fix(drm): add zero-KID fallback for mp4decrypt and clear HLS track.drm after download

mp4decrypt silently copies files unchanged when the tenc box default KID is all zeros, since none of the real KID:KEY pairs match. Add zero-KID fallback entries to both Widevine and PlayReady mp4decrypt methods, matching what Shaka Packager already does.

Also clear track.drm after HLS download when decryption was performed, preventing unnecessary double-decryption. DASH and URL descriptors already did this.

unshackle/core/drm/playready.py

@@ -356,6 +356,19 @@ class PlayReady:
             key_hex = key if isinstance(key, str) else key.hex()
             key_args.extend(["--key", f"{kid_hex}:{key_hex}"])
 
+        # Some services use a blank/zero default KID in the tenc box,
+        # but the real KID for the license server. Add zero-KID fallback entries so
+        # mp4decrypt can match when the file's default KID is all zeros.
+        zero_kid = "00" * 16
+        existing_kids = {
+            kid.hex if hasattr(kid, "hex") else str(kid).replace("-", "")
+            for kid in self.content_keys
+        }
+        if zero_kid not in existing_kids:
+            for key in self.content_keys.values():
+                key_hex = key if isinstance(key, str) else key.hex()
+                key_args.extend(["--key", f"{zero_kid}:{key_hex}"])
+
         cmd = [
             str(binaries.Mp4decrypt),
             "--show-progress",

unshackle/core/drm/widevine.py

@@ -290,6 +290,19 @@ class Widevine:
             key_hex = key if isinstance(key, str) else key.hex()
             key_args.extend(["--key", f"{kid_hex}:{key_hex}"])
 
+        # Some services use a blank/zero default KID in the tenc box,
+        # but the real KID for the license server. Add zero-KID fallback entries so
+        # mp4decrypt can match when the file's default KID is all zeros.
+        zero_kid = "00" * 16
+        existing_kids = {
+            kid.hex if hasattr(kid, "hex") else str(kid).replace("-", "")
+            for kid in self.content_keys
+        }
+        if zero_kid not in existing_kids:
+            for key in self.content_keys.values():
+                key_hex = key if isinstance(key, str) else key.hex()
+                key_args.extend(["--key", f"{zero_kid}:{key_hex}"])
+
         cmd = [
             str(binaries.Mp4decrypt),
             "--show-progress",

unshackle/core/manifests/hls.py

@@ -454,6 +454,10 @@ class HLS:
                     status_update["downloaded"] = f"HLS {downloaded}"
                 progress(**status_update)
 
+        # see https://github.com/devine-dl/devine/issues/71
+        for control_file in segment_save_dir.glob("*.aria2__temp"):
+            control_file.unlink()
+
         progress(total=total_segments, completed=0, downloaded="Merging")
 
         name_len = len(str(total_segments))
@@ -753,6 +757,10 @@ class HLS:
         progress(downloaded="Downloaded")
 
         track.path = save_path
+
+        if session_drm:
+            track.drm = None
+
         events.emit(events.Types.TRACK_DOWNLOADED, track=track)
 
     @staticmethod