kenzuya/unshackle
1
0
Fork 2
mirror of https://github.com/unshackle-dl/unshackle.git synced 2026-11-12 12:05:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(vaults): report bad keys to the vault that served them

Browse Source
This commit is contained in:
imSp4rky
2026-09-13 20:46:38 -06:00
parent a0515f8d57
commit aa36d4c225
9 changed files with 139 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/dev/rest-api/endpoints.md
+1 -1
View File
@@ -1088,7 +1088,7 @@ Get the content keys for the DRM. The `mode` field selects one of two modes.
### `POST /api/session/{session_id}/keys/bad`
Report a content key from `vault_keys` that did not decrypt the track. The server flags the pair in its local vaults, under the name of the vault that served it, and the next licence for that KID reaches the CDM. The client never learns the server vault names.
Report a content key from `vault_keys` that did not decrypt the track. The server flags the pair in its local vaults and reports it to the vault that served it, and the next licence for that KID reaches the CDM. The client never learns the server vault names.
```json
{ "kid": "<kid_hex>", "key": "<key_hex>" }
docs/dev/rest-api/remote-sessions.md
+3 -3
View File
@@ -239,9 +239,9 @@ There are two ways DRM keys get resolved, chosen by the client's `server_cdm` fl
- A content key the server took from its own vault is unproven. The response
lists its KID in `vault_keys`, the client decrypts and checks that the output
decodes, and a wrong pair goes back to `POST /api/session/{id}/keys/bad`. The
server flags the pair in every local vault it holds, records the name of the
vault that served it, and the next licence for that KID skips the pair and
reaches the CDM. A server with no local SQLite vault cannot store the flag. The
server flags the pair in every local vault it holds, reports it to the vault
that served it, and the next licence for that KID skips the pair and reaches
the CDM. A server with no local SQLite vault cannot store the flag. The
server accepts a report only for a pair it served to that remote session. The
client never learns the server vault names.
- A content key in the client's own vaults goes first, even when the server