kenzuya/unshackle
1
0
Fork 2
mirror of https://github.com/unshackle-dl/unshackle.git synced 2026-11-14 13:05:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(remote): verify server-CDM vault keys on the client and report bad pairs

Browse Source 
The licence response lists KIDs a server vault supplied, the client proves them with the decode check, and a bad pair goes to the new session keys/bad route so the server flags its own row. Client vault keys go first over --remote, and the dashboard health warns when no SQLite vault can store flags.
This commit is contained in:
imSp4rky
2026-09-12 15:13:08 -06:00
parent 7c82282813
commit a7d6791136
21 changed files with 579 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/guide/downloading.md
+1 -1
View File
@@ -762,7 +762,7 @@ unshackle dl -w S01 --slow 30-60 EXAMPLE 81234567
By default, unshackle checks your **key vaults** first and only asks a **CDM** to license
a content key when the vault misses. You can force one side or the other:
- `--cdm-only`: only use the CDM (skip vaults).
- `--cdm-only`: only use the CDM (skip vaults). Over a `server_cdm` remote session the flag does not reach the server, whose vault shortcut still runs; it only skips the client's decode check on a server key.
- `--cdm <name>`: use the named CDM device for this run, ignoring the `cdm` config mapping (including its quality and Widevine/PlayReady sub-entries).
- `--vaults-only`: only use key vaults and never license through the CDM. A missing
content key fails.
docs/guide/drm-and-cdm.md
+1 -1
View File
@@ -497,7 +497,7 @@ control this trade-off on the `dl` command:
| Flag | Effect |
|------|--------|
| `--vaults-only` | Never send a license request; use only cached/vault keys. Fails if a content key is missing. |
| `--cdm-only` | Ignore vaults for sourcing keys and always perform a fresh license request. |
| `--cdm-only` | Ignore vaults for sourcing keys and always perform a fresh license request. Over a `server_cdm` remote session the server still reads its own vaults; the flag only skips the client's decode check on the key it gets back. |
| `--cdm <name>` | Use the named CDM device for this run instead of the one the `cdm` config maps for the service. |
See [key vaults](vaults.md) for how to configure vault backends.