Shaka Packager integration

This guide explains how to integrate Shaka Packager with Cloud DRM to protect MPEG-DASH and HLS content using Widevine, PlayReady, and FairPlay. The integration uses the CPIX format for key provisioning and supports multi-DRM packaging.

Overview

Cloud DRM provides encryption keys via the CPIX API to Shaka Packager, which then packages the content with the necessary DRM protection. The integration requires you to obtain specific parameters from the Cloud DRM web console to configure the packager command line.

Configuration

To configure your settings, log in to the DRM Dashboard -> Configuration and collect the following parameters from the KMS section.

Parameter	Location in Console	Description
CPIX URL	API section	Used by Shaka Packager to fetch encryption keys in CPIX format
API Key	Authentication section	Used to authorize requests to Cloud DRM

To learn how to request the CPIX document, refer to the official guide on How to request CPIX from Cloud DRM.

Example CPIX Response from Cloud DRM

The CPIX API from Cloud DRM will return a document containing the content keys and DRM-specific protection headers. An example response is shown below:

<cpix:CPIX xmlns:pskc="urn:ietf:params:xml:ns:keyprov:pskc"
           xmlns:speke="urn:aws:amazon:com:speke"
           xmlns:cpix="urn:dashif:org:cpix">
  <cpix:ContentKeyList>
    <cpix:ContentKey kid="5b220272-c6e0-478f-b12a-ac875385fe8a" explicitIV="wM8K3NLlTdq5h7I1NDq/qg==">
      <cpix:Data>
        <pskc:Secret>
          <pskc:PlainValue>TN4jZ6rr84bIxdhI/pFV8Q==</pskc:PlainValue>
        </pskc:Secret>
      </cpix:Data>
    </cpix:ContentKey>
  </cpix:ContentKeyList>

  <cpix:DRMSystemList>
    <cpix:DRMSystem kid="5b220272-c6e0-478f-b12a-ac875385fe8a" systemId="94ce86fb-07ff-4f43-adb8-93d2fa968ca2">
      <cpix:HLSSignalingData playlist="media">
        <![CDATA[I0VYVC1YLUtFWTpNRVRIT0Q9U0FNUExFLUFFUyxVUkk9InNrZDovL2RybS5vcnMuYXQvYWNxdWlyZS1saWNlbnNlL2ZhaXJwbGF5...]]>
      </cpix:HLSSignalingData>
    </cpix:DRMSystem>

    <cpix:DRMSystem kid="5b220272-c6e0-478f-b12a-ac875385fe8a" systemId="edef8ba9-79d6-4ace-a3c8-27dcd51d21ed">
      <cpix:PSSH>AAAAZ3Bzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAAEcIARIQWyICcsbgR4+xKqyHU4X+ihoFaW5zeXMiJDViMjIwMjcyLWM2ZTAtNDc4Zi1iMTJhLWFjODc1Mzg1ZmU4YSoCU0QyAA==</cpix:PSSH>
    </cpix:DRMSystem>

    <cpix:DRMSystem kid="5b220272-c6e0-478f-b12a-ac875385fe8a" systemId="9a04f079-9840-4286-ab92-e65be0885f95">
      <cpix:PSSH>AAADTHBzc2gAAAAAmgTweZhAQoarkuZb4IhflQAAAywsAwAAAQABACIDPABXAFIATQBIAEUA...</cpix:PSSH>
    </cpix:DRMSystem>
  </cpix:DRMSystemList>
</cpix:CPIX>

Parameters to Extract from CPIX

The following table shows the parameters you need to extract from the CPIX response to use with the Shaka Packager command.

Field	XML Element / Attribute	Use in Shaka Packager Command
Key ID	`kid` attribute in `<cpix:ContentKey>`	`--keys` hex string (without ‘-’ sign)
Key (Base64)	`<pskc:PlainValue>`	`--keys` hex string converted from base64
IV (Base64)	`explicitIV` attribute in `<cpix:ContentKey>`	`--iv` hex string converted from base64
Widevine PSSH	`<cpix:PSSH>` with systemId `edef8ba9-...`	`--pssh` optional hex string converted from base64 if missing v1 common PSSH box will be generated
FairPlay URI	`<cpix:HLSSignalingData>`	`--hls_key_uri` plain text string converted from base64

Packaging Command Example

This example assumes that DASH and HLS will use the cbcs protection scheme. If CENC is required for DASH, separate commands must be issued with the proper protection scheme.

packager \
  input=input_video.mp4,stream=video,output=video_encrypted.mp4 \
  input=input_audio.mp4,stream=audio,output=audio_encrypted.mp4 \
  --enable_raw_key_encryption \
  --clear_lead 0 \
  --protection_scheme cbcs \
  --protection_systems Widevine,PlayReady,FairPlay \
  --hls_key_uri "skd://la.drm.cloud/acquire-license/fairplay?..." \
  --keys label=:key_id=f3c5e0361e6654b28f8049c778b23946:key=a4631a153a443df9eed0593043db7519:iv=11223344556677889900112233445566 \
  --mpd_output output.mpd \
  --hls_master_playlist_output master.m3u8

License Acquisition Flow

The player requests a manifest (e.g., output.mpd or master.m3u8).
The manifest includes DRM signaling (PSSH boxes or HLS tags).
The player extracts the license acquisition URL and sends a license request to Cloud DRM.
Cloud DRM validates the request and returns a license.

For more details on how to issue licenses, refer to the Cloud DRM License Acquisition Guide.

Overview​

Configuration​

Example CPIX Response from Cloud DRM​

Parameters to Extract from CPIX​

Packaging Command Example​