Support for clearkey

[Zoom-Adr]

is there any development for clearkey support soon?

[glennguy]

It's not super high on the priority list - are there any services that use it?

[Zoom-Adr]

not sure which services but there are some streams that use clearkey

[rysson]

Hi,
@glennguy, yes, discovery/eurosport for example (via player.pl).

[carlosbalsas]

Not implemented that yet?

[glennguy]

No not yet. Only really 2 active developers on this project at the moment, we're working our way through cleaning up and refactoring the code and once done we can look at new features such as this.

[glennguy]

Any service that use widevine can handle clearkey

Sure, anything can 'handle' clearkey however providers don't typically implement clearkey because as the name implies the key is not protected.

It's even easier to setup clearkey than widevine because you dont have to deal with http headers and stuff.

there's nothing preventing a provider from enforcing seeing particular headers for any stream

I get this feature is wanted, happy to review PRs anytime however if you want the very small active development team to implement then unfortunately it will wait until we have time.

[mmBesar]

clearkey support would be great, thank you.

[glennguy]

It's on my to-do list, I will try to get to it soon

[aicynide]

Please add clearkey

[glennguy]

Everyone - this isn't a poll. It will be done when it's done. No promises but hopefully in the next couple of months.

[glennguy]

Anyone watching this issue - Can I get a clearkey stream or two to test on?

[glennguy]

Any chance for something that isn't geoblocked or requiring sign in cookies?

[gpascualUY]

Two different manifest formats. Same KEY:

https://media.axprod.net/TestVectors/v7-MultiDRM-SingleKey/Manifest_1080p_ClearKey.mpd
https://media.axprod.net/TestVectors/v7-MultiDRM-SingleKey/Manifest_1080p.mpd
9eb4050de44b4802932e27d75083e266:166634c675823c235a4a9446fad52e4d

[Uukrull]

Another one from https://bitmovin.com/demos/drm:

https://cdn.bitmovin.com/content/assets/art-of-motion_drm/mpds/11331.mpd
eb676abbcb345e96bbcf616630f1a3da:100b6c20940f779a4589152b57d2dacb

And this one:

http://www.bok.net/dash/clearkey_example/stream.mpd
000102030405060708090a0b0c0d0e0f:00112233445566778899aabbccddeeff

Will it support multiple keys? i.e:

#KODIPROP:inputstream.adaptive.license_key={"kid1": "key1", "kid2": "key2", "kid3": "key3", "kid4": "key4"}

[glennguy]

@Uukrull I was thinking more along the lines of manifests that have clearkey specified in the content protection. But we could add support for giving IA key/keyID pairs.

From what I can see it looks like there's Android streaming players out there that have adopted the playlist format for inputstream.adaptive and extended it to support clearkey too. Is your example above
#KODIPROP:inputstream.adaptive.license_key={"kid1": "key1", "kid2": "key2", "kid3": "key3", "kid4": "key4"}
how this works for these streaming players? Or just your suggestion?

[Uukrull]

From what I can see it looks like there's Android streaming players out there that have adopted the playlist format for inputstream.adaptive and extended it to support clearkey too. Is your example above
#KODIPROP:inputstream.adaptive.license_key={"kid1": "key1", "kid2": "key2", "kid3": "key3", "kid4": "key4"}
how this works for these streaming players? Or just your suggestion?

Yes, that is how it works. Anyway, are you sure you want to add clearkey support to Kodi? That may open a pandora's box you don't want to deal with.

Clearkey means that if you don't a have real subscription to a service you still can use it if you know the mpd and the key(s).

[glennguy]

Happy to add it since it's a legitimate content protection method. Not so keen on the abuse side of things but I'm interested to hear how you will think it will play out. Most publishers also have security on access to the mpds and segments themselves and generally discovery of keys leads to downloading the content and reposting rather than allowing for streaming in which case the provider can rotate the keys or the content itself can expire...

[Uukrull]

Not so keen on the abuse side of things but I'm interested to hear how you will think it will play out.

Believe me, it will be abuse to the point that what remains of the good name Kodi has as a media player not related to piracy will be shattered to pieces.

[CastagnaIT]

Clearkey means that if you don't a have real subscription to a service you still can use it if you know the mpd and the key(s).

A service without protection cookies or other custom headers looks weird,
however ill-intentioned users there are and always will be,
but it is not our place to judge whether this DRM is unreliable or not, the important thing is to implement it correctly,
since ClearKey is already supported by almost all browsers, and major brands like playstation android boxes apple products etc,
i dont see big problems at the end its the service provider to decide whether to support it or not

for example shaka, allow to configure clearkey in similar way:
https://shaka-player-demo.appspot.com/docs/api/tutorial-drm-config.html
or https://developer.bitmovin.com/playback/docs/how-to-play-mpeg-cenc-clearkey-content

a sample is:
https://reference.dashif.org/dash.js/latest/samples/drm/clearkey.html

[Uukrull]

A service without protection cookies or other custom headers looks weird

In this thread you have an example from a well known provider and there are hundreds of examples like that.

[CastagnaIT]

i think also that we should stop add new behaviours to inputstream.adaptive.license_key
this very mess old property should be deprecated and changed with a new improved one

if we have to add a new support to add kid/key pairs
would be better is introduce a new inputstream.adaptive.drm
since there is intention to add a json lib depenency the value to be set can be as json string,
where in future will replace inputstream.adaptive.license_key

python addons will do:

drm_config = {
    "clearkeys": {"kid": "key","kid": "key"},
    "license_servers": {"com.widevine.alpha": "http://www."},  # << this in future
    "license_headers": "...",  # << this in future
    ...
}
listitem...drm...prop = json.dumps(drm_config)

will be a bit more complex for C++ addons such as pvr to create manually the json string without json lib, but not so impossible

In this thread you have an example from a well known provider and there are hundreds of examples like that.

if so, you can play that stream with any players as shaka player

[MiyasakiYoshi]

Clearkey means that if you don't a have real subscription to a service you still can use it if you know the mpd and the key(s).

A service without protection cookies or other custom headers looks weird, however ill-intentioned users there are and always will be, but it is not our place to judge whether this DRM is unreliable or not, the important thing is to implement it correctly, since ClearKey is already supported by almost all browsers, and major brands like playstation android boxes apple products etc, i dont see big problems at the end its the service provider to decide whether to support it or not

for example shaka, allow to configure clearkey in similar way: https://shaka-player-demo.appspot.com/docs/api/tutorial-drm-config.html or https://developer.bitmovin.com/playback/docs/how-to-play-mpeg-cenc-clearkey-content

a sample is: https://reference.dashif.org/dash.js/latest/samples/drm/clearkey.html

Yes, you are right. I think there are illegal streamers that are just worried their leaked keys will now start to be useless as like @glennguy pointed out, providers will start to rotate keys and add more protection and hence the easy income a lot of IPTV providers will stop since Kodi is such a popular streaming platform. Probably for the better that the providers actually have to work.

[aicynide]

Patiently waiting

[fkoemep]

Patiently waiting too, for now I'm using shaka to cast some ClearKey streams to my device, but would love to have those streams in a playlist file ready to be played directly from Kodi!

[Iniyan-I]

Waiting...

[glennguy]

Hi all, can you please check out #1598 and give some feedback if possible?

[fkoemep]

Hi all, can you please check out #1598 and give some feedback if possible?

Using your DASH sample it works on Android 14 with Kodi 21 aarch64! Unfortunately when I tried one of the playlists I normally use it force closes 😔

[glennguy]

@fkoemep this change isn't designed to accept these playlists that have 'extended' the inputstream.adaptive Kodi properties.

Could you provide an example of the MPD or M3U8 file that the playlist you have is linking to, plus the Kodi properties that are in the main M3U8 playlist? At least we can look at getting it to not crash and instead give a useful error message.

[fkoemep]

@glennguy can I contact you privately so I can send you the .mpd and keys? Not sure if it's geo-blocked though

[pablozafra97]

Hello @glennguy ,
I builded it for Windows, and your demo for "angel one" test stream works.

However, this one crashes (No Clear-Key sheme in manifest, but correct keys supplied):

#KODIPROP:inputstream=inputstream.adaptive
#KODIPROP:inputstream.adaptive.license_type=org.w3.clearkey
#KODIPROP:inputstream.adaptive.drm={"org.w3.clearkey": {"keyids": {"eb676abbcb345e96bbcf616630f1a3da": "100b6c20940f779a4589152b57d2dacb"}}}
https://cdn.bitmovin.com/content/assets/art-of-motion_drm/mpds/11331.mpd

And this one doesn't crash, but decryption failed as the video is scrambled and audio is not playing (Manifest contains ClearKey scheme).

#KODIPROP:inputstream=inputstream.adaptive
#KODIPROP:inputstream.adaptive.license_type=org.w3.clearkey
#KODIPROP:inputstream.adaptive.drm={"org.w3.clearkey": {"keyids": {"000102030405060708090a0b0c0d0e0f": "00112233445566778899aabbccddeeff"}}}
http://www.bok.net/dash/clearkey_example/stream.mpd

[CastagnaIT]

i made tests but
the first one: its widevine MPD without clearkey, mixing this way configuration its not so good, anyway to me dont crash, just isnt able to play
the second one: to me its played correctly audio/video ok

IMO suggest that or you have some different ISA settings that im not aware,
or you have builded ISA badly, or maybe you have mixed build modes, e.g. ISA builded as debug and kodi as release, this could cause side effects

you can test by using these test builds:
https://jenkins.kodi.tv/blue/organizations/jenkins/xbmc%2Finputstream.adaptive/detail/PR-1598/3/artifacts
on a regular kodi (21) release

[pablozafra97]

Well, I used the ISA test build zip you provided, I reinstalled kodi regular release and I got the same results. Maybe it has to do with my windows machine? Ill try other devices tomorrow. For context I used IPTV Simple Client and created .m3u file for the PVR client. I didn't change ISA settings.

[Uukrull]

The last time I tried it, IPTV Simple client didn't like spaces in KODIPROPS, so try this:

#KODIPROP:inputstream=inputstream.adaptive
#KODIPROP:inputstream.adaptive.license_type=org.w3.clearkey
#KODIPROP:inputstream.adaptive.drm={"org.w3.clearkey":{"keyids":{"000102030405060708090a0b0c0d0e0f":"00112233445566778899aabbccddeeff"}}}
http://www.bok.net/dash/clearkey_example/stream.mpd

[glennguy]

The design of clearkey support in the PR is to support manifests that signal they are protected with clearkey. If you have a manifest that is protected by Widevine then you should use widevine and construct the playlist appropriately.
The current behaviour is expected - tell IA that the key system used is clearkey, IA downloads manifest and finds only widevine. Playback will not start.

Alternatively, write a proxy to add clearkey into the manifest if you want to get it going that way.

[CastagnaIT]

However, this one crashes (No Clear-Key sheme in manifest, but correct keys supplied):

out of curiosity i would like to know what player that you are using that allow to force decrypt as clearkey a widevine manifest

[fkoemep]

However, this one crashes (No Clear-Key sheme in manifest, but correct keys supplied):

out of curiosity i would like to know what player that you are using that allow to force decrypt as clearkey a widevine manifest

Shaka player and jwplayer are some players that support this usage

[CastagnaIT]

so please show me how to configure the stream on shakaplayer by using their "custom content" page
https://shaka-player-demo.appspot.com/demo/#audiolang=it-IT;textlang=it-IT;uilang=it-IT;panel=CUSTOM%20CONTENT;build=uncompiled

[sr0lle]

However, this one crashes (No Clear-Key sheme in manifest, but correct keys supplied):

out of curiosity i would like to know what player that you are using that allow to force decrypt as clearkey a widevine manifest

OTT Player supports this.

[fkoemep]

so please show me how to configure the stream on shakaplayer by using their "custom content" page https://shaka-player-demo.appspot.com/demo/#audiolang=it-IT;textlang=it-IT;uilang=it-IT;panel=CUSTOM%20CONTENT;build=uncompiled

First set the manifest URL and any name you want for the content

After that you go to the "EXTRA CONFIG" tab and set your kid and key

{
  "drm": {
    "clearKeys": {
      "KeyId": "Key"
    }
  }
}

[CastagnaIT]

thank you, interesting works,
the first time i tried wasnt working i must have set up something wrong...
i assume that this should works also with all other manifest types (...HLS...) that use CENC

docs say

so this will skip any content protection specified on manifests, not so ideal thing to do

we can think to implement something similar,
but imo it's not the right time at current stage of development
because DRM configuration on ISA need to be completely reworked

this seems to require the addition of some workarounds to make it work right now
that can make more hard to do the future rework,
since we have a working sample stream we can try implement this at later time, and so add it on roadmap

[fkoemep]

I understand that it's going to be difficult to implement, but forced Clear Key decryption is probably the most popular use case here.

By this I don't mean this feature should be finished ASAP, these things take time and we really appreciate the work you all do. But it should be a priority imo.

[CastagnaIT]

fyi
im changing the way to configure the DRM
this to allow make easier configuration by using playlists like M3U8/STRM files

inputstream.adaptive.drm discussed above and previously tested, will be removed from Kodi 21, and reintroduced (more likely) from Kodi 22 along the rework

instead of it there will be: inputstream.adaptive.drm_legacy
that can be used for all DRM types in a limited way, which should be enough to make works most live TV streaming
(act as replacement of inputstream.adaptive.license_type and inputstream.adaptive.license_key)

more details and examples on PR #1604