Provisioning a device - unshackle-dl/unshackle GitHub Wiki

Widevine Provisions

A Widevine Provision is needed for acquiring licenses containing decryption keys for DRM-protected content. They are not needed if you will be using unshackle on DRM-free services. Please do not ask for any widevine Device Files, Keys, or Provisions as they cannot be provided.

unshackle only supports .WVD files (widevine Device Files). However, if you have the Provision RSA Private Key and Device Client Identification Blob as blob files (e.g., device_private_key and device_client_id_blob), then you can convert them to a .WVD file by running uv run unshackle wvd new --help.

To create or manage WVD files, use the built-in CLI commands:

  • uv run unshackle wvd new — Create a new WVD file from device keys and certificates
  • uv run unshackle wvd add — Add one or more WVD files to the WVDs Directory
  • uv run unshackle wvd delete — Delete one or more WVD files from the WVDs Directory
  • uv run unshackle wvd parse — Parse a WVD file to check information
  • uv run unshackle wvd dump — Extract data from a WVD file to a folder structure

Once you have .WVD files, place them in the WVDs directory which can be found by calling uv run unshackle env info. You can then set in your config which WVD (by filename only) to use by default with uv run unshackle cfg cdm.default wvd_name. From here you can then set which WVD to use for each specific service. It's best to use the lowest security-level provision where possible.

An alternative would be using a pywidevine Serve-compliant CDM API. Of course, you would need to know someone who is serving one, and they would need to give you access. Take a look at the remote_cdm config option for setup information. For further information on it see the pywidevine repository.

PlayReady Provisions

Similarly, a PlayReady Device file (.PRD) is needed for acquiring licenses and decryption keys for PlayReady DRM-protected content. PRD files are not required for DRM-free services. unshackle only supports .PRD files (PlayReady Device Files).

To create or manage PRD files, use the built-in CLI commands:

  • uv run unshackle prd new — Create a new PRD PlayReady Device file from group keys and certificates
  • uv run unshackle prd reprovision — Reprovision a PlayReady Device (.prd) file
  • uv run unshackle prd test — Test a PlayReady Device on the Microsoft demo server

Once you have .PRD files, place them in the PRDs/ directory (see uv run unshackle env info for the path). You can set the default PRD file in your config with uv run unshackle cfg cdm.default prd_name. Service-specific PRD files can also be set in the config, just like Widevine. For best compatibility, use the lowest security-level PRD file available.

Do not ask for PRD device files, keys, or provisions as they cannot be provided. Only use PRD files for services you have the legal right to access.