{"id":"f86cda47-b33c-4a21-b33d-b24228a4def2","task":"Build a multi-DRM license proxy that routes FairPlay SPC, Widevine license challenge, and PlayReady license requests to the correct backend based on the requesting CDM","domain":"w3.org","steps":["Encrypt content once with CENC (or cbcs for FairPlay compatibility) and embed one PSSH box per DRM system (Widevine, PlayReady) at packaging time using a tool like Shaka Packager or Bento4; FairPlay does not use a PSSH box and is keyed separately via its own certificate flow","On the client, rely on the browser's Encrypted Media Extensions (EME) implementation to have its CDM parse the pssh box matching its own system ID and issue a DRM-specific license request","Implement a single license-proxy endpoint that inspects the incoming request (explicit drm-system parameter, Content-Type, or player-supplied header) and forwards it to the matching backend: Widevine's serialized protobuf challenge, PlayReady's XML SOAP challenge, or FairPlay's raw SPC binary blob","For FairPlay specifically, first serve the FairPlay application certificate to the client so it can generate a valid Server Playback Context (SPC), then forward that SPC to your FairPlay key server and return its Content Key Context (CKC) response unmodified to the player","Enforce your own authorization/entitlement check inside the proxy before forwarding any license request, since DRM key delivery alone is not an access-control layer","Test playback against at least one device per DRM system (a Widevine-based browser, a PlayReady-based device, and Safari/tvOS for FairPlay) since a packaging or signaling bug often only breaks one CDM"],"gotchas":["There is no formal wire-protocol spec for the FairPlay license request/response format - every FairPlay-capable key server implements its own SPC/CKC request shape, so a generic proxy still needs a per-vendor adapter","Treat CKC responses as highly sensitive and never log them - a leaked CKC lets an attacker decrypt that content without needing your proxy again","A packaging step that omits the PSSH box for one DRM system will silently break playback only on devices using that specific CDM, while the others keep working, making the bug easy to miss in single-platform testing"],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/f86cda47-b33c-4a21-b33d-b24228a4def2"}