v1.0.0-rc.5.3: bump version (unified release)

freemkv-keysources: keydb search is local to the executable
keydb_search_paths() returns exactly [<exe dir>/keydb.cfg] (or empty if current_exe is unavailable) — no %APPDATA%/.config/XDG lookup. Matches libfreemkv::keydb::default_path.
2026-10-07 18:13:11 +00:00 · 2026-06-24 21:55:08 -07:00 · 2026-06-24 20:46:31 -07:00 · 2026-06-24 17:19:48 -07:00 · 2026-06-24 15:40:50 -07:00
3 changed files with 59 additions and 275 deletions
@@ -1,6 +1,6 @@
 [package]
 name = "freemkv-keysources"
-version = "1.0.0-rc.5.1"
+version = "1.0.0-rc.5.3"
 edition = "2024"
 rust-version = "1.86"
 license = "AGPL-3.0-only"
@@ -11,7 +11,7 @@ categories = ["multimedia"]

 [dependencies]
 # The crate provides the `KeySource` trait + `Key`/`DiscInputs` types these impls fill.
-libfreemkv = "1.0.0-rc.5.1"
+libfreemkv = "1.0.0-rc.5.3"
 # OnlineSource: POST disc inputs + samples to a key service over HTTP.
 ureq = { version = "2", features = ["json"] }
 serde_json = "1"
@@ -15,10 +15,11 @@
 //! Sources are dumb and stateful: each hands its candidate keys out one at a
 //! time via [`KeySource::next_key`], in its own best order, and reports
 //! exhaustion. Compose several with [`MultiSource`] in the caller's chosen
-//! order; [`resolve_and_apply`] drives the loop — handing each key to
-//! `Disc::decrypt_with` (which validates against the disc's content samples) and
-//! stopping at the first that decrypts, or reporting a genuine "no key" when
-//! every source is spent.
+//! order. Resolving those candidates against a disc, and reading the encrypted
+//! content-sample units a key server validates on, is decryption *mechanism* —
+//! it lives in the library (`libfreemkv::resolve_and_apply`,
+//! `libfreemkv::read_encrypted_units`), not here. A source only ever looks a key
+//! up and hands it back; what's done with the key is not its concern.

 mod keydb;
 mod mapfile;
@@ -34,8 +35,6 @@ pub use paths::{default_keydb_path, existing_keydb_path, keydb_search_paths};
 // for the source-side types.
 pub use libfreemkv::{DiscInputs, Key, KeySource};

-use libfreemkv::{Disc, DiscTitle, SectorSource};
-
 /// An ordered composition of key sources, driven as one. `next_key` exhausts
 /// the first source (one candidate per call), then the next, … then `None`.
 /// **The caller supplies the list AND the order** — local-first `[Keydb,
@@ -74,89 +73,3 @@ impl KeySource for MultiSource {
        self.sources.iter().any(|s| s.errored())
    }
 }
-
-/// Drive `sources` until one key decrypts `disc`. Loops `next_key` and hands
-/// each candidate to [`Disc::decrypt_with`] (which validates it against
-/// `inputs.samples` and only mutates the disc on success), returning `true` at
-/// the first key that decrypts and `false` once every source is exhausted — the
-/// genuine "no key for this disc". THE shared key-resolution loop: every
-/// application (the `freemkv` CLI, autorip) uses it instead of re-rolling the
-/// candidate/retry logic, so the "no key" verdict is identical everywhere.
-pub fn resolve_and_apply(
-    sources: &mut dyn KeySource,
-    inputs: &DiscInputs,
-    disc: &mut Disc,
-) -> bool {
-    while let Some(key) = sources.next_key(inputs) {
-        if disc.decrypt_with(key, &inputs.samples).is_ok() {
-            return true;
-        }
-    }
-    false
-}
-
-/// Read up to `n` ENCRYPTED 6144-byte aligned units from `title`'s body, raw (no
-/// decrypt) — the content samples a caller hands to [`resolve_and_apply`] (for
-/// `Disc::decrypt_with` to validate a key against) and that a sample-needing
-/// source (an online key service) byte-validates against.
-///
-/// "Encrypted" is decided by `libfreemkv::aacs::is_aacs_scrambled` — the SAME
-/// predicate the library's decrypt gate and a key service use — so all sides
-/// agree. A clip opens with clear navigation units (PAT/PMT, menus); only the
-/// feature body is scrambled, and a clear unit proves nothing, so this collects
-/// only scrambled ones, sampling the largest extent at its midpoint forward.
-pub fn read_sample_units(
-    reader: &mut dyn SectorSource,
-    title: &DiscTitle,
-    n: usize,
-) -> Vec<Vec<u8>> {
-    const UNIT_LEN: usize = 6144;
-    const UNIT_SECTORS: u32 = 3; // 6144 / 2048
-    const CHUNK_UNITS: u32 = 15; // 45 sectors/read — under the drive transfer cap
-    const MAX_CHUNKS_PER_EXTENT: u32 = 4; // ~60 units scanned at each extent's midpoint
-
-    let mut out: Vec<Vec<u8>> = Vec::new();
-    for ext in &title.extents {
-        let total_units = ext.sector_count / UNIT_SECTORS;
-        if total_units == 0 {
-            continue;
-        }
-        let mut unit = total_units / 2; // midpoint (past the clear nav at the head)
-        for _ in 0..MAX_CHUNKS_PER_EXTENT {
-            if unit >= total_units {
-                break;
-            }
-            let units_this = CHUNK_UNITS.min(total_units - unit);
-            // Saturate: start_lba comes from attacker-controlled UDF/MPLS
-            // extents; a malformed extent near u32::MAX would otherwise panic
-            // (debug) or wrap to a wrong LBA (release). Matches the hardened
-            // pattern in mux/disc.rs and verify.rs; an over-capacity LBA then
-            // fails cleanly via the read_sectors().is_err() break below.
-            let lba = ext
-                .start_lba
-                .saturating_add(unit.saturating_mul(UNIT_SECTORS));
-            let count = (units_this * UNIT_SECTORS) as u16;
-            let mut buf = vec![0u8; count as usize * 2048];
-            // `false` = no recovery retries; the reader is the raw drive/file
-            // (no decrypt decorator), so these are the on-disc encrypted bytes.
-            if reader.read_sectors(lba, count, &mut buf, false).is_err() {
-                break;
-            }
-            for i in 0..units_this as usize {
-                let o = i * UNIT_LEN;
-                if o + UNIT_LEN > buf.len() {
-                    break;
-                }
-                let u = &buf[o..o + UNIT_LEN];
-                if libfreemkv::aacs::is_aacs_scrambled(u) {
-                    out.push(u.to_vec());
-                    if out.len() >= n {
-                        return out;
-                    }
-                }
-            }
-            unit += units_this;
-        }
-    }
-    out
-}
@@ -1,78 +1,37 @@
-//! Where the `keydb.cfg` lives, per OS.
+//! Where the `keydb.cfg` lives: local to the executable, local ONLY.
 //!
 //! Key-path policy belongs with the key sources (this crate), not the library:
 //! libfreemkv is handed a path and reads it. The CLI/app asks here for the
-//! ordered list of locations to *search* (first existing wins) and for the
-//! single *default* location to write to (e.g. `update-keys`/save).
+//! list of locations to *search* (first existing wins) and for the single
+//! *default* location to write to (e.g. `update-keys`/save).
 //!
-//! Resolution order:
-//!
-//! - **Windows**: `%APPDATA%\freemkv\keydb.cfg` FIRST (the idiomatic per-user
-//!   roaming config dir), then the legacy `%USERPROFILE%\.config\freemkv\keydb.cfg`
-//!   for back-compat with installs that predate this fix.
-//! - **Linux / macOS**: `$XDG_CONFIG_HOME/freemkv/keydb.cfg` (if `XDG_CONFIG_HOME`
-//!   is set), then `$HOME/.config/freemkv/keydb.cfg` — the long-standing default,
-//!   unchanged so existing users keep working.
-//!
-//! Pure `std::env` — `%APPDATA%`, `%USERPROFILE%`, `$HOME`, `$XDG_CONFIG_HOME`
-//! are all environment variables, so no `dirs`-style crate is pulled in.
+//! freemkv is a portable, standalone binary: the `keydb.cfg` lives *next to*
+//! the executable — `<dir of current exe>/keydb.cfg` — and nowhere else. There
+//! is no OS-specific config-dir lookup (`%APPDATA%`, `%USERPROFILE%\.config`,
+//! `$XDG_CONFIG_HOME`, `$HOME/.config`). Drop the exe and its `keydb.cfg` in
+//! the same folder and it works. Callers needing a custom location pass
+//! `--keydb PATH`, which bypasses this module entirely.

 use std::path::PathBuf;

-/// The keydb filename plus its `freemkv` subdir, joined onto a base dir.
-fn keydb_under(base: PathBuf) -> PathBuf {
-    base.join("freemkv").join("keydb.cfg")
-}
-
-/// The ordered list of `keydb.cfg` locations to search, most-idiomatic first.
+/// The single `keydb.cfg` location to search: next to the current executable.
+///
+/// Returns exactly one path — `<dir of current exe>/keydb.cfg` — on success.
+/// Returns an empty list if the executable's own directory can't be determined
+/// (`std::env::current_exe()` fails or has no parent); there is deliberately no
+/// OS config-dir fallback (portable / local-only).
 ///
 /// The caller picks the first path that exists on disk (see
 /// [`existing_keydb_path`]); for writing a freshly-downloaded keydb, use
-/// [`default_keydb_path`] (the first entry — the canonical location).
-///
-/// Always returns at least one entry on a normally-configured system; returns
-/// an empty list only if none of the relevant env vars are set.
+/// [`default_keydb_path`].
 pub fn keydb_search_paths() -> Vec<PathBuf> {
-    let mut paths = Vec::new();
-
-    if cfg!(windows) {
-        // Idiomatic Windows location first.
-        if let Ok(appdata) = std::env::var("APPDATA") {
-            if !appdata.is_empty() {
-                paths.push(keydb_under(PathBuf::from(appdata)));
-            }
-        }
-        // Legacy XDG-style dotfolder under the user profile, for back-compat.
-        if let Ok(profile) = std::env::var("USERPROFILE") {
-            if !profile.is_empty() {
-                paths.push(
-                    PathBuf::from(profile)
-                        .join(".config")
-                        .join("freemkv")
-                        .join("keydb.cfg"),
-                );
-            }
-        }
-    } else {
-        // Honour XDG_CONFIG_HOME if the user set it, then the historical default.
-        if let Ok(xdg) = std::env::var("XDG_CONFIG_HOME") {
-            if !xdg.is_empty() {
-                paths.push(keydb_under(PathBuf::from(xdg)));
-            }
-        }
-        if let Ok(home) = std::env::var("HOME") {
-            if !home.is_empty() {
-                paths.push(
-                    PathBuf::from(home)
-                        .join(".config")
-                        .join("freemkv")
-                        .join("keydb.cfg"),
-                );
-            }
-        }
+    match std::env::current_exe()
+        .ok()
+        .and_then(|exe| exe.parent().map(|dir| dir.join("keydb.cfg")))
+    {
+        Some(path) => vec![path],
+        None => Vec::new(),
    }
-
-    paths
 }

 /// The first search path that exists on disk, if any.
@@ -85,9 +44,8 @@ pub fn existing_keydb_path() -> Option<PathBuf> {

 /// The canonical default location to WRITE the keydb to (e.g. after a download).
 ///
-/// This is the first (most idiomatic) entry of [`keydb_search_paths`]:
-/// `%APPDATA%\freemkv\keydb.cfg` on Windows, `~/.config/freemkv/keydb.cfg`
-/// elsewhere. Returns `None` only when the relevant env vars are unset.
+/// This is the sole entry of [`keydb_search_paths`]: `<dir of current exe>/keydb.cfg`.
+/// Returns `None` only when the executable's own directory can't be determined.
 pub fn default_keydb_path() -> Option<PathBuf> {
    keydb_search_paths().into_iter().next()
 }
@@ -96,129 +54,42 @@ pub fn default_keydb_path() -> Option<PathBuf> {
 mod tests {
    use super::*;

-    /// Serialize env-mutating tests: they share the process environment.
-    fn lock() -> std::sync::MutexGuard<'static, ()> {
-        static M: std::sync::Mutex<()> = std::sync::Mutex::new(());
-        M.lock().unwrap_or_else(|e| e.into_inner())
+    /// The expected exe-local keydb path, computed the same way the code does.
+    /// Under `cargo test`, `current_exe()` is the test binary under `target/…`.
+    fn expected_local() -> Option<PathBuf> {
+        std::env::current_exe()
+            .ok()
+            .and_then(|exe| exe.parent().map(|dir| dir.join("keydb.cfg")))
    }

-    /// Build the search list under an explicit env, restoring the prior env
-    /// afterwards. Avoids depending on the host's real HOME/APPDATA.
-    fn with_env(vars: &[(&str, Option<&str>)], f: impl FnOnce()) {
-        let _g = lock();
-        let keys = ["APPDATA", "USERPROFILE", "HOME", "XDG_CONFIG_HOME"];
-        let saved: Vec<(&str, Option<String>)> =
-            keys.iter().map(|k| (*k, std::env::var(k).ok())).collect();
-        // Clear all, then apply the requested overrides.
-        for k in keys {
-            unsafe { std::env::remove_var(k) };
-        }
-        for (k, v) in vars {
-            match v {
-                Some(val) => unsafe { std::env::set_var(k, val) },
-                None => unsafe { std::env::remove_var(k) },
+    #[test]
+    fn search_paths_is_exactly_exe_local_keydb() {
+        let paths = keydb_search_paths();
+        match expected_local() {
+            Some(expected) => {
+                assert_eq!(
+                    paths,
+                    vec![expected],
+                    "search list must be exactly [<exe dir>/keydb.cfg]"
+                );
            }
-        }
-        f();
-        // Restore.
-        for (k, v) in saved {
-            match v {
-                Some(val) => unsafe { std::env::set_var(k, val) },
-                None => unsafe { std::env::remove_var(k) },
+            None => {
+                // No exe dir available → empty, no OS fallback (local only).
+                assert!(
+                    paths.is_empty(),
+                    "no exe dir means an empty search list, never an OS fallback"
+                );
            }
        }
    }

-    #[cfg(windows)]
    #[test]
-    fn windows_prefers_appdata_then_legacy_userprofile() {
-        with_env(
-            &[
-                ("APPDATA", Some(r"C:\Users\matt\AppData\Roaming")),
-                ("USERPROFILE", Some(r"C:\Users\matt")),
-            ],
-            || {
-                let paths = keydb_search_paths();
-                assert_eq!(paths.len(), 2, "APPDATA + legacy USERPROFILE");
-                assert_eq!(
-                    paths[0],
-                    PathBuf::from(r"C:\Users\matt\AppData\Roaming")
-                        .join("freemkv")
-                        .join("keydb.cfg"),
-                    "APPDATA location must be searched first on Windows"
-                );
-                assert_eq!(
-                    paths[1],
-                    PathBuf::from(r"C:\Users\matt")
-                        .join(".config")
-                        .join("freemkv")
-                        .join("keydb.cfg"),
-                    "legacy .config dotfolder is the back-compat fallback"
-                );
-                assert_eq!(default_keydb_path(), Some(paths[0].clone()));
-            },
-        );
-    }
-
-    #[cfg(windows)]
-    #[test]
-    fn windows_falls_back_to_legacy_when_appdata_unset() {
-        with_env(
-            &[("APPDATA", None), ("USERPROFILE", Some(r"C:\Users\matt"))],
-            || {
-                let paths = keydb_search_paths();
-                assert_eq!(paths.len(), 1, "only the legacy USERPROFILE path");
-                assert_eq!(
-                    paths[0],
-                    PathBuf::from(r"C:\Users\matt")
-                        .join(".config")
-                        .join("freemkv")
-                        .join("keydb.cfg")
-                );
-            },
-        );
-    }
-
-    #[cfg(not(windows))]
-    #[test]
-    fn unix_default_is_home_dotconfig() {
-        with_env(
-            &[("HOME", Some("/u/me")), ("XDG_CONFIG_HOME", None)],
-            || {
-                let paths = keydb_search_paths();
-                assert_eq!(paths.len(), 1, "just the $HOME/.config default");
-                assert_eq!(
-                    paths[0],
-                    PathBuf::from("/u/me")
-                        .join(".config")
-                        .join("freemkv")
-                        .join("keydb.cfg"),
-                    "Linux/macOS default must remain ~/.config/freemkv/keydb.cfg"
-                );
-                assert_eq!(default_keydb_path(), Some(paths[0].clone()));
-            },
-        );
-    }
-
-    #[cfg(not(windows))]
-    #[test]
-    fn unix_honours_xdg_config_home_first() {
-        with_env(
-            &[
-                ("XDG_CONFIG_HOME", Some("/u/me/.cfg")),
-                ("HOME", Some("/u/me")),
-            ],
-            || {
-                let paths = keydb_search_paths();
-                assert_eq!(paths.len(), 2, "XDG dir + $HOME/.config fallback");
-                assert_eq!(
-                    paths[0],
-                    PathBuf::from("/u/me/.cfg")
-                        .join("freemkv")
-                        .join("keydb.cfg"),
-                    "XDG_CONFIG_HOME, when set, is searched before ~/.config"
-                );
-            },
+    fn default_path_matches_search_head() {
+        // The write default is the single search entry, or None if unavailable.
+        assert_eq!(default_keydb_path(), expected_local());
+        assert_eq!(
+            default_keydb_path(),
+            keydb_search_paths().into_iter().next()
        );
    }
 }
Author	SHA1	Message	Date
Matthew Jackson	02931638d8	v1.0.0-rc.5.3: bump version (unified release)	2026-06-24 21:55:08 -07:00
Matthew Jackson	8d4d8cb576	freemkv-keysources: keydb search is local to the executable keydb_search_paths() returns exactly [<exe dir>/keydb.cfg] (or empty if current_exe is unavailable) — no %APPDATA%/.config/XDG lookup. Matches libfreemkv::keydb::default_path.	2026-06-24 20:46:31 -07:00
Matthew Jackson	a774b483b4	v1.0.0-rc.5.2: bump version (unified release)	2026-06-24 17:19:48 -07:00
Matthew Jackson	dcc1438ae4	freemkv-keysources: pure key lookup Move the encrypted sample reader and the key-resolution loop into libfreemkv (they read the disc and validate keys — decryption mechanism, not lookup). A key source now only looks a key up and hands it back.	2026-06-24 15:40:50 -07:00