Leave installing the app to the package

core/src/os/macos/uninstall.rs

@@ -26,10 +26,8 @@ pub fn uninstall() -> Result<(), BoxError> {
         Err(error) if error.code() == errSecItemNotFound => false,
         Err(error) => return Err(error.into()),
     };
-    if system_keychain::load_secret(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT)?.is_some() {
-        system_keychain::delete_secret(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT)?;
-        removed = true;
-    }
+    // Reading a secret's data is limited to the extension, so delete without checking it exists.
+    system_keychain::delete_secret(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT)?;
     EnclaveKey::delete()?;
     for path in [CA_FILE, ENV_AGENT] {
         match std::fs::remove_file(path) {

macos/App/FirewallModel.swift

@@ -212,6 +212,9 @@ final class FirewallModel: NSObject, ObservableObject {
                 forExtensionWithIdentifier: FirewallIDs.extensionBundleID, queue: .main))
             extensionStep = .pending
             log("System extension deactivated, macOS finishes removing it on the next reboot")
+        } catch OSSystemExtensionError.extensionNotFound {
+            extensionStep = .pending
+            log("No system extension to deactivate")
         } catch {
             extensionStep = .failed(error.localizedDescription)
             log("Deactivation failed: \(error.localizedDescription)")

macos/build.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Builds and signs StrixFirewall.app, installs it to /Applications, and packages it as build/Firewall.pkg.
+# Builds and signs StrixFirewall.app and packages it as build/Firewall.pkg.
 # The package is notarized with the notarytool keychain profile in NOTARY_PROFILE; `build.sh debug`
 # makes a Debug build and skips notarization.
 #
@@ -39,7 +39,6 @@ PKG_ROOT=build/pkg-root
 main() {
   build
   sign
-  install_app
   package
   [ $CONFIGURATION = Debug ] || notarize
 }
@@ -64,13 +63,6 @@ sign() {
   codesign --verify --deep --strict "$APP"
 }
 
-# The extension can only be activated from /Applications.
-install_app() {
-  echo "==> Installing /Applications/StrixFirewall.app"
-  rm -rf /Applications/StrixFirewall.app
-  cp -R "$APP" /Applications/StrixFirewall.app
-}
-
 # Marked non-relocatable so the installer never updates another copy with the same bundle id.
 package() {
   echo "==> Packaging build/Firewall.pkg"