feat(drm): add blowfish stripe cipher and mp3 audio codec

BlowfishStripe decrypts on the client after download, so a --remote client gets clear audio.
This commit is contained in:
imSp4rky
2026-10-26 18:59:42 -06:00
parent ffeb58f808
commit 06f87dafa3
16 changed files with 218 additions and 16 deletions
+2 -1
View File
@@ -41,7 +41,7 @@ then decrypts the file with those keys.
## Supported DRM systems
unshackle implements five DRM systems. Only the first two need a device file and a
unshackle implements six DRM systems. Only the first two need a device file and a
license-server handshake. The rest are special cases.
| System | Device file | License flow | Decryption |
@@ -51,6 +51,7 @@ license-server handshake. The rest are special cases.
| **ClearKey (CENC)**, W3C EME `org.w3.clearkey` | none | JSON `{"kids":[...],"type":"temporary"}` → license server returns a JWK Set. No CDM. | shaka-packager / mp4decrypt |
| **ClearKey (HLS)**, AES-128 `EXT-X-KEY` | none | Key fetched directly from a URI or `data:` URL. No CDM, no challenge. | in-process AES-CBC |
| **MonaLisa** (proprietary, WASM) | `.mld` | Ticket from the service API; keys extracted locally via WASM. No license server. | ML-Worker binary + AES-ECB, per segment |
| **Blowfish stripe** | none | The service gives the per-track key. No CDM, no license server. | in-process Blowfish-CBC on every third 2048-byte chunk |
!!! warning "Two different ClearKeys"
"ClearKey (HLS)" and "ClearKey (CENC)" are entirely different systems that happen