v1.4.4: bump version (unified release)

The key service now always returns {"UK":[...]} - an array of one for a
plain movie sample, or all 32 index-ordered variant keys for a forensic
sample. OnlineSource::query accepts both the legacy string form and the
array form, emitting one UnitKey per element (index = array position).
Re-export MIN_SAMPLE_UNITS so callers size their samples correctly.

CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## [1.4.2] — 2026-07-15
+
+Version sync with the workspace; inherits libfreemkv 1.4.2. The keydb test that
+feeds real key material into the AACS crypto was adapted to the segregated
+`decrypt_unit` + `is_clean` primitives (behaviour unchanged).
+
+## [1.4.1] — 2026-07-14
+
+Version sync with the workspace; inherits libfreemkv 1.4.1.
+
+## [1.4.0] — 2026-07-13
+
+Version sync with the workspace; inherits libfreemkv 1.4.0.
+
+## [1.3.2] — 2026-07-10
+
+### Changed
+
+- Unit keys carry libfreemkv's new `UnitKey.variant_number`; every source
+  (keydb, online, VUK-derived) emits `0` — ordinary, non-forensic content —
+  via the `UnitKey::new` constructor. No behaviour change. Inherits
+  **libfreemkv 1.3.2**.
+
+## [1.3.1] — 2026-07-10
+
+### Licensing
+
+- **Relicensed to the MIT License, from 1.3.1 onwards** (releases up to and
+  including 1.3.0 remain under AGPL-3.0).
+
+Version sync with the workspace; inherits libfreemkv 1.3.1.
+
 ## [1.3.0] — 2026-07-08
 
 ### Added

Cargo.toml

@@ -1,9 +1,9 @@
 [package]
 name = "freemkv-keysources"
-version = "1.3.0"
+version = "1.4.4"
 edition = "2024"
 rust-version = "1.86"
-license = "AGPL-3.0-only"
+license = "MIT"
 description = "Pluggable AACS key sources (keydb, online key service) for libfreemkv. Each source looks a disc up and hands libfreemkv its terminal Unit Keys via get_uk; the library does all derivation."
 repository = "https://github.com/freemkv/freemkv-keysources"
 keywords = ["aacs", "blu-ray", "uhd", "decryption", "keydb"]
@@ -17,7 +17,7 @@ publish = false
 # The crate provides the `KeySource` trait + `Key`/`DiscInputs` types these impls fill.
 # libfreemkv is git-only now; the committed [patch.crates-io] below redirects this
 # bare version req to the libfreemkv git tag (local dev overrides it to a path).
-libfreemkv = "1.3"
+libfreemkv = "1.4"
 # OnlineSource: POST disc inputs + samples to a key service over HTTP.
 ureq = { version = "2", features = ["json"] }
 serde_json = "1"
@@ -40,4 +40,4 @@ codegen-units = 1
 # overrides it with a path patch via the gitignored .cargo/config.toml (a
 # config-level [patch.crates-io] wins over this manifest one for the same crate).
 [patch.crates-io]
-libfreemkv = { git = "https://github.com/freemkv/libfreemkv", tag = "v1.3.0" }
+libfreemkv = { git = "https://github.com/freemkv/libfreemkv", tag = "v1.4.4" }

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Jackson & Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

src/keydb.rs

@@ -184,10 +184,7 @@ impl KeydbSource {
         // 1. Terminal Unit Keys stored in the entry — directly usable, no
         //    derivation. Preserve the keydb's CPS numbering (idx = num - 1).
         for (num, key) in &entry.unit_keys {
-            keys.push(UnitKey {
+            keys.push(UnitKey::new(num.saturating_sub(1), *key));
-                idx: num.saturating_sub(1),
-                key: *key,
-            });
         }
 
         // The disc's encrypted title keys (from Unit_Key_RO.inf) — what every

src/keydb_format.rs

@@ -1412,7 +1412,7 @@ mod tests {
     //
     // These exercise the parser (KeyDb::load) end-to-end against a real
     // keydb.cfg and feed its material into libfreemkv's AACS crypto
-    // (derive_vuk / decrypt_unit_try_keys). They live here now that the
+    // (derive_vuk, then decrypt_unit + is_clean_ts). They live here now that the
     // parser lives here. All are KEYDB_PATH-env-gated and no-op in CI when
     // the env is unset; they must still COMPILE.
     // ════════════════════════════════════════════════════════════════════
@@ -1466,7 +1466,7 @@ mod tests {
         let original = std::fs::read(&unit_path).unwrap();
         assert_eq!(original.len(), libfreemkv::aacs::content::ALIGNED_UNIT_LEN);
         assert!(
-            libfreemkv::aacs::content::ts_sync_destroyed(&original),
+            !libfreemkv::aacs::content::is_clean(&original, libfreemkv::disc::ContentFormat::BdTs),
             "Unit should be encrypted"
         );
 
@@ -1485,22 +1485,22 @@ mod tests {
 
         eprintln!("Found {} entries with unit keys", candidate_entries.len());
 
-        // Try each entry's unit keys
+        // Try each entry's unit keys: apply the key, then ask whether it opened
+        // the unit (the segregated primitives — decrypt, then structural check).
         for entry in &candidate_entries {
-            let keys: Vec<[u8; 16]> = entry.unit_keys.iter().map(|(_, k)| *k).collect();
+            for (_, key) in &entry.unit_keys {
                 let mut unit = original.clone();
-
+                libfreemkv::aacs::content::decrypt_unit(&mut unit, key);
-            if let Some(res) = libfreemkv::aacs::content::decrypt_unit_try_keys(&mut unit, &keys) {
+                if libfreemkv::aacs::content::is_clean(&unit, libfreemkv::disc::ContentFormat::BdTs)
-                eprintln!(
+                {
-                    "SUCCESS: Decrypted with entry {} ({res:?})",
+                    eprintln!("SUCCESS: Decrypted with entry {}", entry.disc_hash);
-                    entry.disc_hash
-                );
                     // Count TS sync bytes
                     let ts = (0..32).filter(|&i| unit[4 + i * 192] == 0x47).count();
                     eprintln!("  TS sync bytes: {}/32", ts);
                     return;
                 }
             }
+        }
 
         // Expected: none work because this is AACS 2.0 and needs bus decryption first
         eprintln!("No unit key worked (expected for AACS 2.0 BEE disc — needs read_data_key)");

src/lib.rs

@@ -30,7 +30,7 @@ mod paths;
 
 pub use keydb::{KeydbSource, UpdateResult};
 pub use keydb_format::{DiscEntry, KeyDb};
-pub use online::{OnlineSource, validate_keyserver_url};
+pub use online::{MIN_SAMPLE_UNITS, OnlineSource, validate_keyserver_url};
 pub use paths::{default_keydb_path, existing_keydb_path, keydb_search_paths};
 
 // Re-exported for downstream convenience so apps need only depend on this crate
@@ -47,10 +47,7 @@ pub(crate) fn uks_from_vuk(vuk: &[u8; 16], enc_title_keys: &[[u8; 16]]) -> Vec<U
     enc_title_keys
         .iter()
         .enumerate()
-        .map(|(i, e)| UnitKey {
+        .map(|(i, e)| UnitKey::new(i as u32, libfreemkv::aacs::derive::decrypt_unit_key(vuk, e)))
-            idx: i as u32,
-            key: libfreemkv::aacs::derive::decrypt_unit_key(vuk, e),
-        })
         .collect()
 }
 

src/online.rs

@@ -7,7 +7,7 @@ use std::time::Duration;
 use crate::uks_from_vuk;
 use base64::Engine;
 use libfreemkv::aacs::types::UnitKey;
-use libfreemkv::keysource::ResolveCtx;
+use libfreemkv::keysource::{DecodeSampleSet, ResolveCtx};
 use libfreemkv::{Error, KeySource};
 
 // Upper bound on the MKB forwarded to the key service — kept in lockstep with
@@ -16,6 +16,19 @@ use libfreemkv::{Error, KeySource};
 // record stream is normally a few MiB; this is headroom, not an expected size).
 const MAX_MKB_BYTES: usize = 64 * 1024 * 1024;
 const TIMEOUT_SECS: u64 = 180;
+/// Minimum encrypted-content samples the online source will send in one key
+/// request — re-exported from the base crate ([`libfreemkv::keysource::MIN_SAMPLE_UNITS`])
+/// so this crate and libfreemkv's own FMTS forensic query share ONE value.
+///
+/// The service identifies the key by which of the submitted units it decrypts,
+/// so too few samples — especially on FMTS, where a segment interleaves several
+/// variants at the unit level — can return a key that matches an incidental unit
+/// rather than the one asked about (a false positive). A request carrying fewer
+/// is refused (empty result → the resolver moves to the next source) rather than
+/// sent and trusted. Kept public so callers that GATHER the samples (the CLI,
+/// autorip) sample at least this many — sampling fewer guarantees the request is
+/// skipped and the online source never consulted.
+pub use libfreemkv::keysource::MIN_SAMPLE_UNITS;
 /// Hard cap on the key-service response body. A real unit-key reply is a few
 /// hundred bytes; bound the read so a malicious/compromised server can't drive
 /// the client to OOM with an unbounded body.
@@ -219,6 +232,23 @@ impl OnlineSource {
             );
             return Vec::new();
         }
+        // Gather encrypted-content samples and prove the minimum by TYPE: a
+        // `DecodeSampleSet` only exists with >= MIN_SAMPLE_UNITS units, so from here
+        // on the request cannot be built under-sized. The service resolves a key by
+        // which submitted unit it decrypts, so a request carrying too few can return
+        // a key matching an incidental unit (a false positive, seen on FMTS variant
+        // units) — too few → skip this source and fall through to the next.
+        let gathered = ctx.samples(64).unwrap_or_default();
+        let n = gathered.len();
+        let Some(samples) = DecodeSampleSet::new(gathered) else {
+            tracing::info!(
+                target: "freemkv::keysource",
+                samples = n,
+                min = MIN_SAMPLE_UNITS,
+                "too few content samples for a reliable online key request; skipping the online source"
+            );
+            return Vec::new();
+        };
         let b64 = base64::engine::general_purpose::STANDARD;
         let mut body = serde_json::json!({
             // Raw Unit_Key_RO.inf, verbatim — the server does its own parse /
@@ -229,18 +259,15 @@ impl OnlineSource {
         if let Some(vid) = ctx.vid() {
             body["vid_b64"] = serde_json::Value::String(b64.encode(vid.0));
         }
-        // Up to a generous cap of encrypted content samples for server-side
+        // Encrypted-content samples for server-side ciphertext validation (already
-        // ciphertext validation.
+        // gathered + minimum-checked above).
-        if let Ok(samples) = ctx.samples(64) {
-            if !samples.is_empty() {
         body["units_b64"] = serde_json::Value::Array(
             samples
+                .units()
                 .iter()
                 .map(|u| serde_json::Value::String(b64.encode(u)))
                 .collect(),
         );
-            }
-        }
         // The disc's own title (UDF/ISO volume id), plain text. The key service
         // catalogs it by disc_hash (its disc-titles.json) — independent of keydb.
         if let Some(label) = ctx.title().map(str::trim) {
@@ -303,10 +330,28 @@ impl OnlineSource {
             Ok(j) => j,
             Err(_) => return Vec::new(),
         };
-        // A terminal UK is used directly (CPS unit 0 → committed cps 1, matching
+        // `UK` is an ARRAY of hex keys (the service always returns an array now,
-        // the old `Key::Unit(vec![(1, uk)])`).
+        // even of one). A single element is the base Unit Key. A full set (one per
-        if let Some(uk) = json.get("UK").and_then(|u| u.as_str()).and_then(parse_uk) {
+        // forensic index, ordered index 1..N) is returned for a forensic sample.
-            return vec![UnitKey { idx: 0, key: uk }];
+        // Preserve array order and tag each key with its array position, so the
+        // caller can map position → index (element i = index i+1). A bare string is
+        // still accepted for backward compatibility.
+        if let Some(uk) = json.get("UK") {
+            let mut out = Vec::new();
+            if let Some(s) = uk.as_str() {
+                if let Some(k) = parse_uk(s) {
+                    out.push(UnitKey::new(0, k));
+                }
+            } else if let Some(arr) = uk.as_array() {
+                for (i, v) in arr.iter().enumerate() {
+                    if let Some(k) = v.as_str().and_then(parse_uk) {
+                        out.push(UnitKey::new(i as u32, k));
+                    }
+                }
+            }
+            if !out.is_empty() {
+                return out;
+            }
         }
         // A VUK is derived to the terminal keys locally, via the disc's
         // encrypted title keys from the context — the library owns the crypto.

tests/key_sources.rs

@@ -267,10 +267,7 @@ impl KeySource for ScriptedSource {
 }
 
 fn uk(b: u8) -> UnitKey {
-    UnitKey {
+    UnitKey::new(0, [b; 16])
-        idx: 0,
-        key: [b; 16],
-    }
 }
 
 #[test]