Skip to content

fix(FEC-14578): [DRM] playkit-js changes needed to support uDRM CPIX multikey solution for HLS FPS#819

Open
chanakabr wants to merge 5 commits intokaltura:masterfrom
chanakabr:cpix2.3_support
Open

fix(FEC-14578): [DRM] playkit-js changes needed to support uDRM CPIX multikey solution for HLS FPS#819
chanakabr wants to merge 5 commits intokaltura:masterfrom
chanakabr:cpix2.3_support

Conversation

@chanakabr
Copy link

@chanakabr chanakabr commented Jun 20, 2025

Description of the Changes

Baseline Fairplay Implementation: Following the legacy Key System (com.apple.fps.1_0).
Background: We have a new feature in the uDRM and in the CPIX 2.3 encrypters/packagers to support multikeys/key rotation, which uses kid per track per crypto period.
The Packager is signalling the kid as keyUri in the playlist:
Format:
EXT-X-KEY:METHOD=SAMPLE-AES,URI="skd://kid",KEYFORMAT="com.apple.streamingkeydelivery",KEYFORMATVERSIONS="1"
Sample:

#EXT-X-KEY:KEYFORMATVERSIONS="1",METHOD=SAMPLE-AES,URI="skd://86bb0abb-a6af-3819-8d6d-98ac161c595e",KEYFORMAT="com.apple.streamingkeydelivery"

During the license flow the uDRM needs to locate the kid from the request.
It can be in 2 places.
a. SPC's AssetID TLLVS (this works with modern media key system how in the legacy the AssetID can't be parsed)
b. X-InitData-Kaltura (skd in base64 - explained in this PR).

The PR Change:

  1. Set the X-InitData-Kaltura on the license request of FPS.

CheckLists

  • [ Y] changes have been done against master branch, and PR does not conflict
  • [ Y] new unit / functional tests have been added (whenever applicable)
  • [Y ] test are passing in local environment
  • Travis tests are passing (or test results are not worse than on master branch :))
  • Docs have been updated

@MosheMaorKaltura MosheMaorKaltura requested a review from Copilot July 21, 2025 12:13
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR implements CPIX 2.3 support for FairPlay DRM by adding multi-key/key rotation functionality. The changes enable the uDRM to locate key IDs (KIDs) from license requests to support the new CPIX 2.3 encrypters/packagers that use KID per track per crypto period.

  • Adds X-Kaltura-InitData header to license requests containing base64-encoded KID
  • Updates content ID extraction to properly parse skd:// format URLs
  • Enhances WebKit key message handling to extract KID from session content
Comments suppressed due to low confidence (2)

src/engines/html5/media-source/adapters/fairplay-drm-handler.ts:133

  • The header name 'X-Kaltura-InitData' is inconsistent with the description which mentions 'X-InitData-Kaltura'. Please verify the correct header name format.
      headers: {'X-Kaltura-InitData': kidBase64} // pass the kid to uDRM

src/engines/html5/media-source/adapters/fairplay-drm-handler.ts:274

  • The variable name 'hostname' is misleading since it's now extracting a key ID rather than a hostname. Consider renaming to 'keyId' or 'contentId' for clarity.
    const hostname = url.slice(url.lastIndexOf("skd://")+6,url.length); // handle the skd://mykeyid format

// WebkitMediaKeySession has attribute contentId (which is the mykeyid from playlist's skd://mykeyid)
const session = event.target;
const kid = session?.contentId;
const kidBase64 = btoa(kid);
Copy link

Copilot AI Jul 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The btoa() function expects a string input, but 'kid' could be undefined or null if session?.contentId is falsy. This will throw an error. Add validation: const kidBase64 = kid ? btoa(kid) : '';

Suggested change
const kidBase64 = btoa(kid);
const kidBase64 = kid ? btoa(kid) : '';

Copilot uses AI. Check for mistakes.
Comment on lines +274 to +275
const hostname = url.slice(url.lastIndexOf("skd://")+6,url.length); // handle the skd://mykeyid format
return hostname;
Copy link

Copilot AI Jul 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the URL doesn't contain 'skd://', lastIndexOf() returns -1, causing slice(-1+6, length) which would return the last 5 characters. Add validation: if (url.includes('skd://')) { return url.slice(url.lastIndexOf('skd://') + 6); } else { /* fallback logic */ }

Suggested change
const hostname = url.slice(url.lastIndexOf("skd://")+6,url.length); // handle the skd://mykeyid format
return hostname;
if (url.includes("skd://")) {
const hostname = url.slice(url.lastIndexOf("skd://") + 6); // handle the skd://mykeyid format
return hostname;
} else {
throw new Error("Invalid URL format: 'skd://' not found");
}

Copilot uses AI. Check for mistakes.
@SivanA-Kaltura SivanA-Kaltura changed the title Cpix2.3 support fix(FEC-14578): [DRM] playkit-js changes needed to support uDRM CPIX multikey solution for HLS FPS Aug 5, 2025
SivanA-Kaltura added a commit that referenced this pull request Aug 6, 2025
…multikey solution for HLS FPS

### Description of the Changes

Based on #819
Add a custom header for fairplay DRM requests
The custom header logic will only work with the configuration

```
        playback: {
          options: {
            html5: {
              native: {
                useKIDHeader: true
              }
            }
          }
        }
```

Resolves FEC-14578

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants