Widevine integration not working

[pozelli]

System info

Operating System: Ubuntu 22.04
Shaka Packager Version: packager version v2.6.1-634af65-release

Issue and steps to reproduce the problem

Packager Command:

I'm using the command below to generate Widevine-protected content.

packager in='video_cmaf_480p.mp4',stream=video,segment_template='video/480p/$Number$.m4s',playlist_name='video/480p.m3u8',init_segment='video/480p/init.mp4' --segment_duration 4 --fragment_duration 2 --enable_widevine_encryption --key_server_url https://license.widevine.com/cenc/getcontentkey/XXXXX --content_id 'XXXXX' --signer XXXXX --aes_signing_key 'XXXXX' --aes_signing_iv 'XXXXX' --protection_scheme cbcs --generate_static_live_mpd --mpd_output 'auto.mpd'

What is the expected result?

The generated video can be played normally.

What happens instead?

When I try to play the content, the playback stops after what I think is the clear lead.

Stall detected at 8.13857 for 1.183000087738037 seconds.

From the Chrome console logs, I see that the keys are "usable", but I still don't understand why the video doesn't play.
One of the points that caught my attention was the presence of "DEVICE_NOT_WHITELISTED" in the license response.

One of the messages I see in the Media Internals logs is "no key for key ID XXXXX", although the key ID present in the manifest is the same as the one listed as "usable" in the player logs.

I know the question is becoming too broad, but I think there is really something happening with the packager output.

Since I'm also implementing the Widevine License Proxy, I'll write below other outputs I think could help you better understand my scenario.

This is the license response (XXXXX is just for simplicity or confidential data):

{"status":"OK","status_message":"","license":"XXXXX","license_metadata":{"content_id":"XXXXX","license_type":"STREAMING","request_type":"NEW"},"supported_tracks":[{"type":"UHD1","key_id":"M4hBF55vXouvao+EtAEmAg=="},{"type":"HD","key_id":"2wkibceqWg+e9HteHUDfQA=="},{"type":"SD","key_id":"P7TX0e7OVbC0mGhvoERDhA=="},{"type":"AUDIO","key_id":"NQlm3CFMVmyPkAZ+5WgIAw=="}],"make":"Google","model":"ChromeCDM-Linux-x64-9","security_level":3,"internal_status":0,"session_state":{"license_id":{"request_id":"XXXXX","session_id":"XXXXX","purchase_id":"","type":"STREAMING","version":0,"original_rental_duration_seconds":604800,"original_playback_duration_seconds":20,"original_start_time_seconds":1698676051},"signing_key":"XXXXX","keybox_system_id":26834,"license_counter":0},"drm_cert_serial_number":"XXXXX","device_whitelist_state":"DEVICE_NOT_WHITELISTED","message_type":"LICENSE","platform":"linux","device_state":"RELEASED","pssh_data":{"key_id":[],"content_id":"YWNjb3VudDEtaTEtdjEtdmVyc2lvbjU="},"client_max_hdcp_version":"HDCP_NONE","client_info":[{"name":"architecture_name","value":"x86-64"},{"name":"company_name","value":"Google"},{"name":"model_name","value":"ChromeCDM"},{"name":"platform_name","value":"Linux"},{"name":"widevine_cdm_version","value":"4.10.2710.0"}],"signature_expiration_secs":620890049,"platform_verification_status":"PLATFORM_UNVERIFIED","content_owner":"XXXXX","content_provider":"XXXXX","system_id":26834,"oem_crypto_api_version":16,"resource_rating_tier":0,"service_version_info":{"license_sdk_version":"18.1.2 Built on Aug 16 2023 12:55:00 ([1692215686](tel:1692215686))","license_service_version":"widevine.license-server_20230816.06_p0"},"soc":"x64","client_capabilities":{"session_token":true,"video_resolution_constraints":true,"supported_key_type":[]}}

Side notes:

It wasn't my goal to have multiple different keys for the tests. Although I'm testing with just one track (SD) listed (in the Shaka Packager command and generated manifest), apparently the Shaka Packager either asks for or receives the other keys from WLS.

The PSSH (containing the content_id) is apparently generated by the WLS. Or would it be through Shaka Packager? I ask because in raw key mode Shaka Packager does not generate a PSSH containing the content_id and that is why I stopped using this mode.

I updated the DCSL file today. But the field "device_whitelist_state" is still equal to "DEVICE_NOT_WHITELISTED". Is Ubuntu 22.04 really not whitelisted by Widevine? If so, is that a problem? Shouldn't it stop generating the license before it even reaches the client? Or is it normal behavior for the license to be generated (including the keys) and it is up to the CDM/browser/OS to block the key from being used by the player?

[cosmin]

I ask because in raw key mode Shaka Packager does not generate a PSSH containing the content_id and that is why I stopped using this mode.

You can generate the PSSH box yourself using the included pssh-box.py script, such as

pssh-box.py --widevine-system-id --content-id XXXX --hex

and then pass that to packager in raw key encryption mode with --pssh

[pozelli]

Thank you @cosmin
Even using the custom PSSH, the playback is not possible after 8 seconds and the error seems to be the same.

If I use:
https://integration.uat.widevine.com/player

With this DASH content:
https://d20w2wsa6ocqck.cloudfront.net/account1-i1/video/1-cmaf/cmaf/auto.mpd

The response log is:

{
	"id":{
		"requestId":"2kmePmxe1AxZ2QZU617g4Q==",
		"sessionId":"2kmePmxe1AxZ2QZU617g4Q==",
		"purchaseId":"",
		"type":"STREAMING",
		"version":0,
		"originalRentalDurationSeconds":"604800",
		"originalPlaybackDurationSeconds":"86400",
		"originalStartTimeSeconds":"1698687179"
	},
	"policy":{
		"canPlay":true,
		"canPersist":false,
		"canRenew":false,
		"rentalDurationSeconds":"604800",
		"playbackDurationSeconds":"86400",
		"licenseDurationSeconds":"604800",
		"renewalRecoveryDurationSeconds":"0",
		"renewalServerUrl":"",
		"renewalDelaySeconds":"0",
		"renewalRetryIntervalSeconds":"0",
		"renewWithUsage":false,
		"alwaysIncludeClientId":false,
		"softEnforcePlaybackDuration":false,
		"softEnforceRentalDuration":true
	},
	"key":[{
		"iv":"...",
		"type":"SIGNING"
	},{
		"id":"M4hBF55vXouvao+EtAEmAg==",
		"iv":"zrBRbA+wcjCqSGwHWJeS0g==",
		"type":"CONTENT",
		"level":"SW_SECURE_CRYPTO",
		"keyControl":{
			"keyControlBlock":"a2MxNgAJOoCW8uSSgAAACA=="
		},
		"trackLabel":"UHD1"
	},{
		"id":"2wkibceqWg+e9HteHUDfQA==",
		"iv":"mNIjkjtHCfh7yFVGcvCfmw==",
		"type":"CONTENT",
		"level":"SW_SECURE_CRYPTO",
		"keyControl":{
			"keyControlBlock":"a2MxNgAJOoCW8uSSgAAACA=="
		},
		"trackLabel":"HD"
	},{
		"id":"P7TX0e7OVbC0mGhvoERDhA==",
		"iv":"0SnQoUrN32i6C1Nl8+WR3Q==",
		"type":"CONTENT",
		"level":"SW_SECURE_CRYPTO",
		"keyControl":{
			"keyControlBlock":"a2MxNgAJOoCW8uSSgAAACA=="
		},
		"trackLabel":"SD"
	},{
		"id":"NQlm3CFMVmyPkAZ+5WgIAw==",
		"iv":"+CPdIIqT8YPKUPFF+LRs5w==",
		"type":"CONTENT",
		"level":"SW_SECURE_CRYPTO",
		"keyControl":{
			"keyControlBlock":"a2MxNgAJOoCW8uSSgAAACA=="
		},
		"trackLabel":"AUDIO"
	}],
	"licenseStartTime":"1698687179",
	"protectionScheme":1667392371,
	"platformVerificationStatus":"PLATFORM_UNVERIFIED"
}

The proxy server is more private. If someone would like to test the proxy server URL, let me know.

[cosmin]

Are you able to play other Widevine content on this same platform? For example try some of the Widevine DRM streams from https://shaka-player-demo.appspot.com/demo/#audiolang=en-US;textlang=en-US;uilang=en-US;panel=ALL_CONTENT;panelData=drm:WIDEVINE;build=uncompiled and see if those play.

As long as the content is encrypted correctly with the proper key and the PSSH is correct in the MPD then Shaka packager should be doing its job and the playback issues are likely between the browser and license server (including license proxy). For that it might be better to contact Widevine support at https://support.google.com/widevine/troubleshooter/6027072

[pozelli]

Yes, I'm able to player other Widevine content on the same platform.

What is odd is that the media internals:
chrome://media-internals

shows the following error:
"no key for key ID XXX"

The key ID is not known to me.

The WLS response, the MPD and the player logs contain the same key ID, but the value is different from the one in "media internals".

Both key IDs are in hex format, so I think the difference is not due to the format.

[cosmin]

I suggest reaching out to Widevine support https://support.google.com/widevine/troubleshooter/6027072 to troubleshoot this further. If you do discover a bug in Shaka Packager itself please re-open it with some details, as it stands there doesn't appear to be anything actionable on the packager side.