Build the macOS app for Intel Macs too

The MSI's exit dialog starts it from the unelevated UI process, so it runs
as the signed-in user.

core/Cargo.lock

@@ -261,6 +261,15 @@ dependencies = [
  "hybrid-array",
 ]
 
+[[package]]
+name = "block2"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
+dependencies = [
+ "objc2",
+]
+
 [[package]]
 name = "borsh"
 version = "1.8.1"
@@ -669,6 +678,16 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "dispatch2"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2",
+]
+
 [[package]]
 name = "displaydoc"
 version = "0.2.7"
@@ -680,6 +699,12 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "dpi"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
+
 [[package]]
 name = "either"
 version = "1.18.0"
@@ -751,6 +776,15 @@ dependencies = [
  "getrandom 0.4.3",
 ]
 
+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.13"
@@ -771,7 +805,7 @@ checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
 dependencies = [
  "crc32fast",
  "libz-sys",
- "miniz_oxide",
+ "miniz_oxide 0.9.1",
  "zlib-rs",
 ]
 
@@ -1452,6 +1486,16 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "keyboard-types"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fbe853b403ae61a04233030ae8a79d94975281ed9770a1f9e246732b534b28d"
+dependencies = [
+ "bitflags 2.13.2",
+ "serde",
+]
+
 [[package]]
 name = "konst"
 version = "0.2.20"
@@ -1595,6 +1639,16 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
 [[package]]
 name = "miniz_oxide"
 version = "0.9.1"
@@ -1636,6 +1690,24 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "muda"
+version = "0.21.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4340e89c178916e62879c5c36b7f699019369be413e496178a6983ce91b8bc03"
+dependencies = [
+ "crossbeam-channel",
+ "dpi",
+ "keyboard-types",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "png",
+ "thiserror",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "multer"
 version = "3.1.0"
@@ -1742,6 +1814,66 @@ dependencies = [
  "autocfg",
 ]
 
+[[package]]
+name = "objc2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08849bbd4767dfae9457696856ae1c84fe4e0281bbe4a7abff2d0e06fb7981f8"
+dependencies = [
+ "objc2-encode",
+]
+
+[[package]]
+name = "objc2-app-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+dependencies = [
+ "bitflags 2.13.2",
+ "dispatch2",
+ "objc2",
+]
+
+[[package]]
+name = "objc2-core-graphics"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-encode"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
+
+[[package]]
+name = "objc2-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2",
+ "objc2",
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "oid-registry"
 version = "0.8.1"
@@ -1864,6 +1996,19 @@ version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
 
+[[package]]
+name = "png"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+dependencies = [
+ "bitflags 2.13.2",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide 0.8.9",
+]
+
 [[package]]
 name = "portable-atomic"
 version = "1.15.0"
@@ -3230,7 +3375,9 @@ dependencies = [
  "clap",
  "core-foundation 0.10.1",
  "directories",
+ "muda",
  "percent-encoding",
+ "png",
  "rama",
  "rand",
  "rcgen",
@@ -3246,6 +3393,7 @@ dependencies = [
  "tracing",
  "tracing-appender",
  "tracing-subscriber",
+ "tray-icon",
  "which",
  "windows",
  "windows-registry",
@@ -3652,6 +3800,25 @@ dependencies = [
  "tracing-serde",
 ]
 
+[[package]]
+name = "tray-icon"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f5cc5858ecf9574ddd8f0032a2ff7ffd6f7724d2b81e48b9374984b3fd6ddc9"
+dependencies = [
+ "crossbeam-channel",
+ "muda",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-foundation",
+ "once_cell",
+ "png",
+ "thiserror",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "try-lock"
 version = "0.2.5"

core/Cargo.toml

@@ -11,9 +11,9 @@ homepage = "https://github.com/usestrix/firewall"
 # as an integration test; new tests/*.rs need an explicit [[test]] entry.
 autotests = false
 
-# Only Windows ships the service.
+# Only Windows ships the service and tray.
 [package.metadata.dist.binaries]
-x86_64-pc-windows-msvc = ["firewall", "firewall-service"]
+x86_64-pc-windows-msvc = ["firewall", "firewall-service", "firewall-tray"]
 aarch64-apple-darwin = ["firewall"]
 x86_64-apple-darwin = ["firewall"]
 aarch64-unknown-linux-gnu = ["firewall"]
@@ -39,6 +39,10 @@ path = "src/main.rs"
 name = "firewall-service"
 path = "src/bin/firewall-service.rs"
 
+[[bin]]
+name = "firewall-tray"
+path = "src/bin/firewall-tray.rs"
+
 [[bin]]
 name = "firewall-uninstall"
 path = "src/bin/firewall-uninstall.rs"
@@ -107,19 +111,14 @@ security-framework = "3.7.0"
 security-framework-sys = "2.17.0"
 
 [target.'cfg(windows)'.dependencies]
+muda = { version = "0.21.2", default-features = false }
+png = "0.18.1"
 rama = { version = "0.4.0", features = ["dns-hickory"] }
 schannel = "0.1.29"
 tokio = { version = "1.53.1", features = ["net"] }
 tracing-appender = "0.2.5"
-windows = { version = "0.62", features = [
-    "Win32_Foundation",
-    "Win32_Security",
-    "Win32_Security_Authorization",
-    "Win32_Security_Cryptography",
-    "Win32_System_Com",
-    "Win32_System_Environment",
-    "Win32_UI_Shell",
-] }
+tray-icon = { version = "0.26.1", default-features = false }
+windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Security_Cryptography", "Win32_System_Com", "Win32_System_Environment", "Win32_System_Threading", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
 windows-registry = "0.6.1"
 windows-service = "0.8.0"
 

core/src/aliasing/forward.rs

@@ -89,12 +89,16 @@ async fn handle(req: Request, firewall: &Firewall) -> Result<Response, Infallibl
     }
 
     info!(method = %req.method(), %url, "forwarding");
-    let index = firewall.is_index_url(&url);
+    // Only an HTTPS registry was downgraded to reach us, so only it is upgraded back and rewritten.
+    let tls = firewall.is_https_url(&url);
+    let index = tls && firewall.is_index_url(&url);
     let (mut parts, body) = req.into_parts();
-    let Ok(uri) = url.parse() else {
-        return Ok(text(400, "firewall: expected an absolute URL\n"));
-    };
-    parts.uri = uri;
+    if tls {
+        let Ok(uri) = url.parse() else {
+            return Ok(text(400, "firewall: expected an absolute URL\n"));
+        };
+        parts.uri = uri;
+    }
 
     let client = DecompressionLayer::new().into_layer(EasyHttpWebClient::default());
     let response = match client.serve(Request::from_parts(parts, body)).await {

core/src/bin/firewall-tray.rs

@@ -0,0 +1,11 @@
+//! The notification-area icon, started at sign-in. A GUI app, so no console opens with it.
+#![windows_subsystem = "windows"]
+
+#[cfg(windows)]
+fn main() -> Result<(), rama::error::BoxError> {
+    firewall::os::windows::run_tray()
+}
+
+/// The tray is Windows-only.
+#[cfg(not(windows))]
+fn main() {}

core/src/firewall.rs

@@ -47,6 +47,11 @@ impl Firewall {
         self.config.hosts()
     }
 
+    pub fn is_https_url(&self, url: &str) -> bool {
+        let host = host_of(url);
+        self.config.registries.iter().any(|r| r.upstream.starts_with("https://") && r.host() == host)
+    }
+
     pub fn is_index_url(&self, url: &str) -> bool {
         self.config.registries.iter().any(|r| r.index && r.host() == host_of(url))
     }

core/src/os/windows/mod.rs

@@ -4,10 +4,12 @@
 mod ca;
 mod service;
 mod tpm;
+mod tray;
 mod uninstall;
 
 pub use service::run as run_service;
 pub use tpm::CaKey;
+pub use tray::run as run_tray;
 pub use uninstall::uninstall;
 
 use rama::error::BoxError;

core/src/os/windows/tray.rs

@@ -0,0 +1,195 @@
+//! The notification-area icon, started at sign-in as the menu bar app is on macOS.
+
+use super::*;
+use muda::{Menu, MenuEvent, MenuItem, PredefinedMenuItem};
+use std::io::Cursor;
+use tray_icon::{Icon, MouseButtonState, TrayIcon, TrayIconBuilder, TrayIconEvent};
+use windows::core::{w, PCWSTR};
+use windows::Win32::Foundation::*;
+use windows::Win32::System::Threading::CreateMutexW;
+use windows::Win32::UI::Shell::*;
+use windows::Win32::UI::WindowsAndMessaging::*;
+use windows_registry::CURRENT_USER;
+use windows_service::service::{Service, ServiceAccess, ServiceState};
+use windows_service::service_manager::{ServiceManager, ServiceManagerAccess};
+
+const MENU_PAUSE: &str = "pause";
+const MENU_LOG: &str = "log";
+const MENU_QUIT: &str = "quit";
+const LOGO: &[u8] = include_bytes!("tray.png");
+
+/// Runs until Quit, once per session.
+pub fn run() -> Result<(), BoxError> {
+    // Held until we exit.
+    let _mutex = unsafe { CreateMutexW(None, false, w!(r"Local\StrixFirewallTray"))? };
+    if unsafe { GetLastError() } == ERROR_ALREADY_EXISTS {
+        return Ok(());
+    }
+    let status = MenuItem::new("", false, None);
+    let pause = MenuItem::with_id(MENU_PAUSE, "", false, None);
+    let menu = Menu::with_items(&[
+        &status,
+        &PredefinedMenuItem::separator(),
+        &pause,
+        &MenuItem::with_id(MENU_LOG, "Open logs", true, None),
+        &PredefinedMenuItem::separator(),
+        &MenuItem::with_id(MENU_QUIT, "Quit", true, None),
+    ])?;
+    let (logo, logo_size) = logo_mask()?;
+    let icon = TrayIconBuilder::new().with_menu(Box::new(menu)).build()?;
+    let window = HWND(icon.window_handle());
+    let mut tray = Tray {
+        icon,
+        logo,
+        logo_size,
+        drawn: None,
+        status,
+        pause,
+        state: None,
+    };
+    tray.update();
+    unsafe { SetTimer(None, 0, 2000, None) };
+    let mut message = MSG::default();
+    while unsafe { GetMessageW(&mut message, None, 0, 0) }.0 > 0 {
+        unsafe { DispatchMessageW(&message) };
+        // WM_CLOSE, as the MSI sends, destroys the icon's window.
+        if !unsafe { IsWindow(Some(window)) }.as_bool() {
+            break;
+        }
+        // Ours, not the icon window's own hover timer.
+        if message.message == WM_TIMER && message.hwnd.is_invalid() {
+            tray.update();
+        }
+        while let Ok(event) = TrayIconEvent::receiver().try_recv() {
+            // The menu opens on release, so this keeps it current.
+            if let TrayIconEvent::Click {
+                button_state: MouseButtonState::Down,
+                ..
+            } = event
+            {
+                tray.update();
+            }
+        }
+        while let Ok(event) = MenuEvent::receiver().try_recv() {
+            if event.id == MENU_QUIT {
+                return Ok(());
+            }
+            tray.on_menu(event.id.as_ref());
+        }
+    }
+    Ok(())
+}
+
+struct Tray {
+    icon: TrayIcon,
+    /// The logo's alpha channel; it is square.
+    logo: Vec<u8>,
+    logo_size: u32,
+    /// Whether the taskbar was light and the service screening when the icon was last set.
+    drawn: Option<(bool, bool)>,
+    status: MenuItem,
+    pause: MenuItem,
+    /// As the menu last showed it.
+    state: Option<ServiceState>,
+}
+
+impl Tray {
+    fn update(&mut self) {
+        self.state = service_state();
+        let screening = self.state == Some(ServiceState::Running);
+        let light = light_taskbar();
+        if self.drawn != Some((light, screening)) {
+            let rgba = logo_rgba(&self.logo, light, screening);
+            if let Ok(icon) = Icon::from_rgba(rgba, self.logo_size, self.logo_size) {
+                let _ = self.icon.set_icon(Some(icon));
+            }
+            self.drawn = Some((light, screening));
+        }
+        let text = status_text(self.state);
+        let tip = format!("Strix Firewall: {text}");
+        let _ = self.icon.set_tooltip(Some(tip));
+        self.status.set_text(text);
+        let pause = if screening { "Pause" } else { "Resume" };
+        self.pause.set_text(pause);
+        self.pause.set_enabled(self.state.is_some());
+    }
+
+    fn on_menu(&self, id: &str) {
+        let state = self.state;
+        let screening = state == Some(ServiceState::Running);
+        let action: fn() -> Result<(), BoxError> = match id {
+            MENU_PAUSE if screening => || Ok(open_service()?.pause().map(drop)?),
+            MENU_PAUSE if state == Some(ServiceState::Paused) => {
+                || Ok(open_service()?.resume().map(drop)?)
+            }
+            MENU_PAUSE => || Ok(open_service()?.start::<&str>(&[])?),
+            MENU_LOG => {
+                let log = HSTRING::from(data_dir().as_path());
+                let none = PCWSTR::null();
+                unsafe { ShellExecuteW(None, w!("open"), &log, none, none, SW_SHOWNORMAL) };
+                return;
+            }
+            _ => return,
+        };
+        if let Err(error) = action() {
+            let text = HSTRING::from(error.to_string());
+            unsafe { MessageBoxW(None, &text, w!("Strix Firewall"), MB_ICONERROR) };
+        }
+    }
+}
+
+/// `None` when the service is not installed.
+fn service_state() -> Option<ServiceState> {
+    let manager =
+        ServiceManager::local_computer(None::<&str>, ServiceManagerAccess::CONNECT).ok()?;
+    let service = manager
+        .open_service(SERVICE_NAME, ServiceAccess::QUERY_STATUS)
+        .ok()?;
+    Some(service.query_status().ok()?.current_state)
+}
+
+fn light_taskbar() -> bool {
+    let personalize = r"Software\Microsoft\Windows\CurrentVersion\Themes\Personalize";
+    let Ok(key) = CURRENT_USER.open(personalize) else {
+        return false;
+    };
+    key.get_u32("SystemUsesLightTheme").is_ok_and(|light| light == 1)
+}
+
+fn status_text(state: Option<ServiceState>) -> &'static str {
+    match state {
+        Some(ServiceState::Running) => "Screening downloads",
+        Some(ServiceState::Paused) => "Paused",
+        _ => "Not running",
+    }
+}
+
+fn open_service() -> Result<Service, BoxError> {
+    let manager = ServiceManager::local_computer(None::<&str>, ServiceManagerAccess::CONNECT)?;
+    let access = ServiceAccess::START | ServiceAccess::PAUSE_CONTINUE;
+    Ok(manager.open_service(SERVICE_NAME, access)?)
+}
+
+/// The alpha channel of the RGBA logo, and its width.
+fn logo_mask() -> Result<(Vec<u8>, u32), BoxError> {
+    let mut reader = png::Decoder::new(Cursor::new(LOGO)).read_info()?;
+    let mut rgba = vec![0; reader.output_buffer_size().ok_or("logo too large")?];
+    let info = reader.next_frame(&mut rgba)?;
+    let mut alpha = Vec::with_capacity(rgba.len() / 4);
+    for pixel in rgba.chunks(4) {
+        alpha.push(pixel[3]);
+    }
+    Ok((alpha, info.width))
+}
+
+/// White on a dark taskbar and black on a light one, as macOS draws a template image; dimmed
+/// when not screening.
+fn logo_rgba(mask: &[u8], light: bool, screening: bool) -> Vec<u8> {
+    let shade = if light { 0 } else { 255 };
+    let mut rgba = Vec::with_capacity(mask.len() * 4);
+    for &alpha in mask {
+        let alpha = if screening { alpha } else { alpha / 2 };
+        rgba.extend([shade, shade, shade, alpha]);
+    }
+    rgba
+}

core/tests/forward.rs

@@ -1,7 +1,9 @@
 use firewall::aliasing::forward::downgrade;
 use firewall::http::https_url;
-use firewall::Firewall;
+use firewall::{aliasing, Firewall, FirewallConfig};
 use rama::http::{Body, Request};
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream};
 
 fn request(target: &str, host: Option<&str>) -> Request {
     let mut builder = Request::builder().method("GET").uri(target);
@@ -35,6 +37,25 @@ fn requests_always_go_out_over_tls() {
     assert_eq!(https_url(&request("/six", None)), None);
 }
 
+#[test]
+fn a_plain_http_upstream_is_not_upgraded() {
+    let upstream = TcpListener::bind("127.0.0.1:0").expect("bind");
+    let addr = upstream.local_addr().expect("address");
+    std::thread::spawn(move || {
+        let (mut stream, _) = upstream.accept().expect("accept");
+        let _ = stream.read(&mut [0; 4096]);
+        let _ = stream.write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok");
+    });
+
+    let port = aliasing::spawn(0, FirewallConfig::default()).expect("spawn");
+    let mut proxy = TcpStream::connect(("127.0.0.1", port)).expect("connect");
+    let request = format!("GET http://{addr}/x HTTP/1.1\r\nHost: {addr}\r\nConnection: close\r\n\r\n");
+    proxy.write_all(request.as_bytes()).expect("write");
+    let mut response = String::new();
+    proxy.read_to_string(&mut response).expect("read");
+    assert!(response.starts_with("HTTP/1.1 200") && response.ends_with("ok"), "{response}");
+}
+
 #[tokio::test]
 async fn downgrade_touches_known_hosts_in_text_only() {
     let text = b"https://pypi.org/x https://example.com/y".to_vec();

core/wix/main.wxs

@@ -21,7 +21,7 @@
     <?define PlatformProgramFilesFolder = "ProgramFilesFolder" ?>
 <?endif ?>
 
-<Wix xmlns='http://schemas.microsoft.com/wix/2006/wi'>
+<Wix xmlns='http://schemas.microsoft.com/wix/2006/wi' xmlns:util='http://schemas.microsoft.com/wix/UtilExtension'>
 
     <Product
         Id='*'
@@ -95,6 +95,20 @@
                         <Environment Id='NODE_EXTRA_CA_CERTS' Name='NODE_EXTRA_CA_CERTS' Value='[CommonAppDataFolder]Strix Firewall\ca.pem' Action='set' System='yes'/>
                         <Environment Id='UV_SYSTEM_CERTS' Name='UV_SYSTEM_CERTS' Value='1' Action='set' System='yes'/>
                     </Component>
+                    <Component Id='binary2' Guid='*'>
+                        <File
+                            Id='exe2'
+                            Name='firewall-tray.exe'
+                            DiskId='1'
+                            Source='$(var.CargoTargetBinDir)\firewall-tray.exe'
+                            KeyPath='yes'/>
+                        <RegistryValue
+                            Root='HKLM'
+                            Key='SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
+                            Name='Strix Firewall'
+                            Type='string'
+                            Value='"[#exe2]"'/>
+                    </Component>
                 </Directory>
             </Directory>
         </Directory>
@@ -110,6 +124,7 @@
             Absent='disallow'>
             <ComponentRef Id='binary0'/>
             <ComponentRef Id='binary1'/>
+            <ComponentRef Id='binary2'/>
 
             <Feature
                 Id='Environment'
@@ -147,11 +162,21 @@
             Execute='deferred'
             Impersonate='no'
             Return='check'/>
+        <!-- From the exit dialog, which runs as the signed-in user rather than elevated. -->
+        <CustomAction
+            Id='StartTray'
+            Directory='APPLICATIONFOLDER'
+            ExeCommand='"[#exe2]"'
+            Return='asyncNoWait'/>
+        <!-- Before its file is replaced or removed. Trays WM_CLOSE does not reach, as in other sessions, are terminated. -->
+        <util:CloseApplication Id='CloseTray' Target='firewall-tray.exe' CloseMessage='yes' RebootPrompt='no' TerminateProcess='0'/>
         <InstallExecuteSequence>
             <!-- An upgrade removes the old version too, but should keep screening. -->
             <Custom Action='UninstallFirewall' After='DeleteServices'>REMOVE~="ALL" AND NOT UPGRADINGPRODUCTCODE</Custom>
             <Custom Action='SetFailureActions' After='InstallServices'>NOT REMOVE~="ALL"</Custom>
             <Custom Action='SetFailureFlag' After='SetFailureActions'>NOT REMOVE~="ALL"</Custom>
+            <!-- The default, before InstallFiles, is after RemoveFiles, which would find the tray still running. -->
+            <Custom Action='WixCloseApplications' Before='RemoveFiles'/>
         </InstallExecuteSequence>
 
         <SetProperty Id='ARPINSTALLLOCATION' Value='[APPLICATIONFOLDER]' After='CostFinalize'/>
@@ -161,6 +186,7 @@
             <UIRef Id='WixUI_FeatureTree'/>
             <Publish Dialog='WelcomeDlg' Control='Next' Event='NewDialog' Value='CustomizeDlg' Order='99'>1</Publish>
             <Publish Dialog='CustomizeDlg' Control='Back' Event='NewDialog' Value='WelcomeDlg' Order='99'>1</Publish>
+            <Publish Dialog='ExitDialog' Control='Finish' Event='DoAction' Value='StartTray' Order='1'>NOT Installed</Publish>
         </UI>
     </Product>
 

macos/build.sh

@@ -47,6 +47,7 @@ build() {
   echo "==> Building"
   xcodegen generate >/dev/null
   xcodebuild -project Firewall.xcodeproj -scheme StrixFirewall -configuration $CONFIGURATION \
+    -destination generic/platform=macOS \
     -derivedDataPath build CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
     CODE_SIGN_IDENTITY="" CODE_SIGN_ENTITLEMENTS="" build >/dev/null
 }

macos/project.yml

@@ -10,7 +10,7 @@ settings:
     "CARGO_PROFILE[config=Debug]": debug
     "LIBRARY_SEARCH_PATHS[arch=arm64]": $(SRCROOT)/../core/target/aarch64-apple-darwin/$(CARGO_PROFILE)
     "LIBRARY_SEARCH_PATHS[arch=x86_64]": $(SRCROOT)/../core/target/x86_64-apple-darwin/$(CARGO_PROFILE)
-    ARCHS: arm64
+    ARCHS: arm64 x86_64
     "ONLY_ACTIVE_ARCH[config=Debug]": "YES"
     SWIFT_VERSION: "5.0"
     DEVELOPMENT_TEAM: ${TEAM}
@@ -127,5 +127,13 @@ targets:
           unset CC CXX CFLAGS CXXFLAGS
           export SDKROOT="$(xcrun --sdk macosx --show-sdk-path)"
           cd "$SRCROOT/../core"
-          cargo build --bin firewall-uninstall --target aarch64-apple-darwin $([ "$CONFIGURATION" = Debug ] || echo --release)
-          cp "target/aarch64-apple-darwin/$CARGO_PROFILE/firewall-uninstall" "$TARGET_BUILD_DIR/$EXECUTABLE_FOLDER_PATH/"
+          bins=
+          for arch in $ARCHS; do
+            case $arch in
+              arm64|arm64e) triple=aarch64-apple-darwin ;;
+              x86_64)       triple=x86_64-apple-darwin ;;
+            esac
+            cargo build --bin firewall-uninstall --target $triple $([ "$CONFIGURATION" = Debug ] || echo --release)
+            bins="$bins target/$triple/$CARGO_PROFILE/firewall-uninstall"
+          done
+          lipo -create $bins -output "$TARGET_BUILD_DIR/$EXECUTABLE_FOLDER_PATH/firewall-uninstall"