v1.4.2: bump version (unified release)

The KEYDB-gated test that feeds real key material into libfreemkv's AACS crypto
now composes decrypt_unit + is_clean (the removed decrypt_unit_try_keys wrapper's
behaviour), unchanged semantics.

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [1.4.2] — 2026-07-15
+
+Version sync with the workspace; inherits libfreemkv 1.4.2. The keydb test that
+feeds real key material into the AACS crypto was adapted to the segregated
+`decrypt_unit` + `is_clean` primitives (behaviour unchanged).
+
+## [1.4.1] — 2026-07-14
+
+Version sync with the workspace; inherits libfreemkv 1.4.1.
+
 ## [1.4.0] — 2026-07-13
 
 Version sync with the workspace; inherits libfreemkv 1.4.0.

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "freemkv-keysources"
-version = "1.4.0"
+version = "1.4.2"
 edition = "2024"
 rust-version = "1.86"
 license = "MIT"
@@ -40,4 +40,4 @@ codegen-units = 1
 # overrides it with a path patch via the gitignored .cargo/config.toml (a
 # config-level [patch.crates-io] wins over this manifest one for the same crate).
 [patch.crates-io]
-libfreemkv = { git = "https://github.com/freemkv/libfreemkv", tag = "v1.4.0" }
+libfreemkv = { git = "https://github.com/freemkv/libfreemkv", tag = "v1.4.2" }

src/keydb_format.rs

@@ -1412,7 +1412,7 @@ mod tests {
     //
     // These exercise the parser (KeyDb::load) end-to-end against a real
     // keydb.cfg and feed its material into libfreemkv's AACS crypto
-    // (derive_vuk / decrypt_unit_try_keys). They live here now that the
+    // (derive_vuk, then decrypt_unit + is_clean_ts). They live here now that the
     // parser lives here. All are KEYDB_PATH-env-gated and no-op in CI when
     // the env is unset; they must still COMPILE.
     // ════════════════════════════════════════════════════════════════════
@@ -1485,20 +1485,20 @@ mod tests {
 
         eprintln!("Found {} entries with unit keys", candidate_entries.len());
 
-        // Try each entry's unit keys
+        // Try each entry's unit keys: apply the key, then ask whether it opened
+        // the unit (the segregated primitives — decrypt, then structural check).
         for entry in &candidate_entries {
-            let keys: Vec<[u8; 16]> = entry.unit_keys.iter().map(|(_, k)| *k).collect();
-            let mut unit = original.clone();
-
-            if let Some(res) = libfreemkv::aacs::content::decrypt_unit_try_keys(&mut unit, &keys) {
-                eprintln!(
-                    "SUCCESS: Decrypted with entry {} ({res:?})",
-                    entry.disc_hash
-                );
-                // Count TS sync bytes
-                let ts = (0..32).filter(|&i| unit[4 + i * 192] == 0x47).count();
-                eprintln!("  TS sync bytes: {}/32", ts);
-                return;
+            for (_, key) in &entry.unit_keys {
+                let mut unit = original.clone();
+                libfreemkv::aacs::content::decrypt_unit(&mut unit, key);
+                if libfreemkv::aacs::content::is_clean(&unit, libfreemkv::disc::ContentFormat::BdTs)
+                {
+                    eprintln!("SUCCESS: Decrypted with entry {}", entry.disc_hash);
+                    // Count TS sync bytes
+                    let ts = (0..32).filter(|&i| unit[4 + i * 192] == 0x47).count();
+                    eprintln!("  TS sync bytes: {}/32", ts);
+                    return;
+                }
             }
         }