Safari Fairplay MediaKeys Polyfill

[sanbornhilland]

In issue #279 it was mentioned that "The status of Fairplay through EME is unknown at this time." Can you elaborate on what you mean by this? We have some apple sample code that shows Fairplay playback in Safari. However trying to play the same content through Shaka with an HLS Parser plugin is not going so smoothly. I'm not sure the MediaKeys polyfill is working correctly on Safari. Have you tested in Safari?

I can get more detailed logs and specific failings in the next few days but I wanted to initially enquire about the compatibility of the MediaKeys polyfill and the Safari (9.1) EME implementation.

[joeyparrish]

What I meant by that comment is that we have never seen any Fairplay-compatible DASH content we could try in Shaka, nor any EME-based Fairplay demos using HLS. So we can only assume Apple's EME works. Can you share a link to something of that sort?

A quick check shows that Safari 9's EME is the webkit-prefixed v0.1b API. The polyfill for that was originally developed against Chrome, but Chrome has long-since implemented the unprefixed working-draft EME API. If we need to modify the polyfill to better support Safari, I have no problems with that. Safari is, at the moment, the only known consumer of it.

[sanbornhilland]

We have a server issue to resolve but then I should be able to provide you with a working Safari sample with HLS Fairplay content.

[sanbornhilland]

I'm still working on getting you some HLS + Fairplay samples to give you. But there is sample client code from apple here: https://developer.apple.com/streaming/fps/ if you download the FairPlay Streaming Server SDK. If you haven't looked at this it would be useful for comparing to the v01b polyfill.

For instance, for FPS on Safari the init data is formed by concatenating the initData from the needkey event with a contentId and an Apple App Cert. I believe this is different from Chrome and other browsers that just require the init data? It looks to me like currently Shaka and the MediaKeys polyfill assumes the needkey event.initData is sufficient.

After that it looks like there are some other differences. The concatenated init data is passed in the createSession call and then there is no generateRequest call at all. This also appears to be different than how Shaka is handling it where the createSession call does not take any arguments and there is a generateRequest call that takes initData.

It appears to me that the flow on Safari is a bit different than on Chrome. I have tested that Apple sample code with HLS + Fairplay content and it does work in Safari.

I'm also having the following issue in Safari: In shaka.polyfill.PatchedMediaKeys.v01b.MediaKeys.prototype.onWebkitNeedKey_ it throws an error when trying to dispatch the shaka FakeEvent: UNSPECIFIED_EVENT_TYPE_ERR: DOM Events Exception 0: The Event's type was not specified by initializing the event before the method was called. The only way I can see to avoid that is to create a custom event instead like this:

var event2 = new CustomEvent('encrypted');
event2.initDataType = 'webm';
event2.initData = event.initData;

I'm not sure you'd want to handle it like this just for consistency reasons but this was how I could get around that error just for POC purposes.

[sarge]

@joeyparrish would it help if I provide some test content to run against?

[joeyparrish]

@sarge, it couldn't hurt! Thanks!

[boredom2]

Hi there - we are now also finally under Pressure to run a DRM Solution for Safari asap.
I am really a little confused :) We have Assets in HLS and with FairPlay Protection ready.
Initially, I thought, that Safari will handle the Process itself, but looks, like if we have to do something here :) So Apple DRM also works on MSE Base?
And if yes, I suggest, this will only work with HLS (DASH with FairPlay is afaik not possible to create or at least never done and for sure not possible to create on MS Azure).
So can you maybe give me a little Hint on how to make this work?
Did someone ever made HLS+FairPlay+MSE work at all?
(and if you know that - how does this work on iOS, if this does not support MSE?)

[sarge]

@joeyparrish I have uploaded a working sample of the fairplay drm.
https://s3.amazonaws.com/shift72-temp/hls_fps_bento4_sintel/master.m3u8

This file contains reference to the "Apple Developer Program License Agreement", so you can choose not to view it. Not sure what to do about worlds colliding here (shrug)
https://s3.amazonaws.com/shift72-temp/hls_fps_bento4_sintel/safari_hls.html

@boredom2 HLS + Fairplay works on Safari Desktop. But does not work on Safari iOS, an app is still required.
Dash + Fairplay + (Widevine + Playready) + MSE appears possible, implementations are rare from what I have seen. An additional pssh box with the fairplay id and some work generating the initData in the format [initData] = [initData] + [4 byte: idLength] + [idLength byte: id] + [4 byte:certLength] + [certLength byte: cert] should work.

[boredom2]

Thanks for that Information - I will try once SHAKA can handle the slightly "crippled" HLS Manifest, that we get from MS Azure CDN. I will update then here :)

[joeyparrish]

Here's an update on our progress.

The polyfill part is not that difficult. I have written a polyfill that builds a compliant MediaKeys API on top of Safari 10's WebKitMediaKeys.

Parsing the FairPlay tag in HLS to feed EME is trivial.

The challenge is that the key system com.apple.fps.1_0 seems to be usable only with video.src=foo.m3u8. When used with MediaSource, createSession() causes the page to crash and reload. And Shaka Player currently only works with MediaSource.

Judging from a WebKit commit log, they introduced com.apple.fps.2_0 for MediaSource:

(WebCore::keySystemIsSupported): Use "com.apple.fps.2_0" to distinguish from the not-media-source scheme.

I have not been able to find any working examples of that key system in use.

Creating a session with fps.2_0 results in a message that contains only the text "certificate". Looking at WebKit sources, this is unconditional and we are expected to call update() with the certificate after that.

Dealing with this certificate request is enough to do, and we can even hide it in the MediaKeys polyfill. However, the message we get after that is not a license request, either. It's completely empty.

WebKit sources also show support for com.apple.fps.3_0, but that also has no documentation and does not get us any further than fps.2_0 did.

[sarge]

Thanks Joey for taking a look at this. You got further than I did. Would you mind pushing a branch?

fps.2_0 being for MSE is a good find - the apple forums note that NetFlix uses this scheme.

When you say after the certificate request you get a message that is empty do you mean that get a call to webkitkeymessage with no initdata?

[joeyparrish]

I mean that the second webkitkeymessage event has message.length of zero.

[joeyparrish]

I can't push anything until it's been through code review by the team, but I'll try to clean up what I've done so far and make it available in some form.

[senaev]

Can someone with Mojave confirm or deny that window.MediaKeys shows up in the JS debugger on Safari 12.1?

yes, there is MediaKeys, but i did not find the way to detect fireplay anyway

Now we are using WebKitMediaKeys.isTypeSupported, and we are in search of unprefixed api to.

[joeyparrish]

isTypeSupported is not a part of the MediaKeys API. Instead, you are supposed to use navigator.requestMediaKeySystemAccess, which is much more complicated. Thankfully, Shaka Player handles that API for you.

Since this unprefixed API is dependent on a specific OS version, I think it's best if I continue developing the polyfill to support older OS versions. Then I'll perform the update to Mojave and test again. :-)

[senaev]

isTypeSupported is not a part of the MediaKeys API. Instead, you are supposed to use navigator.requestMediaKeySystemAccess, which is much more complicated. Thankfully, Shaka Player handles that API for you.

Yeah, used to try, but there is also no way to detect fireplay with navigator.requestMediaKeySystemAccess api on 12.1 version. If you know how to do it, share it please!

[joeyparrish]

If that's the case, we'll be stuck using prefixed until Apple implements the whole thing. I'll find out soon. Probably tomorrow.

[joeyparrish]

A teammate has confirmed that requestMediaKeySystemAccess is available on Safari 12.1 on Mojave specifically. It's not on 12.1 on High Sierra.

[joeyparrish]

Thank you @avelad for the content. My changes are still in review, but I have your content working with Apple's HLS and fps.1_0!

If anyone else has sample content to contribute, please send them our way!

[osmestad]

I sent a link with some TIDAL sample content to [email protected] now, would be great if you can test that!

[joeyparrish]

Will do! Thank you!

[avelad]

@joeyparrish Can you update README.md file with current Fairplay status?

[joeyparrish]

Yes, thanks for reminding me!

[mathieuedet]

I'm trying to implement Fairplay with new shaka-player version (2.5) ? Can you update documentation to include configuration for Fairplay ?

[joeyparrish]

Sure. In the mean time, here's what you need to know.

You use FairPlay just like any other DRM in terms of the license server config:

player.configure({
  drm: {
    servers: {
      'com.apple.fps.1_0': '/path/to/my/server',
    },
  },
});

// or

player.configure('drm.servers.com\\.apple\\.fps\\.1_0', '/path/to/my/server');

In addition, FairPlay requires you to provide a certificate through the "advanced" DRM config:

const response = await fetch('/path/to/my/cert.der');
if (!response.ok) {
  // handle error
}
const cert = await response.arrayBuffer();

player.configure({
  drm: {
    advanced: {
      'com.apple.fps.1_0': {
        serverCertificate: new Uint8Array(cert),
      },
    },
  },
});

// or

player.configure('drm.advanced.com\\.apple\\.fps\\.1_0.serverCertificate',
                 new Uint8Array(cert));

If your license server doesn't use the default formatting for FairPlay license requests/responses, you can use request and response filters to transform them. See the "License Wrapping" tutorials for generic examples of that.

I hope that helps you get started. We'll work on improving the docs around FairPlay so that these things are clearer.

[sandeep-mirpuri]

@joeyparrish I'm so excited about this. Been waiting for it for ages :). But I can't get it to work. I am setting the licenseUrl and certificate ArrayBuffer as described in your comment above. Then trying to load the corresponding m3u8 manifest. But I get a couple of different errors.

1. invalid config, wrong type for .drm.advanced.com.apple.fps.1_0
2. Error code: 6010 - Shaka Error DRM.ENCRYPTED_CONTENT_WITHOUT_DRM_INFO

I assumed that it might be an issue with getting the license key since we need to append a session key and ticket number to the request. I tried registering a request filter for this, but it seems its not even getting as far as the license, since the filter doesn't seem to be firing at all (fires fine on chrome using widevine). This is the line for the key info in the manifest.

#EXT-X-SESSION-KEY:METHOD=SAMPLE-AES,URI="skd://key-server-url",KEYFORMAT="com.apple.streamingkeydelivery",KEYFORMATVERSIONS="1"

I have also attached an image with the logs in my safari browser from shaka

Not sure what is happening here. I am working on getting permissions to share the manifest with you but until then, any pointers? (At the moment we are using a raw implementation using safari's webkit apis. This implementation works fine. Let me know if steps describing this implementation are of any use)