freemkv-keysources/CHANGELOG.md

Changelog

[1.6.4] — UNRELEASED

Changed

• No functional change. This crate ships alongside the rest of freemkv at a matching version; its behaviour is untouched.

[1.6.3] — 2026-08-10

Changed

• The key service is reached over a newer HTTP client, with the same protections. Before contacting a key service this crate resolves the host, rejects any private or link-local address, and then pins the connection to the addresses it just checked, so a hostname cannot be re-pointed at an internal machine in the moment between the check and the request. That behaviour is unchanged; only the client underneath it moved.

Security

• The address pinning is now proven by a test rather than assumed. The checks that reject a bad address were well covered, but nothing verified that the approved addresses were the ones actually connected to — and every existing test still passed with that wiring removed entirely, because none of them opened a connection. A connection made to an unreachable name can only succeed if the pinned address is honoured, and that is now asserted. No defect is being fixed here: the pinning was correct. It simply had no way of telling anyone if it stopped being correct.

[1.6.2] — 2026-08-08

Version sync with the workspace. No functional change in this crate.

[1.6.1] — 2026-08-07

Version sync with the workspace. No functional change in this crate.

[1.6.0] — 2026-08-03

Fixed

• Key-service failures are no longer indistinguishable from "no key for this disc". query returned an empty vector for a 502, a 401, a 429, a transport error and an unparseable body alike — the same value a successful lookup with no match returns. It now returns a typed error, and the HTTP status is classified into the operator action it implies: 401/403 the token, 429 back off, any other non-2xx the service. A genuine miss is a 200 with no key, so every non-2xx is a failure by definition. A DNS failure or timeout now counts as unreachable rather than as a bad URL.

Version sync with the workspace (freemkv-engine split release). No source change in this crate; it remains a pluggable AACS key-source provider consumed by the freemkv CLI and libfreemkv's key resolver.

[1.5.2] — 2026-07-22

Version sync with the workspace; inherits libfreemkv 1.5.2 (CSS DVD descramble fix). No source change in this crate.

[1.4.5] — 2026-07-18

Version sync; inherits libfreemkv 1.4.5. KeySource split into get_unit_keys + get_fmts_indexes, and a keydb device-key parse bug on an uppercase 0X hex prefix was fixed (case-insensitive hex parsing across the toolchain).

[1.4.4] — 2026-07-17

Version sync; inherits libfreemkv 1.4.4. The online /decode request is built from a DecodeSampleSet proven sufficient by type rather than a runtime length check.

[1.4.3] — 2026-07-17

Version sync; inherits libfreemkv 1.4.3. The online unit-key reply is parsed as a list (one key for an ordinary disc, the ordered set for a forensic-variant disc), and MIN_SAMPLE_UNITS is re-exported from libfreemkv.

[1.4.2] — 2026-07-15

Version sync with the workspace; inherits libfreemkv 1.4.2. The keydb test that feeds real key material into the AACS crypto was adapted to the segregated decrypt_unit + is_clean primitives (behaviour unchanged).

[1.4.1] — 2026-07-14

Version sync with the workspace; inherits libfreemkv 1.4.1.

[1.4.0] — 2026-07-13

Version sync with the workspace; inherits libfreemkv 1.4.0.

[1.3.2] — 2026-07-10

Changed

• Unit keys carry libfreemkv's new UnitKey.variant_number; every source (keydb, online, VUK-derived) emits 0 — ordinary, non-forensic content — via the UnitKey::new constructor. No behaviour change. Inherits libfreemkv 1.3.2.

[1.3.1] — 2026-07-10

Licensing

• Relicensed to the MIT License, from 1.3.1 onwards (releases up to and including 1.3.0 remain under AGPL-3.0).

Version sync with the workspace; inherits libfreemkv 1.3.1.

[1.3.0] — 2026-07-08

Added

• AACS 2.0 host certs round-trip through keydb.cfg. to_keydb_cfg now emits the sibling | HC2 | line — the inverse of the v2 host-cert parser — so writing a keydb back out no longer silently drops AACS 2.0 host certs.

Changed

• Resolve runs directly on libfreemkv::aacs primitives. After libfreemkv dropped its aacs::boil veneer, the resolve path now calls derive_media_key_from_{pk,dk}, derive_vuk, and decrypt_unit_key from aacs::derive with the aacs::types newtypes. No behaviour change.
• Inherits libfreemkv 1.3.0.

Fixed

• keydb save-validation matches the parser exactly. A 0x line counts as a disc entry only when it also contains =, so validating and persisting content that parses to zero usable entries (e.g. a stray 0xDEADBEEF line) can no longer succeed.
• Disc-entry titles round-trip verbatim (parentheses and all) — the parse path now keeps the title exactly as the emit path writes it.

[1.2.0] — 2026-06-29

Changed

• One hex parser across the toolchain. Online and keydb hex inputs now parse through libfreemkv::hex, the same parser the library uses — no separate decoder with its own length/nibble rules.
• DiscInputs carries the disc's AACS version, and the tests derive the Unit_Key_RO stride from inputs.version instead of hardcoding it, so an AACS-1.0 (V10, 48-byte) and AACS-2.x (V20/V21, 64-byte) disc are each handled at their own stride.
• Online MKB read cap aligned with libfreemkv (64 MiB), and an over-cap MKB is logged rather than silently truncated.