[HLS] Support FairPlay-signaled CMAF with ClearKey - #2105
Merged
Conversation
CastagnaIT
requested changes
Aug 30, 2026
CastagnaIT
left a comment
Collaborator
There was a problem hiding this comment.
not bad idea but needs a bit of more cleanups
ldzhjn
force-pushed
the
hls-fairplay-clearkey-cmaf
branch
from
August 30, 2026 12:19
5093ede to
32b5c77
Compare
Contributor
Author
|
@CastagnaIT PTAL |
CastagnaIT
reviewed
Aug 30, 2026
ldzhjn
force-pushed
the
hls-fairplay-clearkey-cmaf
branch
from
August 30, 2026 12:52
32b5c77 to
354be35
Compare
Preserve a hexadecimal KID from FairPlay skd URIs and expose the tenc KID as Common Encryption information when an encrypted CMAF initialization segment has no usable PSSH. This allows a configured ClearKey decrypter to open SAMPLE-AES fMP4 streams without adding FairPlay key management.
ldzhjn
force-pushed
the
hls-fairplay-clearkey-cmaf
branch
from
August 30, 2026 12:53
354be35 to
3ad066b
Compare
CastagnaIT
approved these changes
Aug 30, 2026
CastagnaIT
left a comment
Collaborator
There was a problem hiding this comment.
I made some tests i think its ok
thank you
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Preserve a 128-bit hexadecimal KID from a FairPlay
skd://URI and expose thetrack encryption KID as Common Encryption information when an encrypted CMAF
initialization segment contains no usable PSSH box.
This allows a user-configured ClearKey decrypter to open
SAMPLE-AESfMP4streams that use FairPlay HLS signaling. It does not implement FairPlay key
management or license acquisition.
Motivation and context
Some CMAF HLS streams signal
KEYFORMAT="com.apple.streamingkeydelivery"anduse
cbcs, while carrying the default KID only in theskd://URI and/or thetrack's
tencbox. Without a PSSH box, the initialization segment previouslyreturned no DRM information, so the ClearKey session could not be matched to
the configured KID.
The parser now accepts only
skd://values that normalize to exactly 16 bytesof hexadecimal data. Other FairPlay asset identifiers remain unchanged.
How has this been tested?
skd://KID andSAMPLE-AES/CBC mode.Apple TV using a configured ClearKey, including video and audio decryption.
Screenshots (if appropriate):
Not applicable.
Types of change
Checklist: