freemkv-keysources/CHANGELOG.md

# Changelog

## [1.6.3] — 2026-08-10

### Changed

- **The key service is reached over a newer HTTP client, with the same
  protections.** Before contacting a key service this crate resolves the host,
  rejects any private or link-local address, and then pins the connection to the
  addresses it just checked, so a hostname cannot be re-pointed at an internal
  machine in the moment between the check and the request. That behaviour is
  unchanged; only the client underneath it moved.

### Security

- **The address pinning is now proven by a test rather than assumed.** The checks
  that reject a bad address were well covered, but nothing verified that the
  approved addresses were the ones actually connected to — and every existing
  test still passed with that wiring removed entirely, because none of them
  opened a connection. A connection made to an unreachable name can only
  succeed if the pinned address is honoured, and that is now asserted. No
  defect is being fixed here: the pinning was correct. It simply had no way of
  telling anyone if it stopped being correct.

## [1.6.2] — 2026-08-08

Version sync with the workspace. No functional change in this crate.

## [1.6.1] — 2026-08-07

Version sync with the workspace. No functional change in this crate.

## [1.6.0] — 2026-08-03

### Fixed

- **Key-service failures are no longer indistinguishable from "no key for this
  disc".** `query` returned an empty vector for a 502, a 401, a 429, a
  transport error and an unparseable body alike — the same value a successful
  lookup with no match returns. It now returns a typed error, and the HTTP
  status is classified into the operator action it implies: 401/403 the token,
  429 back off, any other non-2xx the service. A genuine miss is a 200 with no
  key, so every non-2xx is a failure by definition. A DNS failure or timeout
  now counts as unreachable rather than as a bad URL.

Version sync with the workspace (freemkv-engine split release). No source change
in this crate; it remains a pluggable AACS key-source provider consumed by the
`freemkv` CLI and libfreemkv's key resolver.

## [1.5.2] — 2026-07-22

Version sync with the workspace; inherits libfreemkv 1.5.2 (CSS DVD descramble
fix). No source change in this crate.

## [1.4.5] — 2026-07-18

Version sync; inherits libfreemkv 1.4.5. `KeySource` split into `get_unit_keys` +
`get_fmts_indexes`, and a keydb device-key parse bug on an uppercase `0X` hex
prefix was fixed (case-insensitive hex parsing across the toolchain).

## [1.4.4] — 2026-07-17

Version sync; inherits libfreemkv 1.4.4. The online `/decode` request is built from
a `DecodeSampleSet` proven sufficient by type rather than a runtime length check.

## [1.4.3] — 2026-07-17

Version sync; inherits libfreemkv 1.4.3. The online unit-key reply is parsed as a
list (one key for an ordinary disc, the ordered set for a forensic-variant disc),
and `MIN_SAMPLE_UNITS` is re-exported from libfreemkv.

## [1.4.2] — 2026-07-15

Version sync with the workspace; inherits libfreemkv 1.4.2. The keydb test that
feeds real key material into the AACS crypto was adapted to the segregated
`decrypt_unit` + `is_clean` primitives (behaviour unchanged).

## [1.4.1] — 2026-07-14

Version sync with the workspace; inherits libfreemkv 1.4.1.

## [1.4.0] — 2026-07-13

Version sync with the workspace; inherits libfreemkv 1.4.0.

## [1.3.2] — 2026-07-10

### Changed

- Unit keys carry libfreemkv's new `UnitKey.variant_number`; every source
  (keydb, online, VUK-derived) emits `0` — ordinary, non-forensic content —
  via the `UnitKey::new` constructor. No behaviour change. Inherits
  **libfreemkv 1.3.2**.

## [1.3.1] — 2026-07-10

### Licensing

- **Relicensed to the MIT License, from 1.3.1 onwards** (releases up to and
  including 1.3.0 remain under AGPL-3.0).

Version sync with the workspace; inherits libfreemkv 1.3.1.

## [1.3.0] — 2026-07-08

### Added

- **AACS 2.0 host certs round-trip through `keydb.cfg`.** `to_keydb_cfg` now
  emits the sibling `| HC2 |` line — the inverse of the v2 host-cert parser — so
  writing a keydb back out no longer silently drops AACS 2.0 host certs.

### Changed

- **Resolve runs directly on `libfreemkv::aacs` primitives.** After libfreemkv
  dropped its `aacs::boil` veneer, the resolve path now calls
  `derive_media_key_from_{pk,dk}`, `derive_vuk`, and `decrypt_unit_key` from
  `aacs::derive` with the `aacs::types` newtypes. No behaviour change.
- Inherits **libfreemkv 1.3.0**.

### Fixed

- **keydb save-validation matches the parser exactly.** A `0x` line counts as a
  disc entry only when it also contains ` = `, so validating and persisting
  content that parses to zero usable entries (e.g. a stray `0xDEADBEEF` line) can
  no longer succeed.
- **Disc-entry titles round-trip verbatim** (parentheses and all) — the parse
  path now keeps the title exactly as the emit path writes it.

## [1.2.0] — 2026-06-29

### Changed

- **One hex parser across the toolchain.** Online and keydb hex inputs now parse
  through `libfreemkv::hex`, the same parser the library uses — no separate
  decoder with its own length/nibble rules.
- **`DiscInputs` carries the disc's AACS version**, and the tests derive the
  `Unit_Key_RO` stride from `inputs.version` instead of hardcoding it, so an
  AACS-1.0 (V10, 48-byte) and AACS-2.x (V20/V21, 64-byte) disc are each handled
  at their own stride.
- **Online MKB read cap aligned with libfreemkv (64 MiB)**, and an over-cap MKB
  is logged rather than silently truncated.