;
 	}
 

src/main/java/org/cryptomator/ui/keyloading/hub/NoKeychainController.java

@@ -0,0 +1,31 @@
+package org.cryptomator.ui.keyloading.hub;
+
+import org.cryptomator.ui.common.FxController;
+import org.cryptomator.ui.fxapp.FxApplicationWindows;
+import org.cryptomator.ui.keyloading.KeyLoading;
+import org.cryptomator.ui.preferences.SelectedPreferencesTab;
+
+import javax.inject.Inject;
+import javafx.stage.Stage;
+
+public class NoKeychainController implements FxController {
+
+	private final Stage window;
+	private final FxApplicationWindows appWindows;
+
+	@Inject
+	public NoKeychainController(@KeyLoading Stage window, FxApplicationWindows appWindows) {
+		this.window = window;
+		this.appWindows = appWindows;
+	}
+
+
+	public void cancel() {
+		window.close();
+	}
+
+	public void openPreferences() {
+		appWindows.showPreferencesWindow(SelectedPreferencesTab.GENERAL);
+		window.close();
+	}
+}

src/main/java/org/cryptomator/ui/keyloading/hub/ReceiveKeyController.java

@@ -42,11 +42,11 @@ public class ReceiveKeyController implements FxController {
 	private final Lazy<Scene> registerDeviceScene;
 	private final Lazy<Scene> unauthorizedScene;
 	private final URI vaultBaseUri;
-	private final Lazy<Scene> licenseExceededScene;
+	private final Lazy<Scene> invalidLicenseScene;
 	private final HttpClient httpClient;
 
 	@Inject
-	public ReceiveKeyController(@KeyLoading Vault vault, ExecutorService executor, @KeyLoading Stage window, @Named("deviceId") String deviceId, @Named("bearerToken") AtomicReference<String> tokenRef, CompletableFuture<JWEObject> result, @FxmlScene(FxmlFile.HUB_REGISTER_DEVICE) Lazy<Scene> registerDeviceScene, @FxmlScene(FxmlFile.HUB_UNAUTHORIZED_DEVICE) Lazy<Scene> unauthorizedScene, @FxmlScene(FxmlFile.HUB_LICENSE_EXCEEDED) Lazy<Scene> licenseExceededScene) {
+	public ReceiveKeyController(@KeyLoading Vault vault, ExecutorService executor, @KeyLoading Stage window, @Named("deviceId") String deviceId, @Named("bearerToken") AtomicReference<String> tokenRef, CompletableFuture<JWEObject> result, @FxmlScene(FxmlFile.HUB_REGISTER_DEVICE) Lazy<Scene> registerDeviceScene, @FxmlScene(FxmlFile.HUB_UNAUTHORIZED_DEVICE) Lazy<Scene> unauthorizedScene, @FxmlScene(FxmlFile.HUB_INVALID_LICENSE) Lazy<Scene> invalidLicenseScene) {
 		this.window = window;
 		this.deviceId = deviceId;
 		this.bearerToken = Objects.requireNonNull(tokenRef.get());
@@ -54,7 +54,7 @@ public class ReceiveKeyController implements FxController {
 		this.registerDeviceScene = registerDeviceScene;
 		this.unauthorizedScene = unauthorizedScene;
 		this.vaultBaseUri = getVaultBaseUri(vault);
-		this.licenseExceededScene = licenseExceededScene;
+		this.invalidLicenseScene = invalidLicenseScene;
 		this.window.addEventHandler(WindowEvent.WINDOW_HIDING, this::windowClosed);
 		this.httpClient = HttpClient.newBuilder().version(HttpClient.Version.HTTP_1_1).executor(executor).build();
 	}
@@ -96,7 +96,7 @@ public class ReceiveKeyController implements FxController {
 	}
 
 	private void licenseExceeded() {
-		window.setScene(licenseExceededScene.get());
+		window.setScene(invalidLicenseScene.get());
 	}
 
 	private void needsDeviceRegistration() {

src/main/java/org/cryptomator/ui/lock/LockForcedController.java

@@ -53,7 +53,7 @@ public class LockForcedController implements FxController {
 	}
 
 	public boolean isForceSupported() {
-		return false;//vault.supportsForcedUnmount(); TODO
+		return vault.supportsForcedUnmount();
 	}
 
 }

src/main/java/org/cryptomator/ui/mainwindow/MainWindowController.java

@@ -3,33 +3,17 @@ package org.cryptomator.ui.mainwindow;
 import org.apache.commons.lang3.SystemUtils;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.common.vaults.VaultListManager;
-import org.cryptomator.cryptofs.CryptoFileSystemProvider;
-import org.cryptomator.cryptofs.DirStructure;
 import org.cryptomator.ui.common.FxController;
-import org.cryptomator.ui.wrongfilealert.WrongFileAlertComponent;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javafx.beans.Observable;
-import javafx.beans.property.BooleanProperty;
 import javafx.beans.property.ObjectProperty;
 import javafx.beans.property.ReadOnlyObjectProperty;
-import javafx.beans.property.SimpleBooleanProperty;
 import javafx.fxml.FXML;
-import javafx.scene.input.DragEvent;
-import javafx.scene.input.TransferMode;
 import javafx.scene.layout.StackPane;
 import javafx.stage.Stage;
-import java.io.File;
-import java.io.IOException;
-import java.nio.file.Path;
-import java.util.Set;
-import java.util.stream.Collectors;
-
-import static org.cryptomator.common.Constants.CRYPTOMATOR_FILENAME_EXT;
-import static org.cryptomator.common.Constants.MASTERKEY_FILENAME;
-import static org.cryptomator.common.Constants.VAULTCONFIG_FILENAME;
 
 @MainWindowScoped
 public class MainWindowController implements FxController {
@@ -37,28 +21,19 @@ public class MainWindowController implements FxController {
 	private static final Logger LOG = LoggerFactory.getLogger(MainWindowController.class);
 
 	private final Stage window;
-	private final VaultListManager vaultListManager;
 	private final ReadOnlyObjectProperty<Vault> selectedVault;
-	private final WrongFileAlertComponent.Builder wrongFileAlert;
-	private final BooleanProperty draggingOver = new SimpleBooleanProperty();
-	private final BooleanProperty draggingVaultOver = new SimpleBooleanProperty();
+
 	public StackPane root;
 
 	@Inject
-	public MainWindowController(@MainWindow Stage window, VaultListManager vaultListManager, ObjectProperty<Vault> selectedVault, WrongFileAlertComponent.Builder wrongFileAlert) {
+	public MainWindowController(@MainWindow Stage window, ObjectProperty<Vault> selectedVault) {
 		this.window = window;
-		this.vaultListManager = vaultListManager;
 		this.selectedVault = selectedVault;
-		this.wrongFileAlert = wrongFileAlert;
 	}
 
 	@FXML
 	public void initialize() {
 		LOG.trace("init MainWindowController");
-		root.setOnDragEntered(this::handleDragEvent);
-		root.setOnDragOver(this::handleDragEvent);
-		root.setOnDragDropped(this::handleDragEvent);
-		root.setOnDragExited(this::handleDragEvent);
 		if (SystemUtils.IS_OS_WINDOWS) {
 			root.getStyleClass().add("os-windows");
 		}
@@ -72,65 +47,4 @@ public class MainWindowController implements FxController {
 		}
 	}
 
-	private void handleDragEvent(DragEvent event) {
-		if (DragEvent.DRAG_ENTERED.equals(event.getEventType()) && event.getGestureSource() == null) {
-			draggingOver.set(true);
-		} else if (DragEvent.DRAG_OVER.equals(event.getEventType()) && event.getGestureSource() == null && event.getDragboard().hasFiles()) {
-			event.acceptTransferModes(TransferMode.ANY);
-			draggingVaultOver.set(event.getDragboard().getFiles().stream().map(File::toPath).anyMatch(this::containsVault));
-		} else if (DragEvent.DRAG_DROPPED.equals(event.getEventType()) && event.getGestureSource() == null && event.getDragboard().hasFiles()) {
-			Set<Path> vaultPaths = event.getDragboard().getFiles().stream().map(File::toPath).filter(this::containsVault).collect(Collectors.toSet());
-			if (vaultPaths.isEmpty()) {
-				wrongFileAlert.build().showWrongFileAlertWindow();
-			} else {
-				vaultPaths.forEach(this::addVault);
-			}
-			event.setDropCompleted(!vaultPaths.isEmpty());
-			event.consume();
-		} else if (DragEvent.DRAG_EXITED.equals(event.getEventType())) {
-			draggingOver.set(false);
-			draggingVaultOver.set(false);
-		}
-	}
-
-	private boolean containsVault(Path path) {
-		try {
-			if (path.getFileName().toString().endsWith(CRYPTOMATOR_FILENAME_EXT)) {
-				path = path.getParent();
-			}
-			return CryptoFileSystemProvider.checkDirStructureForVault(path, VAULTCONFIG_FILENAME, MASTERKEY_FILENAME) != DirStructure.UNRELATED;
-		} catch (IOException e) {
-			return false;
-		}
-	}
-
-	private void addVault(Path pathToVault) {
-		try {
-			if (pathToVault.getFileName().toString().endsWith(CRYPTOMATOR_FILENAME_EXT)) {
-				vaultListManager.add(pathToVault.getParent());
-			} else {
-				vaultListManager.add(pathToVault);
-			}
-		} catch (IOException e) {
-			LOG.debug("Not a vault: {}", pathToVault);
-		}
-	}
-
-	/* Getter/Setter */
-
-	public BooleanProperty draggingOverProperty() {
-		return draggingOver;
-	}
-
-	public boolean isDraggingOver() {
-		return draggingOver.get();
-	}
-
-	public BooleanProperty draggingVaultOverProperty() {
-		return draggingVaultOver;
-	}
-
-	public boolean isDraggingVaultOver() {
-		return draggingVaultOver.get();
-	}
 }

src/main/java/org/cryptomator/ui/mainwindow/VaultDetailUnlockedController.java

@@ -1,54 +1,125 @@
 package org.cryptomator.ui.mainwindow;
 
+import com.google.common.base.Preconditions;
 import com.google.common.cache.CacheBuilder;
 import com.google.common.cache.CacheLoader;
 import com.google.common.cache.LoadingCache;
+import com.tobiasdiez.easybind.EasyBind;
+import org.apache.commons.lang3.SystemUtils;
 import org.cryptomator.common.vaults.Vault;
-import org.cryptomator.common.vaults.VaultState;
 import org.cryptomator.integrations.mount.Mountpoint;
+import org.cryptomator.integrations.revealpath.RevealFailedException;
+import org.cryptomator.integrations.revealpath.RevealPathService;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.VaultService;
 import org.cryptomator.ui.fxapp.FxApplicationWindows;
 import org.cryptomator.ui.stats.VaultStatisticsComponent;
+import org.cryptomator.ui.wrongfilealert.WrongFileAlertComponent;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
-import javafx.beans.binding.Bindings;
-import javafx.beans.binding.BooleanBinding;
-import javafx.beans.binding.StringBinding;
+import javafx.application.Platform;
+import javafx.beans.property.BooleanProperty;
 import javafx.beans.property.ObjectProperty;
 import javafx.beans.property.ReadOnlyObjectProperty;
+import javafx.beans.property.SimpleBooleanProperty;
 import javafx.beans.value.ObservableValue;
 import javafx.fxml.FXML;
+import javafx.scene.control.Button;
+import javafx.scene.input.Clipboard;
+import javafx.scene.input.ClipboardContent;
+import javafx.scene.input.DataFormat;
+import javafx.scene.input.DragEvent;
+import javafx.scene.input.TransferMode;
+import javafx.stage.FileChooser;
 import javafx.stage.Stage;
-import java.net.URI;
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
 import java.util.Optional;
+import java.util.ResourceBundle;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.TimeUnit;
 
 @MainWindowScoped
 public class VaultDetailUnlockedController implements FxController {
 
+	private static final Logger LOG = LoggerFactory.getLogger(VaultDetailUnlockedController.class);
+	private static final String ACTIVE_CLASS = "active";
+
 	private final ReadOnlyObjectProperty<Vault> vault;
 	private final FxApplicationWindows appWindows;
 	private final VaultService vaultService;
+	private final WrongFileAlertComponent.Builder wrongFileAlert;
 	private final Stage mainWindow;
+	private final Optional<RevealPathService> revealPathService;
+	private final ResourceBundle resourceBundle;
 	private final LoadingCache<Vault, VaultStatisticsComponent> vaultStats;
 	private final VaultStatisticsComponent.Builder vaultStatsBuilder;
-	private final ObservableValue<Mountpoint> mountPoint;
 	private final ObservableValue<Boolean> accessibleViaPath;
 	private final ObservableValue<Boolean> accessibleViaUri;
-	private final ObservableValue<String> mountUri;
+	private final ObservableValue<String> mountPoint;
+	private final BooleanProperty draggingOver = new SimpleBooleanProperty();
+	private final BooleanProperty ciphertextPathsCopied = new SimpleBooleanProperty();
+
+	//FXML
+	public Button dropZone;
 
 	@Inject
-	public VaultDetailUnlockedController(ObjectProperty<Vault> vault, FxApplicationWindows appWindows, VaultService vaultService, VaultStatisticsComponent.Builder vaultStatsBuilder, @MainWindow Stage mainWindow) {
+	public VaultDetailUnlockedController(ObjectProperty<Vault> vault, FxApplicationWindows appWindows, VaultService vaultService, VaultStatisticsComponent.Builder vaultStatsBuilder, WrongFileAlertComponent.Builder wrongFileAlert, @MainWindow Stage mainWindow, Optional<RevealPathService> revealPathService, ResourceBundle resourceBundle) {
 		this.vault = vault;
 		this.appWindows = appWindows;
 		this.vaultService = vaultService;
+		this.wrongFileAlert = wrongFileAlert;
 		this.mainWindow = mainWindow;
+		this.revealPathService = revealPathService;
+		this.resourceBundle = resourceBundle;
 		this.vaultStats = CacheBuilder.newBuilder().weakValues().build(CacheLoader.from(this::buildVaultStats));
 		this.vaultStatsBuilder = vaultStatsBuilder;
-		this.mountPoint = vault.flatMap(Vault::mountPointProperty);
-		this.accessibleViaPath = mountPoint.map(m -> m instanceof Mountpoint.WithPath).orElse(false);
-		this.accessibleViaUri = mountPoint.map(m -> m instanceof Mountpoint.WithUri).orElse(false);
-		this.mountUri = mountPoint.map(Mountpoint::uri).map(URI::toASCIIString).orElse("");
+		var mp = vault.flatMap(Vault::mountPointProperty);
+		this.accessibleViaPath = mp.map(m -> m instanceof Mountpoint.WithPath).orElse(false);
+		this.accessibleViaUri = mp.map(m -> m instanceof Mountpoint.WithUri).orElse(false);
+		this.mountPoint = mp.map(m -> {
+			if (m instanceof Mountpoint.WithPath mwp) {
+				return mwp.path().toString();
+			} else {
+				return m.uri().toASCIIString();
+			}
+		});
+	}
+
+	public void initialize() {
+		dropZone.setOnDragEntered(this::handleDragEvent);
+		dropZone.setOnDragOver(this::handleDragEvent);
+		dropZone.setOnDragDropped(this::handleDragEvent);
+		dropZone.setOnDragExited(this::handleDragEvent);
+
+		EasyBind.includeWhen(dropZone.getStyleClass(), ACTIVE_CLASS, draggingOver);
+	}
+
+	private void handleDragEvent(DragEvent event) {
+		if (DragEvent.DRAG_OVER.equals(event.getEventType()) && event.getGestureSource() == null && event.getDragboard().hasFiles()) {
+			if(SystemUtils.IS_OS_WINDOWS || SystemUtils.IS_OS_MAC) {
+				event.acceptTransferModes(TransferMode.LINK);
+			} else {
+				event.acceptTransferModes(TransferMode.ANY);
+			}
+			draggingOver.set(true);
+		} else if (DragEvent.DRAG_DROPPED.equals(event.getEventType()) && event.getGestureSource() == null && event.getDragboard().hasFiles()) {
+			List<Path> ciphertextPaths = event.getDragboard().getFiles().stream().map(File::toPath).map(this::getCiphertextPath).flatMap(Optional::stream).toList();
+			if (ciphertextPaths.isEmpty()) {
+				wrongFileAlert.build().showWrongFileAlertWindow();
+			} else {
+				revealOrCopyPaths(ciphertextPaths);
+			}
+			event.setDropCompleted(!ciphertextPaths.isEmpty());
+			event.consume();
+		} else if (DragEvent.DRAG_EXITED.equals(event.getEventType())) {
+			draggingOver.set(false);
+		}
 	}
 
 	private VaultStatisticsComponent buildVaultStats(Vault vault) {
@@ -62,7 +133,9 @@ public class VaultDetailUnlockedController implements FxController {
 
 	@FXML
 	public void copyMountUri() {
-		// TODO
+		ClipboardContent clipboardContent = new ClipboardContent();
+		clipboardContent.putString(mountPoint.getValue());
+		Clipboard.getSystemClipboard().setContent(clipboardContent);
 	}
 
 	@FXML
@@ -75,6 +148,64 @@ public class VaultDetailUnlockedController implements FxController {
 		vaultStats.getUnchecked(vault.get()).showVaultStatisticsWindow();
 	}
 
+	@FXML
+	public void chooseFileAndReveal() {
+		Preconditions.checkState(accessibleViaPath.getValue());
+		var fileChooser = new FileChooser();
+		fileChooser.setTitle(resourceBundle.getString("main.vaultDetail.filePickerTitle"));
+		fileChooser.setInitialDirectory(Path.of(mountPoint.getValue()).toFile());
+		var cleartextFile = fileChooser.showOpenDialog(mainWindow);
+		if (cleartextFile != null) {
+			var ciphertextPaths = getCiphertextPath(cleartextFile.toPath()).stream().toList();
+			revealOrCopyPaths(ciphertextPaths);
+		}
+	}
+
+	private boolean startsWithVaultAccessPoint(Path path) {
+		return path.startsWith(Path.of(mountPoint.getValue()));
+	}
+
+	private Optional<Path> getCiphertextPath(Path path) {
+		if (!startsWithVaultAccessPoint(path)) {
+			LOG.debug("Path does not start with access point of selected vault: {}", path);
+			return Optional.empty();
+		}
+		try {
+			return Optional.of(vault.get().getCiphertextPath(path));
+		} catch (IOException e) {
+			LOG.warn("Unable to get ciphertext path from path: {}", path, e);
+			return Optional.empty();
+		}
+	}
+
+	private void revealOrCopyPaths(List<Path> paths) {
+		revealPathService.ifPresentOrElse(svc -> revealPaths(svc, paths), () -> {
+			LOG.warn("No service provider to reveal files found.");
+			copyPathsToClipboard(paths);
+		});
+	}
+
+	private void revealPaths(RevealPathService service, List<Path> paths) {
+		paths.forEach(path -> {
+			try {
+				LOG.debug("Revealing {}", path);
+				service.reveal(path);
+			} catch (RevealFailedException e) {
+				LOG.error("Revealing ciphertext file failed.", e);
+			}
+		});
+	}
+
+	private void copyPathsToClipboard(List<Path> paths) {
+		StringBuilder clipboardString = new StringBuilder();
+		paths.forEach(p -> clipboardString.append(p.toString()).append("\n"));
+		Clipboard.getSystemClipboard().setContent(Map.of(DataFormat.PLAIN_TEXT, clipboardString.toString()));
+		ciphertextPathsCopied.setValue(true);
+		CompletableFuture.delayedExecutor(2, TimeUnit.SECONDS, Platform::runLater).execute(() -> {
+			ciphertextPathsCopied.set(false);
+		});
+	}
+
 	/* Getter/Setter */
 
 	public ReadOnlyObjectProperty<Vault> vaultProperty() {
@@ -101,13 +232,19 @@ public class VaultDetailUnlockedController implements FxController {
 		return accessibleViaUri.getValue();
 	}
 
-	public ObservableValue<String> mountUriProperty() {
-		return mountUri;
+	public ObservableValue<String> mountPointProperty() {
+		return mountPoint;
 	}
 
-	public String getMountUri() {
-		return mountUri.getValue();
+	public String getMountPoint() {
+		return mountPoint.getValue();
 	}
 
+	public BooleanProperty ciphertextPathsCopiedProperty() {
+		return ciphertextPathsCopied;
+	}
 
+	public boolean isCiphertextPathsCopied() {
+		return ciphertextPathsCopied.get();
+	}
 }

src/main/java/org/cryptomator/ui/mainwindow/VaultListController.java

@@ -3,26 +3,43 @@ package org.cryptomator.ui.mainwindow;
 import org.apache.commons.lang3.SystemUtils;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.common.vaults.VaultListManager;
+import org.cryptomator.cryptofs.CryptoFileSystemProvider;
+import org.cryptomator.cryptofs.DirStructure;
 import org.cryptomator.ui.addvaultwizard.AddVaultWizardComponent;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.removevault.RemoveVaultComponent;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javafx.beans.binding.Bindings;
 import javafx.beans.binding.BooleanBinding;
+import javafx.beans.property.BooleanProperty;
 import javafx.beans.property.ObjectProperty;
+import javafx.beans.property.SimpleBooleanProperty;
 import javafx.beans.value.ObservableValue;
 import javafx.collections.ListChangeListener;
 import javafx.collections.ObservableList;
 import javafx.fxml.FXML;
 import javafx.scene.control.ListView;
 import javafx.scene.input.ContextMenuEvent;
+import javafx.scene.input.DragEvent;
 import javafx.scene.input.KeyCode;
 import javafx.scene.input.KeyEvent;
 import javafx.scene.input.MouseEvent;
+import javafx.scene.input.TransferMode;
+import javafx.scene.layout.StackPane;
 import javafx.stage.Stage;
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Path;
 import java.util.EnumSet;
+import java.util.Set;
+import java.util.stream.Collectors;
 
+import static org.cryptomator.common.Constants.CRYPTOMATOR_FILENAME_EXT;
+import static org.cryptomator.common.Constants.MASTERKEY_FILENAME;
+import static org.cryptomator.common.Constants.VAULTCONFIG_FILENAME;
 import static org.cryptomator.common.vaults.VaultState.Value.ERROR;
 import static org.cryptomator.common.vaults.VaultState.Value.LOCKED;
 import static org.cryptomator.common.vaults.VaultState.Value.MISSING;
@@ -31,6 +48,7 @@ import static org.cryptomator.common.vaults.VaultState.Value.NEEDS_MIGRATION;
 @MainWindowScoped
 public class VaultListController implements FxController {
 
+	private static final Logger LOG = LoggerFactory.getLogger(VaultListController.class);
 
 	private final Stage mainWindow;
 	private final ObservableList<Vault> vaults;
@@ -39,17 +57,21 @@ public class VaultListController implements FxController {
 	private final AddVaultWizardComponent.Builder addVaultWizard;
 	private final BooleanBinding emptyVaultList;
 	private final RemoveVaultComponent.Builder removeVaultDialogue;
+	private final VaultListManager vaultListManager;
+	private final BooleanProperty draggingVaultOver = new SimpleBooleanProperty();
 
 	public ListView<Vault> vaultList;
+	public StackPane root;
 
 	@Inject
-	VaultListController(@MainWindow Stage mainWindow, ObservableList<Vault> vaults, ObjectProperty<Vault> selectedVault, VaultListCellFactory cellFactory, AddVaultWizardComponent.Builder addVaultWizard, RemoveVaultComponent.Builder removeVaultDialogue) {
+	VaultListController(@MainWindow Stage mainWindow, ObservableList<Vault> vaults, ObjectProperty<Vault> selectedVault, VaultListCellFactory cellFactory, AddVaultWizardComponent.Builder addVaultWizard, RemoveVaultComponent.Builder removeVaultDialogue, VaultListManager vaultListManager) {
 		this.mainWindow = mainWindow;
 		this.vaults = vaults;
 		this.selectedVault = selectedVault;
 		this.cellFactory = cellFactory;
 		this.addVaultWizard = addVaultWizard;
 		this.removeVaultDialogue = removeVaultDialogue;
+		this.vaultListManager = vaultListManager;
 
 		this.emptyVaultList = Bindings.isEmpty(vaults);
 
@@ -100,6 +122,11 @@ public class VaultListController implements FxController {
 				keyEvent.consume();
 			}
 		});
+
+		root.setOnDragEntered(this::handleDragEvent);
+		root.setOnDragOver(this::handleDragEvent);
+		root.setOnDragDropped(this::handleDragEvent);
+		root.setOnDragExited(this::handleDragEvent);
 	}
 
 	private void deselect(MouseEvent released) {
@@ -128,6 +155,47 @@ public class VaultListController implements FxController {
 		}
 	}
 
+	private void handleDragEvent(DragEvent event) {
+		if (DragEvent.DRAG_OVER.equals(event.getEventType()) && event.getGestureSource() == null && event.getDragboard().hasFiles()) {
+			draggingVaultOver.set(event.getDragboard().getFiles().stream().map(File::toPath).anyMatch(this::containsVault));
+			if (draggingVaultOver.get()) {
+				event.acceptTransferModes(TransferMode.ANY);
+			}
+		} else if (DragEvent.DRAG_DROPPED.equals(event.getEventType()) && event.getGestureSource() == null && event.getDragboard().hasFiles()) {
+			Set<Path> vaultPaths = event.getDragboard().getFiles().stream().map(File::toPath).filter(this::containsVault).collect(Collectors.toSet());
+			if (!vaultPaths.isEmpty()) {
+				vaultPaths.forEach(this::addVault);
+			}
+			event.setDropCompleted(!vaultPaths.isEmpty());
+			event.consume();
+		} else if (DragEvent.DRAG_EXITED.equals(event.getEventType())) {
+			draggingVaultOver.set(false);
+		}
+	}
+
+	private boolean containsVault(Path path) {
+		try {
+			if (path.getFileName().toString().endsWith(CRYPTOMATOR_FILENAME_EXT)) {
+				path = path.getParent();
+			}
+			return CryptoFileSystemProvider.checkDirStructureForVault(path, VAULTCONFIG_FILENAME, MASTERKEY_FILENAME) != DirStructure.UNRELATED;
+		} catch (IOException e) {
+			return false;
+		}
+	}
+
+	private void addVault(Path pathToVault) {
+		try {
+			if (pathToVault.getFileName().toString().endsWith(CRYPTOMATOR_FILENAME_EXT)) {
+				vaultListManager.add(pathToVault.getParent());
+			} else {
+				vaultListManager.add(pathToVault);
+			}
+		} catch (IOException e) {
+			LOG.debug("Not a vault: {}", pathToVault);
+		}
+	}
+
 	// Getter and Setter
 
 	public BooleanBinding emptyVaultListProperty() {
@@ -138,4 +206,13 @@ public class VaultListController implements FxController {
 		return emptyVaultList.get();
 	}
 
+	public BooleanProperty draggingVaultOverProperty() {
+		return draggingVaultOver;
+	}
+
+	public boolean isDraggingVaultOver() {
+		return draggingVaultOver.get();
+	}
+
+
 }

src/main/java/org/cryptomator/ui/mainwindow/WelcomeController.java

@@ -16,7 +16,7 @@ import javafx.fxml.FXML;
 public class WelcomeController implements FxController {
 
 	private static final Logger LOG = LoggerFactory.getLogger(WelcomeController.class);
-	private static final String GETTING_STARTED_URI = "https://docs.cryptomator.org/en/1.6/desktop/getting-started/";
+	private static final String GETTING_STARTED_URI = "https://docs.cryptomator.org/en/1.7/desktop/getting-started/";
 
 	private final Application application;
 	private final BooleanBinding noVaultPresent;

src/main/java/org/cryptomator/ui/migration/MigrationImpossibleController.java

@@ -10,7 +10,7 @@ import javafx.stage.Stage;
 
 public class MigrationImpossibleController implements FxController {
 
-	private static final String HELP_URI = "https://docs.cryptomator.org/en/1.6/help/manual-migration/";
+	private static final String HELP_URI = "https://docs.cryptomator.org/en/1.7/help/manual-migration/";
 
 	private final Application application;
 	private final Stage window;

src/main/java/org/cryptomator/ui/preferences/VolumePreferencesController.java

@@ -1,11 +1,14 @@
 package org.cryptomator.ui.preferences;
 
+import dagger.Lazy;
+import org.cryptomator.common.ObservableUtil;
 import org.cryptomator.common.settings.Settings;
 import org.cryptomator.integrations.mount.MountCapability;
 import org.cryptomator.integrations.mount.MountService;
 import org.cryptomator.ui.common.FxController;
 
 import javax.inject.Inject;
+import javafx.application.Application;
 import javafx.beans.binding.Bindings;
 import javafx.beans.binding.BooleanExpression;
 import javafx.beans.value.ObservableValue;
@@ -14,39 +17,58 @@ import javafx.scene.control.ChoiceBox;
 import javafx.scene.control.TextField;
 import javafx.util.StringConverter;
 import java.util.List;
+import java.util.Optional;
+import java.util.ResourceBundle;
 
-/**
- * TODO: if WebDAV is selected under Windows, show warning that specific mount options (like selecting a directory as mount point) are _not_ supported
- */
 @PreferencesScoped
 public class VolumePreferencesController implements FxController {
 
+	private static final String DOCS_MOUNTING_URL = "https://docs.cryptomator.org/en/1.7/desktop/volume-type/";
+
 	private final Settings settings;
 	private final ObservableValue<MountService> selectedMountService;
+	private final ResourceBundle resourceBundle;
 	private final BooleanExpression loopbackPortSupported;
+	private final ObservableValue<Boolean> mountToDirSupported;
+	private final ObservableValue<Boolean> mountToDriveLetterSupported;
+	private final ObservableValue<Boolean> mountFlagsSupported;
+	private final ObservableValue<Boolean> readonlySupported;
+	private final Lazy<Application> application;
 	private final List<MountService> mountProviders;
 	public ChoiceBox<MountService> volumeTypeChoiceBox;
 	public TextField loopbackPortField;
 	public Button loopbackPortApplyButton;
 
 	@Inject
-	VolumePreferencesController(Settings settings, List<MountService> mountProviders, ObservableValue<MountService> selectedMountService) {
+	VolumePreferencesController(Settings settings, Lazy<Application> application, List<MountService> mountProviders, ResourceBundle resourceBundle) {
 		this.settings = settings;
+		this.application = application;
 		this.mountProviders = mountProviders;
-		this.selectedMountService = selectedMountService;
+		this.resourceBundle = resourceBundle;
+
+		var fallbackProvider = mountProviders.stream().findFirst().orElse(null);
+		this.selectedMountService = ObservableUtil.mapWithDefault(settings.mountService(), serviceName -> mountProviders.stream().filter(s -> s.getClass().getName().equals(serviceName)).findFirst().orElse(fallbackProvider), fallbackProvider);
 		this.loopbackPortSupported = BooleanExpression.booleanExpression(selectedMountService.map(s -> s.hasCapability(MountCapability.LOOPBACK_PORT)));
+		this.mountToDirSupported = selectedMountService.map(s -> s.hasCapability(MountCapability.MOUNT_WITHIN_EXISTING_PARENT) || s.hasCapability(MountCapability.MOUNT_TO_EXISTING_DIR));
+		this.mountToDriveLetterSupported = selectedMountService.map(s -> s.hasCapability(MountCapability.MOUNT_AS_DRIVE_LETTER));
+		this.mountFlagsSupported = selectedMountService.map(s -> s.hasCapability(MountCapability.MOUNT_FLAGS));
+		this.readonlySupported = selectedMountService.map(s -> s.hasCapability(MountCapability.READ_ONLY));
 	}
 
 	public void initialize() {
+		volumeTypeChoiceBox.getItems().add(null);
 		volumeTypeChoiceBox.getItems().addAll(mountProviders);
 		volumeTypeChoiceBox.setConverter(new MountServiceConverter());
-		volumeTypeChoiceBox.getSelectionModel().select(selectedMountService.getValue());
-		volumeTypeChoiceBox.valueProperty().addListener((observableValue, oldProvide, newProvider) -> settings.mountService().set(newProvider.getClass().getName()));
+		boolean autoSelected = settings.mountService().get() == null;
+		volumeTypeChoiceBox.getSelectionModel().select(autoSelected ? null : selectedMountService.getValue());
+		volumeTypeChoiceBox.valueProperty().addListener((observableValue, oldProvider, newProvider) -> {
+			var toSet = Optional.ofNullable(newProvider).map(nP -> nP.getClass().getName()).orElse(null);
+			settings.mountService().set(toSet);
+		});
 
 		loopbackPortField.setText(String.valueOf(settings.port().get()));
 		loopbackPortApplyButton.visibleProperty().bind(settings.port().asString().isNotEqualTo(loopbackPortField.textProperty()));
 		loopbackPortApplyButton.disableProperty().bind(Bindings.createBooleanBinding(this::validateLoopbackPort, loopbackPortField.textProperty()).not());
-
 	}
 
 	private boolean validateLoopbackPort() {
@@ -75,13 +97,49 @@ public class VolumePreferencesController implements FxController {
 		return loopbackPortSupported.get();
 	}
 
+	public ObservableValue<Boolean> readonlySupportedProperty() {
+		return readonlySupported;
+	}
+
+	public boolean isReadonlySupported() {
+		return readonlySupported.getValue();
+	}
+
+	public ObservableValue<Boolean> mountToDirSupportedProperty() {
+		return mountToDirSupported;
+	}
+
+	public boolean isMountToDirSupported() {
+		return mountToDirSupported.getValue();
+	}
+
+	public ObservableValue<Boolean> mountToDriveLetterSupportedProperty() {
+		return mountToDriveLetterSupported;
+	}
+
+	public boolean isMountToDriveLetterSupported() {
+		return mountToDriveLetterSupported.getValue();
+	}
+
+	public ObservableValue<Boolean> mountFlagsSupportedProperty() {
+		return mountFlagsSupported;
+	}
+
+	public boolean isMountFlagsSupported() {
+		return mountFlagsSupported.getValue();
+	}
+
 	/* Helpers */
 
-	private static class MountServiceConverter extends StringConverter<MountService> {
+	private class MountServiceConverter extends StringConverter<MountService> {
 
 		@Override
 		public String toString(MountService provider) {
-			return provider== null? "None" : provider.displayName(); //TODO: adjust message
+			if (provider == null) {
+				return resourceBundle.getString("preferences.volume.type.automatic");
+			} else {
+				return provider.displayName();
+			}
 		}
 
 		@Override
@@ -90,5 +148,7 @@ public class VolumePreferencesController implements FxController {
 		}
 	}
 
-
+	public void openDocs() {
+		application.get().getHostServices().showDocument(DOCS_MOUNTING_URL);
+	}
 }

src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyRecoverController.java

@@ -4,6 +4,7 @@ import com.google.common.base.CharMatcher;
 import com.google.common.base.Strings;
 import dagger.Lazy;
 import org.cryptomator.common.Nullable;
+import org.cryptomator.common.ObservableUtil;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.cryptofs.VaultConfig;
 import org.cryptomator.cryptofs.VaultConfigLoadException;
@@ -15,9 +16,10 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
-import javafx.beans.binding.Bindings;
-import javafx.beans.binding.BooleanBinding;
+import javafx.beans.property.ObjectProperty;
+import javafx.beans.property.SimpleObjectProperty;
 import javafx.beans.property.StringProperty;
+import javafx.beans.value.ObservableValue;
 import javafx.fxml.FXML;
 import javafx.scene.Scene;
 import javafx.scene.control.TextArea;
@@ -38,11 +40,16 @@ public class RecoveryKeyRecoverController implements FxController {
 	private final Vault vault;
 	private final VaultConfig.UnverifiedVaultConfig unverifiedVaultConfig;
 	private final StringProperty recoveryKey;
+	private final ObservableValue<Boolean> recoveryKeyCorrect;
+	private final ObservableValue<Boolean> recoveryKeyWrong;
+	private final ObservableValue<Boolean> recoveryKeyInvalid;
 	private final RecoveryKeyFactory recoveryKeyFactory;
-	private final BooleanBinding validRecoveryKey;
+	private final ObjectProperty<RecoveryKeyState> recoveryKeyState;
 	private final Lazy<Scene> resetPasswordScene;
 	private final AutoCompleter autoCompleter;
 
+	private volatile boolean isWrongKey;
+
 	public TextArea textarea;
 
 	@Inject
@@ -53,14 +60,18 @@ public class RecoveryKeyRecoverController implements FxController {
 		this.unverifiedVaultConfig = unverifiedVaultConfig;
 		this.recoveryKey = recoveryKey;
 		this.recoveryKeyFactory = recoveryKeyFactory;
-		this.validRecoveryKey = Bindings.createBooleanBinding(this::isValidRecoveryKey, recoveryKey);
 		this.resetPasswordScene = resetPasswordScene;
 		this.autoCompleter = new AutoCompleter(recoveryKeyFactory.getDictionary());
+		this.recoveryKeyState = new SimpleObjectProperty<>();
+		this.recoveryKeyCorrect = ObservableUtil.mapWithDefault(recoveryKeyState, RecoveryKeyState.CORRECT::equals, false);
+		this.recoveryKeyWrong = ObservableUtil.mapWithDefault(recoveryKeyState, RecoveryKeyState.WRONG::equals, false);
+		this.recoveryKeyInvalid = ObservableUtil.mapWithDefault(recoveryKeyState, RecoveryKeyState.INVALID::equals, false);
 	}
 
 	@FXML
 	public void initialize() {
 		recoveryKey.bind(textarea.textProperty());
+		textarea.textProperty().addListener(((observable, oldValue, newValue) -> validateRecoveryKey()));
 	}
 
 	private TextFormatter.Change filterTextChange(TextFormatter.Change change) {
@@ -107,6 +118,12 @@ public class RecoveryKeyRecoverController implements FxController {
 		window.setScene(resetPasswordScene.get());
 	}
 
+	/**
+	 * Checks, if vault config is signed with the given key.
+	 *
+	 * @param key byte array of possible signing key
+	 * @return true, if vault config is signed with this key
+	 */
 	private boolean checkKeyAgainstVaultConfig(byte[] key) {
 		try {
 			var config = unverifiedVaultConfig.verify(key, unverifiedVaultConfig.allegedVaultVersion());
@@ -114,6 +131,7 @@ public class RecoveryKeyRecoverController implements FxController {
 			return true;
 		} catch (VaultKeyInvalidException e) {
 			LOG.debug("Provided recovery key does not match vault config signature.");
+			isWrongKey = true;
 			return false;
 		} catch (VaultConfigLoadException e) {
 			LOG.error("Failed to parse vault config", e);
@@ -121,25 +139,64 @@ public class RecoveryKeyRecoverController implements FxController {
 		}
 	}
 
+	private void validateRecoveryKey() {
+		isWrongKey = false;
+		var valid = recoveryKeyFactory.validateRecoveryKey(recoveryKey.get(), unverifiedVaultConfig != null ? this::checkKeyAgainstVaultConfig : null);
+		if (valid) {
+			recoveryKeyState.set(RecoveryKeyState.CORRECT);
+		} else if (isWrongKey) { //set via side effect in checkKeyAgainstVaultConfig()
+			recoveryKeyState.set(RecoveryKeyState.WRONG);
+		} else {
+			recoveryKeyState.set(RecoveryKeyState.INVALID);
+		}
+	}
+
 	/* Getter/Setter */
 
 	public Vault getVault() {
 		return vault;
 	}
 
-	public BooleanBinding validRecoveryKeyProperty() {
-		return validRecoveryKey;
-	}
-
-	public boolean isValidRecoveryKey() {
-		if (unverifiedVaultConfig != null) {
-			return recoveryKeyFactory.validateRecoveryKey(recoveryKey.get(), this::checkKeyAgainstVaultConfig);
-		} else {
-			return recoveryKeyFactory.validateRecoveryKey(recoveryKey.get());
-		}
-	}
-
 	public TextFormatter getRecoveryKeyTextFormatter() {
 		return new TextFormatter<>(this::filterTextChange);
 	}
+
+	public ObservableValue<Boolean> recoveryKeyInvalidProperty() {
+		return recoveryKeyInvalid;
+	}
+
+	public boolean isRecoveryKeyInvalid() {
+		return recoveryKeyInvalid.getValue();
+	}
+
+	public ObservableValue<Boolean> recoveryKeyCorrectProperty() {
+		return recoveryKeyCorrect;
+	}
+
+	public boolean isRecoveryKeyCorrect() {
+		return recoveryKeyCorrect.getValue();
+	}
+
+	public ObservableValue<Boolean> recoveryKeyWrongProperty() {
+		return recoveryKeyWrong;
+	}
+
+	public boolean isRecoveryKeyWrong() {
+		return recoveryKeyWrong.getValue();
+	}
+
+	private enum RecoveryKeyState {
+		/**
+		 * Recovery key is a valid key and belongs to this vault
+		 */
+		CORRECT,
+		/**
+		 * Recovery key is a valid key, but does not belong to this vault
+		 */
+		WRONG,
+		/**
+		 * Recovery key is not a valid key.
+		 */
+		INVALID;
+	}
 }

src/main/java/org/cryptomator/ui/stats/VaultStatisticsController.java

@@ -9,8 +9,10 @@ import javax.inject.Inject;
 import javafx.animation.Animation;
 import javafx.animation.KeyFrame;
 import javafx.animation.Timeline;
+import javafx.beans.binding.Bindings;
 import javafx.beans.binding.DoubleBinding;
 import javafx.beans.binding.LongBinding;
+import javafx.beans.property.LongProperty;
 import javafx.event.ActionEvent;
 import javafx.event.EventHandler;
 import javafx.fxml.FXML;
@@ -21,6 +23,7 @@ import javafx.scene.chart.XYChart.Series;
 import javafx.stage.Stage;
 import javafx.util.Duration;
 import java.util.Arrays;
+import java.util.concurrent.Callable;
 
 @VaultStatisticsScoped
 public class VaultStatisticsController implements FxController {
@@ -32,6 +35,7 @@ public class VaultStatisticsController implements FxController {
 	private final VaultStats stats;
 	private final Series<Number, Number> readData;
 	private final Series<Number, Number> writeData;
+	private final Series<Number, Number> accessData;
 	private final Timeline ioAnimation;
 	private final LongBinding bpsRead;
 	private final LongBinding bpsWritten;
@@ -44,15 +48,20 @@ public class VaultStatisticsController implements FxController {
 	private final LongBinding totalBytesDecrypted;
 	private final LongBinding filesRead;
 	private final LongBinding filesWritten;
+	private final LongBinding filesAccessed;
+	private final LongBinding totalFilesAccessed;
 	private final LongBinding bpsEncrypted;
 	private final LongBinding bpsDecrypted;
 
 	public AreaChart<Number, Number> readChart;
 	public AreaChart<Number, Number> writeChart;
+	public AreaChart<Number, Number> accessChart;
 	public NumberAxis readChartXAxis;
 	public NumberAxis readChartYAxis;
 	public NumberAxis writeChartXAxis;
 	public NumberAxis writeChartYAxis;
+	public NumberAxis accessChartXAxis;
+	public NumberAxis accessChartYAxis;
 
 	@Inject
 	public VaultStatisticsController(VaultStatisticsComponent component, @VaultStatisticsWindow Stage window, @VaultStatisticsWindow Vault vault) {
@@ -60,6 +69,7 @@ public class VaultStatisticsController implements FxController {
 		this.stats = vault.getStats();
 		this.readData = new Series<>();
 		this.writeData = new Series<>();
+		this.accessData = new Series<>();
 		this.bpsRead = WeakBindings.bindLong(stats.bytesPerSecondReadProperty());
 		this.bpsWritten = WeakBindings.bindLong(stats.bytesPerSecondWrittenProperty());
 		this.cacheHitRate = WeakBindings.bindDouble(stats.cacheHitRateProperty());
@@ -71,11 +81,13 @@ public class VaultStatisticsController implements FxController {
 		this.totalBytesEncrypted = WeakBindings.bindLong(stats.totalBytesEncryptedProperty());
 		this.filesRead = WeakBindings.bindLong(stats.filesRead());
 		this.filesWritten = WeakBindings.bindLong(stats.filesWritten());
+		this.filesAccessed = WeakBindings.bindLong(stats.filesAccessed());
+		this.totalFilesAccessed = WeakBindings.bindLong(stats.totalFilesAccessed());
 		this.bpsEncrypted = WeakBindings.bindLong(stats.bytesPerSecondEncryptedProperty());
 		this.bpsDecrypted = WeakBindings.bindLong(stats.bytesPerSecondDecryptedProperty());
 
 		this.ioAnimation = new Timeline(); //TODO Research better timer
-		ioAnimation.getKeyFrames().add(new KeyFrame(Duration.seconds(IO_SAMPLING_INTERVAL), new IoSamplingAnimationHandler(readData, writeData)));
+		ioAnimation.getKeyFrames().add(new KeyFrame(Duration.seconds(IO_SAMPLING_INTERVAL), new IoSamplingAnimationHandler(readData, writeData, accessData)));
 		ioAnimation.setCycleCount(Animation.INDEFINITE);
 		ioAnimation.play();
 
@@ -89,6 +101,7 @@ public class VaultStatisticsController implements FxController {
 	public void initialize() {
 		readChart.getData().addAll(readData);
 		writeChart.getData().addAll(writeData);
+		accessChart.getData().addAll(accessData);
 	}
 
 	private class IoSamplingAnimationHandler implements EventHandler<ActionEvent> {
@@ -96,16 +109,21 @@ public class VaultStatisticsController implements FxController {
 		private long step = IO_SAMPLING_STEPS;
 		private final Series<Number, Number> decryptedBytesRead;
 		private final Series<Number, Number> encryptedBytesWrite;
+		private final Series<Number, Number> accessedFiles;
 		private final long[] maxBuf = new long[IO_SAMPLING_STEPS];
+		private final long[] maxAccessBuf = new long[IO_SAMPLING_STEPS];
 
-		public IoSamplingAnimationHandler(Series<Number, Number> readData, Series<Number, Number> writeData) {
+
+		public IoSamplingAnimationHandler(Series<Number, Number> readData, Series<Number, Number> writeData, Series<Number, Number> accessData) {
 			this.decryptedBytesRead = readData;
 			this.encryptedBytesWrite = writeData;
+			this.accessedFiles = accessData;
 
 			// initialize data once and change value of data points later:
 			for (int i = 0; i < IO_SAMPLING_STEPS; i++) {
 				decryptedBytesRead.getData().add(new Data<>(i, 0));
 				encryptedBytesWrite.getData().add(new Data<>(i, 0));
+				accessedFiles.getData().add(new Data<>(i, 0));
 			}
 		}
 
@@ -114,17 +132,22 @@ public class VaultStatisticsController implements FxController {
 			final long currentStep = step++;
 			final long decBytes = stats.bytesPerSecondReadProperty().get();
 			final long encBytes = stats.bytesPerSecondWrittenProperty().get();
+			final long accFiles = stats.filesAccessed().get();
 
 			maxBuf[(int) currentStep % IO_SAMPLING_STEPS] = Math.max(decBytes, encBytes);
-			long allTimeMax = Arrays.stream(maxBuf).max().orElse(0l);
+			long allTimeMax = Arrays.stream(maxBuf).max().orElse(0L);
+			maxAccessBuf[(int) currentStep % IO_SAMPLING_STEPS] = accFiles;
+			long allTimeMaxAccessedFiles = Arrays.stream(maxAccessBuf).max().orElse(0L);
 
 			// remove oldest value:
 			decryptedBytesRead.getData().remove(0);
 			encryptedBytesWrite.getData().remove(0);
+			accessedFiles.getData().remove(0);
 
 			// add latest value:
 			decryptedBytesRead.getData().add(new Data<>(currentStep, decBytes));
 			encryptedBytesWrite.getData().add(new Data<>(currentStep, encBytes));
+			accessedFiles.getData().add(new Data<>(currentStep, accFiles));
 
 			// adjust ranges:
 			readChartXAxis.setLowerBound(currentStep - IO_SAMPLING_STEPS * 1.0);
@@ -133,6 +156,9 @@ public class VaultStatisticsController implements FxController {
 			writeChartXAxis.setLowerBound(currentStep - IO_SAMPLING_STEPS * 1.0);
 			writeChartXAxis.setUpperBound(currentStep);
 			writeChartYAxis.setUpperBound(allTimeMax);
+			accessChartXAxis.setLowerBound(currentStep - IO_SAMPLING_STEPS * 1.0);
+			accessChartXAxis.setUpperBound(currentStep);
+			accessChartYAxis.setUpperBound(allTimeMaxAccessedFiles);
 		}
 	}
 
@@ -207,4 +233,12 @@ public class VaultStatisticsController implements FxController {
 	public LongBinding filesWrittenProperty() {return filesWritten;}
 
 	public long getFilesWritten() {return filesWritten.get();}
+
+	public LongBinding filesAccessedProperty() {return filesAccessed;}
+
+	public long getFilesAccessed() {return filesAccessed.get();}
+
+	public LongBinding totalFilesAccessedProperty() {return totalFilesAccessed;}
+
+	public long getTotalFilesAccessed() {return totalFilesAccessed.get();}
 }

src/main/java/org/cryptomator/ui/traymenu/AwtTrayMenuController.java

@@ -1,5 +1,6 @@
 package org.cryptomator.ui.traymenu;
 
+import com.google.common.base.Preconditions;
 import org.apache.commons.lang3.SystemUtils;
 import org.cryptomator.integrations.common.CheckAvailability;
 import org.cryptomator.integrations.common.Priority;
@@ -19,6 +20,8 @@ import java.awt.PopupMenu;
 import java.awt.SystemTray;
 import java.awt.Toolkit;
 import java.awt.TrayIcon;
+import java.awt.event.MouseAdapter;
+import java.awt.event.MouseEvent;
 import java.util.List;
 
 @CheckAvailability
@@ -28,6 +31,7 @@ public class AwtTrayMenuController implements TrayMenuController {
 	private static final Logger LOG = LoggerFactory.getLogger(AwtTrayMenuController.class);
 
 	private final PopupMenu menu = new PopupMenu();
+	private TrayIcon trayIcon;
 
 	@CheckAvailability
 	public static boolean isAvailable() {
@@ -35,9 +39,9 @@ public class AwtTrayMenuController implements TrayMenuController {
 	}
 
 	@Override
-	public void showTrayIcon(byte[] rawImageData, Runnable defaultAction, String tooltip) throws TrayMenuException {
-		var image = Toolkit.getDefaultToolkit().createImage(rawImageData);
-		var trayIcon = new TrayIcon(image, tooltip, menu);
+	public void showTrayIcon(byte[] imageData, Runnable defaultAction, String tooltip) throws TrayMenuException {
+		var image = Toolkit.getDefaultToolkit().createImage(imageData);
+		trayIcon = new TrayIcon(image, tooltip, menu);
 
 		trayIcon.setImageAutoSize(true);
 		if (SystemUtils.IS_OS_WINDOWS) {
@@ -52,6 +56,15 @@ public class AwtTrayMenuController implements TrayMenuController {
 		}
 	}
 
+	@Override
+	public void updateTrayIcon(byte[] imageData) {
+		if (trayIcon == null) {
+			throw new IllegalStateException("Failed to update the icon as it has not yet been added");
+		}
+		var image = Toolkit.getDefaultToolkit().createImage(imageData);
+		trayIcon.setImage(image);
+	}
+
 	@Override
 	public void updateTrayMenu(List<TrayMenuItem> items) {
 		menu.removeAll();
@@ -59,8 +72,14 @@ public class AwtTrayMenuController implements TrayMenuController {
 	}
 
 	@Override
-	public void onBeforeOpenMenu(Runnable runnable) {
-
+	public void onBeforeOpenMenu(Runnable listener) {
+		Preconditions.checkNotNull(this.trayIcon);
+		this.trayIcon.addMouseListener(new MouseAdapter() {
+			@Override
+			public void mousePressed(MouseEvent e) {
+				listener.run();
+			}
+		});
 	}
 
 	private void addChildren(Menu menu, List<TrayMenuItem> items) {

src/main/java/org/cryptomator/ui/traymenu/TrayMenuBuilder.java

@@ -3,6 +3,7 @@ package org.cryptomator.ui.traymenu;
 import com.google.common.base.Preconditions;
 import org.apache.commons.lang3.SystemUtils;
 import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.common.vaults.VaultListManager;
 import org.cryptomator.integrations.tray.ActionItem;
 import org.cryptomator.integrations.tray.SeparatorItem;
 import org.cryptomator.integrations.tray.SubMenuItem;
@@ -32,7 +33,9 @@ public class TrayMenuBuilder {
 
 	private static final Logger LOG = LoggerFactory.getLogger(TrayMenuBuilder.class);
 	private static final String TRAY_ICON_MAC = "/img/tray_icon_mac@2x.png";
-	private static final String TRAY_ICON = "/img/window_icon_32.png";
+	private static final String TRAY_ICON_UNLOCKED_MAC = "/img/tray_icon_unlocked_mac@2x.png";
+	private static final String TRAY_ICON = "/img/tray_icon.png";
+	private static final String TRAY_ICON_UNLOCKED = "/img/tray_icon_unlocked.png";
 
 	private final ResourceBundle resourceBundle;
 	private final VaultService vaultService;
@@ -61,12 +64,15 @@ public class TrayMenuBuilder {
 			v.displayNameProperty().addListener(this::vaultListChanged);
 		});
 
-		try (var image = getClass().getResourceAsStream(SystemUtils.IS_OS_MAC_OSX ? TRAY_ICON_MAC : TRAY_ICON)) {
-			trayMenu.showTrayIcon(image.readAllBytes(), this::showMainWindow, "Cryptomator");
+		try {
+			trayMenu.showTrayIcon(getAppropriateTrayIconImage(), this::showMainWindow, "Cryptomator");
+			trayMenu.onBeforeOpenMenu(() -> {
+				for (Vault vault : vaults) {
+					VaultListManager.redetermineVaultState(vault);
+				}
+			});
 			rebuildMenu();
 			initialized = true;
-		} catch (IOException e) {
-			throw new UncheckedIOException("Failed to load embedded resource", e);
 		} catch (TrayMenuException e) {
 			LOG.error("Adding tray icon failed", e);
 		}
@@ -78,6 +84,7 @@ public class TrayMenuBuilder {
 
 	private void vaultListChanged(@SuppressWarnings("unused") Observable observable) {
 		assert Platform.isFxApplicationThread();
+		trayMenu.updateTrayIcon(getAppropriateTrayIconImage());
 		rebuildMenu();
 	}
 
@@ -148,4 +155,22 @@ public class TrayMenuBuilder {
 		appWindows.showPreferencesWindow(SelectedPreferencesTab.ANY);
 	}
 
+	private byte[] getAppropriateTrayIconImage() {
+		boolean isAnyVaultUnlocked = vaults.stream().anyMatch(Vault::isUnlocked);
+
+		String resourceName;
+		if (SystemUtils.IS_OS_MAC_OSX) {
+			resourceName = isAnyVaultUnlocked ? TRAY_ICON_UNLOCKED_MAC : TRAY_ICON_MAC;
+		} else {
+			resourceName = isAnyVaultUnlocked ? TRAY_ICON_UNLOCKED : TRAY_ICON;
+		}
+
+		try (var image = getClass().getResourceAsStream(resourceName)) {
+			assert image != null;
+			return image.readAllBytes();
+		} catch (IOException e) {
+			throw new UncheckedIOException("Failed to load tray icon image: " + resourceName, e);
+		}
+	}
+
 }

src/main/java/org/cryptomator/ui/unlock/UnlockInvalidMountPointController.java

@@ -1,11 +1,18 @@
 package org.cryptomator.ui.unlock;
 
+import org.cryptomator.common.mount.MountPointNotExistsException;
+import org.cryptomator.common.mount.MountPointNotSupportedException;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.ui.common.FxController;
+import org.cryptomator.ui.controls.FormattedLabel;
+import org.cryptomator.ui.fxapp.FxApplicationWindows;
+import org.cryptomator.ui.preferences.SelectedPreferencesTab;
 
 import javax.inject.Inject;
 import javafx.fxml.FXML;
 import javafx.stage.Stage;
+import java.util.ResourceBundle;
+import java.util.concurrent.atomic.AtomicReference;
 
 //At the current point in time only the CustomMountPointChooser may cause this window to be shown.
 @UnlockScoped
@@ -13,11 +20,32 @@ public class UnlockInvalidMountPointController implements FxController {
 
 	private final Stage window;
 	private final Vault vault;
+	private final AtomicReference<Throwable> unlockException;
+	private final FxApplicationWindows appWindows;
+	private final ResourceBundle resourceBundle;
+
+	public FormattedLabel dialogDescription;
 
 	@Inject
-	UnlockInvalidMountPointController(@UnlockWindow Stage window, @UnlockWindow Vault vault) {
+	UnlockInvalidMountPointController(@UnlockWindow Stage window, @UnlockWindow Vault vault, @UnlockWindow AtomicReference<Throwable> unlockException, FxApplicationWindows appWindows, ResourceBundle resourceBundle) {
 		this.window = window;
 		this.vault = vault;
+		this.unlockException = unlockException;
+		this.appWindows = appWindows;
+		this.resourceBundle = resourceBundle;
+	}
+
+	@FXML
+	public void initialize() {
+		var e = unlockException.get();
+		String translationKey = "unlock.error.customPath.description.generic";
+		if (e instanceof MountPointNotSupportedException) {
+			translationKey = "unlock.error.customPath.description.notSupported";
+		} else if (e instanceof MountPointNotExistsException) {
+			translationKey = "unlock.error.customPath.description.notExists";
+		}
+		dialogDescription.setFormat(resourceBundle.getString(translationKey));
+		dialogDescription.setArg1(e.getMessage());
 	}
 
 	@FXML
@@ -25,4 +53,10 @@ public class UnlockInvalidMountPointController implements FxController {
 		window.close();
 	}
 
+	@FXML
+	public void closeAndOpenPreferences() {
+		appWindows.showPreferencesWindow(SelectedPreferencesTab.VOLUME);
+		window.close();
+	}
+
 }

src/main/java/org/cryptomator/ui/unlock/UnlockModule.java

@@ -23,6 +23,7 @@ import javafx.stage.Modality;
 import javafx.stage.Stage;
 import java.util.Map;
 import java.util.ResourceBundle;
+import java.util.concurrent.atomic.AtomicReference;
 
 @Module(subcomponents = {KeyLoadingComponent.class})
 abstract class UnlockModule {
@@ -57,6 +58,13 @@ abstract class UnlockModule {
 		return compBuilder.vault(vault).window(window).build().keyloadingStrategy();
 	}
 
+	@Provides
+	@UnlockWindow
+	@UnlockScoped
+	static AtomicReference<Throwable> unlockException() {
+		return new AtomicReference<>();
+	}
+
 	@Provides
 	@FxmlScene(FxmlFile.UNLOCK_SUCCESS)
 	@UnlockScoped

src/main/java/org/cryptomator/ui/unlock/UnlockWorkflow.java

@@ -2,6 +2,7 @@ package org.cryptomator.ui.unlock;
 
 import com.google.common.base.Throwables;
 import dagger.Lazy;
+import org.cryptomator.common.mount.IllegalMountPointException;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.common.vaults.VaultState;
 import org.cryptomator.cryptolib.api.CryptoException;
@@ -20,6 +21,7 @@ import javafx.concurrent.Task;
 import javafx.scene.Scene;
 import javafx.stage.Stage;
 import java.io.IOException;
+import java.util.concurrent.atomic.AtomicReference;
 
 /**
  * A multi-step task that consists of background activities as well as user interaction.
@@ -38,9 +40,10 @@ public class UnlockWorkflow extends Task<Boolean> {
 	private final Lazy<Scene> invalidMountPointScene;
 	private final FxApplicationWindows appWindows;
 	private final KeyLoadingStrategy keyLoadingStrategy;
+	private final AtomicReference<Throwable> unlockFailedException;
 
 	@Inject
-	UnlockWorkflow(@UnlockWindow Stage window, @UnlockWindow Vault vault, VaultService vaultService, @FxmlScene(FxmlFile.UNLOCK_SUCCESS) Lazy<Scene> successScene, @FxmlScene(FxmlFile.UNLOCK_INVALID_MOUNT_POINT) Lazy<Scene> invalidMountPointScene, FxApplicationWindows appWindows, @UnlockWindow KeyLoadingStrategy keyLoadingStrategy) {
+	UnlockWorkflow(@UnlockWindow Stage window, @UnlockWindow Vault vault, VaultService vaultService, @FxmlScene(FxmlFile.UNLOCK_SUCCESS) Lazy<Scene> successScene, @FxmlScene(FxmlFile.UNLOCK_INVALID_MOUNT_POINT) Lazy<Scene> invalidMountPointScene, FxApplicationWindows appWindows, @UnlockWindow KeyLoadingStrategy keyLoadingStrategy, @UnlockWindow AtomicReference<Throwable> unlockFailedException) {
 		this.window = window;
 		this.vault = vault;
 		this.vaultService = vaultService;
@@ -48,6 +51,7 @@ public class UnlockWorkflow extends Task<Boolean> {
 		this.invalidMountPointScene = invalidMountPointScene;
 		this.appWindows = appWindows;
 		this.keyLoadingStrategy = keyLoadingStrategy;
+		this.unlockFailedException = unlockFailedException;
 	}
 
 	@Override
@@ -67,13 +71,15 @@ public class UnlockWorkflow extends Task<Boolean> {
 		} catch (Exception e) {
 			Throwables.propagateIfPossible(e, IOException.class);
 			Throwables.propagateIfPossible(e, CryptoException.class);
+			Throwables.propagateIfPossible(e, IllegalMountPointException.class);
 			Throwables.propagateIfPossible(e, MountFailedException.class);
 			throw new IllegalStateException("unexpected exception type", e);
 		}
 	}
 
-	private void showInvalidMountPointScene() {
+	private void handleIllegalMountPointError(IllegalMountPointException impe) {
 		Platform.runLater(() -> {
+			unlockFailedException.set(impe);
 			window.setScene(invalidMountPointScene.get());
 			window.show();
 		});
@@ -107,7 +113,11 @@ public class UnlockWorkflow extends Task<Boolean> {
 	protected void failed() {
 		LOG.info("Unlock of '{}' failed.", vault.getDisplayName());
 		Throwable throwable = super.getException();
-		handleGenericError(throwable);
+		if(throwable instanceof IllegalMountPointException impe) {
+			handleIllegalMountPointError(impe);
+		} else {
+			handleGenericError(throwable);
+		}
 		vault.stateProperty().transition(VaultState.Value.PROCESSING, VaultState.Value.LOCKED);
 	}
 

src/main/java/org/cryptomator/ui/vaultoptions/MountOptionsController.java

@@ -1,11 +1,14 @@
 package org.cryptomator.ui.vaultoptions;
 
-import org.cryptomator.common.Environment;
+import com.google.common.base.Strings;
+import org.cryptomator.common.mount.ActualMountService;
 import org.cryptomator.common.mount.WindowsDriveLetters;
+import org.cryptomator.common.settings.VaultSettings;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.integrations.mount.MountCapability;
-import org.cryptomator.integrations.mount.MountService;
 import org.cryptomator.ui.common.FxController;
+import org.cryptomator.ui.fxapp.FxApplicationWindows;
+import org.cryptomator.ui.preferences.SelectedPreferencesTab;
 
 import javax.inject.Inject;
 import javafx.beans.value.ObservableValue;
@@ -30,16 +33,17 @@ import java.util.Set;
 public class MountOptionsController implements FxController {
 
 	private final Stage window;
-	private final Vault vault;
+	private final VaultSettings vaultSettings;
 	private final WindowsDriveLetters windowsDriveLetters;
 	private final ResourceBundle resourceBundle;
 
+	private final ObservableValue<String> defaultMountFlags;
 	private final ObservableValue<Boolean> mountpointDirSupported;
 	private final ObservableValue<Boolean> mountpointDriveLetterSupported;
 	private final ObservableValue<Boolean> readOnlySupported;
 	private final ObservableValue<Boolean> mountFlagsSupported;
-	private final ObservableValue<Path> driveLetter;
 	private final ObservableValue<String> directoryPath;
+	private final FxApplicationWindows applicationWindows;
 
 
 	//-- FXML objects --
@@ -54,59 +58,75 @@ public class MountOptionsController implements FxController {
 	public ChoiceBox<Path> driveLetterSelection;
 
 	@Inject
-	MountOptionsController(@VaultOptionsWindow Stage window, @VaultOptionsWindow Vault vault, ObservableValue<MountService> mountService, WindowsDriveLetters windowsDriveLetters, ResourceBundle resourceBundle, Environment environment) {
+	MountOptionsController(@VaultOptionsWindow Stage window, @VaultOptionsWindow Vault vault, ObservableValue<ActualMountService> mountService, WindowsDriveLetters windowsDriveLetters, ResourceBundle resourceBundle, FxApplicationWindows applicationWindows) {
 		this.window = window;
-		this.vault = vault;
+		this.vaultSettings = vault.getVaultSettings();
 		this.windowsDriveLetters = windowsDriveLetters;
 		this.resourceBundle = resourceBundle;
-		this.mountpointDirSupported = mountService.map(s -> s.hasCapability(MountCapability.MOUNT_TO_EXISTING_DIR) || s.hasCapability(MountCapability.MOUNT_WITHIN_EXISTING_PARENT));
-		this.mountpointDriveLetterSupported = mountService.map(s -> s.hasCapability(MountCapability.MOUNT_AS_DRIVE_LETTER));
-		this.mountFlagsSupported = mountService.map(s -> s.hasCapability(MountCapability.MOUNT_FLAGS));
-		this.readOnlySupported = mountService.map(s -> s.hasCapability(MountCapability.READ_ONLY));
-		this.driveLetter = vault.getVaultSettings().mountPoint().map(p -> isDriveLetter(p) ? p : null);
+		this.defaultMountFlags = mountService.map(as -> {
+			if (as.service().hasCapability(MountCapability.MOUNT_FLAGS)) {
+				return as.service().getDefaultMountFlags();
+			} else {
+				return "";
+			}
+		});
+		this.mountpointDirSupported = mountService.map(as -> as.service().hasCapability(MountCapability.MOUNT_TO_EXISTING_DIR) || as.service().hasCapability(MountCapability.MOUNT_WITHIN_EXISTING_PARENT));
+		this.mountpointDriveLetterSupported = mountService.map(as -> as.service().hasCapability(MountCapability.MOUNT_AS_DRIVE_LETTER));
+		this.mountFlagsSupported = mountService.map(as -> as.service().hasCapability(MountCapability.MOUNT_FLAGS));
+		this.readOnlySupported = mountService.map(as -> as.service().hasCapability(MountCapability.READ_ONLY));
 		this.directoryPath = vault.getVaultSettings().mountPoint().map(p -> isDriveLetter(p) ? null : p.toString());
+		this.applicationWindows = applicationWindows;
 	}
 
 	@FXML
 	public void initialize() {
 		// readonly:
-		readOnlyCheckbox.selectedProperty().bindBidirectional(vault.getVaultSettings().usesReadOnlyMode());
+		readOnlyCheckbox.selectedProperty().bindBidirectional(vaultSettings.usesReadOnlyMode());
 
 		// custom mount flags:
 		mountFlagsField.disableProperty().bind(customMountFlagsCheckbox.selectedProperty().not());
-		customMountFlagsCheckbox.setSelected(vault.isHavingCustomMountFlags());
+		customMountFlagsCheckbox.setSelected(!Strings.isNullOrEmpty(vaultSettings.mountFlags().getValue()));
+		toggleUseCustomMountFlags();
 
 		//driveLetter choice box
 		driveLetterSelection.getItems().addAll(windowsDriveLetters.getAll());
 		driveLetterSelection.setConverter(new WinDriveLetterLabelConverter(windowsDriveLetters, resourceBundle));
-		driveLetterSelection.setOnShowing(event -> driveLetterSelection.setConverter(new WinDriveLetterLabelConverter(windowsDriveLetters, resourceBundle))); //TODO: does this work?
 
 		//mountPoint toggle group
-		var mountPoint = vault.getVaultSettings().getMountPoint();
+		var mountPoint = vaultSettings.getMountPoint();
 		if (mountPoint == null) {
 			//prepare and select auto
 			mountPointToggleGroup.selectToggle(mountPointAutoBtn);
 		} else if (mountPoint.getParent() == null && isDriveLetter(mountPoint)) {
 			//prepare and select drive letter
 			mountPointToggleGroup.selectToggle(mountPointDriveLetterBtn);
-		} else if (driveLetterSelection.getValue() == null) {
+			driveLetterSelection.valueProperty().bindBidirectional(vaultSettings.mountPoint());
+		} else {
 			//prepare and select dir
 			mountPointToggleGroup.selectToggle(mountPointDirBtn);
 		}
 		mountPointToggleGroup.selectedToggleProperty().addListener(this::selectedToggleChanged);
 	}
 
+	@FXML
+	public void openVolumePreferences() {
+		applicationWindows.showPreferencesWindow(SelectedPreferencesTab.VOLUME);
+	}
+
 	@FXML
 	public void toggleUseCustomMountFlags() {
 		if (customMountFlagsCheckbox.isSelected()) {
 			readOnlyCheckbox.setSelected(false); // to prevent invalid states
 			mountFlagsField.textProperty().unbind();
-			vault.setCustomMountFlags(vault.defaultMountFlagsProperty().getValue());
-			mountFlagsField.textProperty().bindBidirectional(vault.getVaultSettings().mountFlags());
+			var mountFlags = vaultSettings.mountFlags().get();
+			if (mountFlags == null || mountFlags.isBlank()) {
+				vaultSettings.mountFlags().set(defaultMountFlags.getValue());
+			}
+			mountFlagsField.textProperty().bindBidirectional(vaultSettings.mountFlags());
 		} else {
-			mountFlagsField.textProperty().unbindBidirectional(vault.getVaultSettings().mountFlags());
-			vault.setCustomMountFlags(null);
-			mountFlagsField.textProperty().bind(vault.defaultMountFlagsProperty());
+			mountFlagsField.textProperty().unbindBidirectional(vaultSettings.mountFlags());
+			vaultSettings.mountFlags().set(null);
+			mountFlagsField.textProperty().bind(defaultMountFlags);
 		}
 	}
 
@@ -114,7 +134,7 @@ public class MountOptionsController implements FxController {
 	public void chooseCustomMountPoint() {
 		try {
 			Path chosenPath = chooseCustomMountPointInternal();
-			vault.getVaultSettings().mountPoint().set(chosenPath);
+			vaultSettings.mountPoint().set(chosenPath);
 		} catch (NoDirSelectedException e) {
 			//no-op
 		}
@@ -131,7 +151,7 @@ public class MountOptionsController implements FxController {
 		DirectoryChooser directoryChooser = new DirectoryChooser();
 		directoryChooser.setTitle(resourceBundle.getString("vaultOptions.mount.mountPoint.directoryPickerTitle"));
 		try {
-			var mp = vault.getVaultSettings().mountPoint().get();
+			var mp = vaultSettings.mountPoint().get();
 			var initialDir = mp != null && !isDriveLetter(mp) ? mp : Path.of(System.getProperty("user.home"));
 
 			if (Files.isDirectory(initialDir)) {
@@ -149,27 +169,30 @@ public class MountOptionsController implements FxController {
 	}
 
 	private void selectedToggleChanged(ObservableValue<? extends Toggle> observable, Toggle oldToggle, Toggle newToggle) {
-		Path mountPointToBe = null;
-		try {
-			//Remark: the mountpoint corresponding to the newToggle must be null, otherwise it would not be new!
-			if (mountPointDriveLetterBtn.equals(newToggle)) {
-				mountPointToBe = driveLetterSelection.getItems().get(0);
-			} else if (mountPointDirBtn.equals(newToggle)) {
-				mountPointToBe = chooseCustomMountPointInternal();
-			}
-			vault.getVaultSettings().mountPoint().set(mountPointToBe);
-		} catch (NoDirSelectedException e) {
-			if (!mountPointDirBtn.equals(oldToggle)) {
-				mountPointToggleGroup.selectToggle(oldToggle);
-
+		//Remark: the mountpoint corresponding to the newToggle must be null, otherwise it would not be new!
+		driveLetterSelection.valueProperty().unbindBidirectional(vaultSettings.mountPoint());
+		if (mountPointDriveLetterBtn.equals(newToggle)) {
+			vaultSettings.mountPoint().set(windowsDriveLetters.getFirstDesiredAvailable().orElse(windowsDriveLetters.getAll().stream().findAny().get()));
+			driveLetterSelection.valueProperty().bindBidirectional(vaultSettings.mountPoint());
+		} else if (mountPointDirBtn.equals(newToggle)) {
+			try {
+				vaultSettings.mountPoint().set(chooseCustomMountPointInternal());
+			} catch (NoDirSelectedException e) {
+				if (oldToggle != null && !mountPointDirBtn.equals(oldToggle)) {
+					mountPointToggleGroup.selectToggle(oldToggle);
+				} else {
+					mountPointToggleGroup.selectToggle(mountPointAutoBtn);
+				}
 			}
+		} else {
+			vaultSettings.mountPoint().set(null);
 		}
 	}
 
 	private boolean isDriveLetter(Path mountPoint) {
 		if (mountPoint != null) {
 			var s = mountPoint.toString();
-			return s.length() == 3 && mountPoint.toString().endsWith(":\\");
+			return s.length() == 3 && s.endsWith(":\\");
 		}
 		return false;
 	}
@@ -237,21 +260,13 @@ public class MountOptionsController implements FxController {
 	}
 
 	public ObservableValue<Boolean> readOnlySupportedProperty() {
-		return mountpointDriveLetterSupported;
+		return readOnlySupported;
 	}
 
 	public boolean isReadOnlySupported() {
 		return readOnlySupported.getValue();
 	}
 
-	public ObservableValue<Path> driveLetterProperty() {
-		return driveLetter;
-	}
-
-	public Path getDriveLetter() {
-		return driveLetter.getValue();
-	}
-
 	public ObservableValue<String> directoryPathProperty() {
 		return directoryPath;
 	}
@@ -259,5 +274,4 @@ public class MountOptionsController implements FxController {
 	public String getDirectoryPath() {
 		return directoryPath.getValue();
 	}
-
 }