FairPLay is not working after PatchedMediaKeysApple polyfill is removed

[pedjoni8]

Hi, I'm in the process of developing html5 player with DRM support.

While I was going through some working examples, I've noticed that Pallycon sample with Shaka player does not work since PatchedMediaKeysApple polyfill is removed for newer Safari versions.

const safariVersion = shaka.util.Platform.safariVersion();
if (navigator.requestMediaKeySystemAccess &&
// eslint-disable-next-line no-restricted-syntax
MediaKeySystemAccess.prototype.getConfiguration &&
safariVersion && safariVersion >= 14) {
// Unprefixed EME is preferable.
return;
}

When I used one of the hosted builds (for example), FPS is working, because PatchedMediaKeysApple polyfill code part is commented, but when I've used github code with latest commit, FPS is not wokring.

Is this behavior expected?

[joeyparrish]

No, it's not expected. That was recently changed, but the change hasn't made it into a release yet. What you see on appspot is the most recent release.

@pedjoni8, what version of Safari are you using? What version of macOS / iOS?

@valotvince, I believe that was a change you made, correct? Any advice? Can you help debug?

[pedjoni8]

@pedjoni8, what version of Safari are you using? What version of macOS / iOS?

macOS 12.1
Safari 15.2

[pedjoni8]

I've accidentally closed issue, sorry about that.

[valotvince]

👋 I've taken a quick look to the code, and the license errors with:

{
    "body": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<response result=\"7308\" message=\"The FairPlay assetId is invalid.\" />\r\n",
    "errorCode": 7308,
    "message": "The FairPlay assetId is invalid."
}

@pedjoni8 Does your fairplay token sent in pallycon-customdata-v2 gives the contentId to the license server ?

Something I didn't anticipated in my PR is the need of the contentId through skd initDataType. It could be retrieved but is not accessible from outside Shaka lib right now.

// SKD
shaka.util.StringUtils.fromCharCode(initData); 
// outputs
"skd://T+sQ7D47tr4kenQNWK5ISQ=="

// SINF
shaka.util.StringUtils.fromCharCode(initData); 
// outputs
"{sinf: [...base64 encoded sinf mp4 box]}"

We could set a new parameter on the license request licenseInitData to allow people using Shaka to get the contentId into a requestFilter and give it like they want to their license server. We should also send licenseInitDataType since operations on initData should be different between skd, sinf, cenc, ... WYT @joeyparrish @pedjoni8 ?

[pedjoni8]

pallycon sends content id through modified initData.

They are using this callback:
player.configure('drm.initDataTransform', function (initData, initDataType){ const skdUri = shaka.util.StringUtils.fromBytesAutoDetect(initData); console.log('skdUri : ' + skdUri); const contentId = skdUri.substring(skdUri.indexOf('skd://') + 6); console.log('contentId : ', contentId); const cert = player.drmInfo().serverCertificate; return shaka.util.FairPlayUtils.initDataTransform(initData, contentId, cert); });

In case when PatchedMediaKeysApple polyfill is not used, callback is not called (because shaka.util.Platform.isMediaKeysPolyfilled()) returns false.

This is something I see from debugging, have in mind I'm not not that good in this DRM stuff as you are :)

[valotvince]

@pedjoni8 Yep since latest Safari, we can use the standard EME API to setup & request a license, rather than the Apple MediaKeys. In that case, the initDataTransform doesn't work because we're using the standard, rather than specific APIs from Safari.

Pallycon should already support that way since they already support Widevine, PlayReady through modern EME APIs, we just have to find out how it works 😅 (maybe talk to them through customer support ?)

[pedjoni8]

@valotvince I can try, I'm not subscribed on their platform, but I can open issue on their GitHub :)

[joeyparrish]

Hi everyone,

Please see if the changes in #4030 resolve this for you. Thanks!

[pedjoni8]

If I understand this correctly, idea here is to use requestFIlter to change spc message (add content id) that is being sent to licence server?

Previously, initData was changed before calling session.generateRequest().
If we are using requestFIlter, spc message is generated with original initData and we should use requestFIlter to change it.

To be honest, I don't know if this can work and I also don't know how to add contend id to spc message using requestFIlter.

[valotvince]

The change done in #4030 allows you to get the keyId (and/or contentId, assetId) for your content and give it back to the license server through the request (if the license server supports it) or directly through the license token that Pallycon seems to use to enforce policies.

Did you had time to write an issue to them ? :)

[avelad]

The main problem is that it works when using MSE, but not when we use src=, I'm working in another solution.

[pedjoni8]

The change done in #4030 allows you to get the keyId (and/or contentId, assetId) for your content and give it back to the license server through the request (if the license server supports it) or directly through the license token that Pallycon seems to use to enforce policies.

Did you had time to write an issue to them ? :)

i didn't write an isssue to them, sorry, didn't have the time.

[avelad]

@pedjoni8 , Could you write to them? Is there anything else we can do?

[pedjoni8]

We switched to another DRM service. I'm closing this issue.