Closed Bug 1287925 Opened 9 years ago Closed 9 years ago

Update Widevine CDM to version 903 (Windows, Mac, and Linux)

Categories

(Release Engineering :: Release Requests, defect, P2)

Product:
Release Engineering
Component:
Release Requests
Type:
defect

Tracking

(firefox47 wontfix, firefox48 wontfix, firefox49 ?, firefox50 affected)

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox47 --- wontfix
firefox48 --- wontfix
firefox49 --- ?
firefox50 --- affected

People

(Reporter: cpeterson, Assigned: Callek)

References

Details

Attachments

(1 file, 1 obsolete file)

Widevine-1.4.8.903.json
2.44 KB, application/json
Details
Depends on: 1273214
We are now ready to push this out. Please can we update the balrog rules to push out Widevine CDM version 1.4.8.903 to Windows Vista and later x86, Windows 7 and later x86 and x64, MacOSX x64, and Linux x86 and x64? We want to push these out to Firefox version >= 50. Windows Vista and later, 32bit: URL: https://redirector.gvt1.com/edgedl/widevine-cdm/903-win-ia32.zip SHA512: d7e10d09c87a157af865f8388ba70ae672bd9e38987bdd94077af52d6b1abaa745b3db92e9f93f607af6420c68210f7cfd518a9d2c99fecf79aed3385cbcbc0b Size: 2884452 Version: 1.4.8.903 Windows 7 and later, x64: URL: https://redirector.gvt1.com/edgedl/widevine-cdm/903-win-x64.zip SHA512: 33497f3458846e11fa52413f6477bfe1a7f502da262c3a2ce9fe6d773a4a2d023c54228596eb162444b55c87fb126de01f60fa729d897ef5e6eec73b2dfbdc7a Size: 2853777 Version: 1.4.8.903 MacOSX x64: URL: https://redirector.gvt1.com/edgedl/widevine-cdm/903-mac-x64.zip SHA512: 1916805e84a49e04748204f4e4c48ae52c8312f7c04afedacacd7dfab2de424412bc988a8c3e5bcb0865f8844b569c0eb9589dae51e74d9bdfe46792c9d1631f Size: 2155607 Version: 1.4.8.903 (Note: We're not supporting 32bit MacOSX at the moment, and you can remove rules for now unsupported MacOSX < 10.9 now) Linux 64bit: URL: https://redirector.gvt1.com/edgedl/widevine-cdm/903-linux-x64.zip SHA512: 1edfb58a44792d2a53694f46fcc698161edafb2a1fe0e5c31b50c1d52408b5e8918d9f33271c62a19a65017694ebeacb4f390fe914688ca7b1952cdb84ed55ec Size: 2975492 Version: 1.4.8.903 (Note: We're not ready to push out 32bit Linux support in 50)
Assignee: cpearce → nobody
Flags: needinfo?(bugspam.Callek)
Looks like I need to defer this from actual necessity for a bit... Balrog has an explicit whitelist for domains, can you (cpearce) help us identify what redirector.gvt1.com is used for, what else can be hosted on there, and how we can restrict this at least as good as the existing source location. In order to ship this update we need to update our whitelist in balrog, thus the n-i to ben, e.g. https://github.com/mozilla/balrog/blob/2bd805aafde2d312a006729e11c38e268f088c65/uwsgi/public.wsgi#L9 I'm not sure when we can next deploy an update to balrog, since this is also release-week, I'll defer ben on the code change side and the when-it-can-deploy. Thanks!
Flags: needinfo?(cpearce)
Flags: needinfo?(bugspam.Callek)
Flags: needinfo?(bhearsum)
(In reply to Justin Wood (:Callek) from comment #2) > Balrog has an explicit whitelist for domains, can you (cpearce) help us > identify what redirector.gvt1.com is used for, what else can be hosted on > there, and how we can restrict this at least as good as the existing source > location. This domain is controlled by Google. It is used to redirect the request to a download end point in a load-balanced fashion. The actual download end points are also controlled by Google. I think it's reasonable to assume that Google do a good job of securing their servers. I've asked the Google team who has access to these servers.
Hey Chris, So after discussion with cloudops (who now maintains balrog) and catlee, we may be blocked on this week, for this week, unless theres a big issue. (In reply to Chris Pearce (:cpearce) from comment #3) > (In reply to Justin Wood (:Callek) from comment #2) > > Balrog has an explicit whitelist for domains, can you (cpearce) help us > > identify what redirector.gvt1.com is used for, what else can be hosted on > > there, and how we can restrict this at least as good as the existing source > > location. > > I think it's reasonable to assume that Google do a good job of securing > their servers. So, with discussion with catlee, we're not blocking on the url issue. I had the exact same concerns with regard to the old url location, and at about the same severity, and since we can agree that Google is similarly good at securing their servers, we probably are fine there. What does need to happen though, is we need to deploy an update to Balrog (our update system) to support this new url, since we whitelist supported urls (to prevent some malicious vectors, should someone get in), this whitelist is restricted to the widevine plugin in this case, however the server upgrade is not. Since this is release week, cloudops is very very hesitant to take an update to balrog (admin and user-facing systems) unless there was a similarly strong need for this to go out this week. Adding to the timidness is the fact that the cloudops deploy process is new (within the last month) and the Releng team member who has been coordinating it (and QA'ing all deploys so far) is on PTO (bhearsum). Cpearce, can you confirm if waiting until next week, once ben is back, is a suitable timeframe for deploying this?
Flags: needinfo?(bhearsum)
OK. Can nthomas do this on Monday NZ time?
Flags: needinfo?(cpearce) → needinfo?(nthomas)
It's unlikely we'd have the change deployed by then, unless this is an urgent request. Could you clarify the situation ?
Flags: needinfo?(nthomas)
(In reply to Nick Thomas [:nthomas] from comment #6) > It's unlikely we'd have the change deployed by then, unless this is an > urgent request. Could you clarify the situation ? It's not urgent. It's just that we've been waiting 8 days so far, so we're getting impatient and were hoping to be able to reduce further delay by having someone in the NZ time zone handle this.
Can we please also push out the 32bit Linux build to Firefox >= 50. Linux 32bit: URL: https://redirector.gvt1.com/edgedl/widevine-cdm/903-linux-ia32.zip SHA512: 5c4beb72ea693740a013b60bc5491a042bb82fa5ca6845a2f450579e2e1e465263f19e7ab6d08d91deb8219b30f092ab6e6745300d5adda627f270c95e5a66e0 Size: 3084582 Version: 1.4.8.903 (32bit Linux had sandboxing issues, which have now been fixed.)
Attached file Widevine-1.4.8.903.json (obsolete) —
Attached is the release blob I plan to upload. -- This only describes the available files for .903 and which platforms, not the rules for which releases they apply to. I'm confirming on the OSX rules to "not support 32 bit" since I may as well not even have a Release blob that can serve it.
Assignee: nobody → bugspam.Callek
Status: NEW → ASSIGNED
(take 2)
Attachment #8779032 - Attachment is obsolete: true
Clarification Questions: * Should this go live on all (>=50) product versions at the same time? * Are you going to tell the release-drivers list about this update? (In reply to Chris Pearce (:cpearce) from comment #1) > We are now ready to push this out. > > Please can we update the balrog rules to push out Widevine CDM version > 1.4.8.903 to Windows Vista and later x86, Windows 7 and later x86 and x64, > MacOSX x64, and Linux x86 and x64? We want to push these out to Firefox > version >= 50. * < win7 x64 -- no widevine at all? (currently no widevine) * < winvista -- same question (currently no widevine) * Firefox 47.0a1 ==> Firefox < 50.0a1 --- Stay with Widevine 1.4.8.866? * OSX < 10.9 -- Keep with Widevine 1.4.8.866 ? ?
Flags: needinfo?(cpearce)
(In reply to Justin Wood (:Callek) from comment #11) > Clarification Questions: I just set this live (on channel `nightlytest`!) with those questions answered as I assume them to be, inline here. > > * Should this go live on all (>=50) product versions at the same time? (answer doesn't matter while you QA, but required for next part) > * Are you going to tell the release-drivers list about this update? (Assumption: Yes, since them knowing and being able to block is a requirement) > * < win7 x64 -- no widevine at all? (currently no widevine) > * < winvista -- same question (currently no widevine) > * Firefox 47.0a1 ==> Firefox < 50.0a1 --- Stay with Widevine 1.4.8.866? > * OSX < 10.9 -- Keep with Widevine 1.4.8.866 ? Assumptions are already there ;-)
(In reply to Justin Wood (:Callek) from comment #11) > Clarification Questions: > > * Should this go live on all (>=50) product versions at the same time? Yes. > * Are you going to tell the release-drivers list about this update? I'll let them know we've pushed out the update. > (In reply to Chris Pearce (:cpearce) from comment #1) > > We are now ready to push this out. > > > > Please can we update the balrog rules to push out Widevine CDM version > > 1.4.8.903 to Windows Vista and later x86, Windows 7 and later x86 and x64, > > MacOSX x64, and Linux x86 and x64? We want to push these out to Firefox > > version >= 50. > > * < win7 x64 -- no widevine at all? (currently no widevine) Yes. > * < winvista -- same question (currently no widevine) Yes. > * Firefox 47.0a1 ==> Firefox < 50.0a1 --- Stay with Widevine 1.4.8.866? Yes. > * OSX < 10.9 -- Keep with Widevine 1.4.8.866 ? We don't support 10.9 in Firefox 50 and later, so the rules for 10.9 in 50 and later can be removed. I've tested nightlytest. Please push out the new CDM update to Firefox >= 50 now.
Flags: needinfo?(cpearce) → needinfo?(bugspam.Callek)
(In reply to Chris Pearce (:cpearce) from comment #13) > > * OSX < 10.9 -- Keep with Widevine 1.4.8.866 ? > > We don't support 10.9 in Firefox 50 and later, so the rules for 10.9 in 50 > and later can be removed. Is it really 10.9, not *lesser than* 10.9?
(In reply to Masatoshi Kimura [:emk] from comment #14) > (In reply to Chris Pearce (:cpearce) from comment #13) > > > * OSX < 10.9 -- Keep with Widevine 1.4.8.866 ? > > > > We don't support 10.9 in Firefox 50 and later, so the rules for 10.9 in 50 > > and later can be removed. > > Is it really 10.9, not *lesser than* 10.9? You're correct. 10.8 and earlier are now unsupported.
This was done last night, and 10.9 is supported, 10.8 is not (has been that way since done)
Flags: needinfo?(bugspam.Callek)
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Thanks Callek. Now that the Linux support uplift has landed, can you please change these rules so that we're pushing Widevine CDM 903 out to Firefox >= 49? Cheers!
Flags: needinfo?(bugspam.Callek)
(In reply to Chris Pearce (:cpearce) from comment #17) > Thanks Callek. Now that the Linux support uplift has landed, can you please > change these rules so that we're pushing Widevine CDM 903 out to Firefox >= > 49? For all platforms or just Linux? I understand rushing Widevine for Linux, where those users have no EME today, but do we need to rush Widevine 903 for Windows and Mac?
:cpearce. I want to cross check some assumptions here and be *sure* what you're asking. * The e-mails to drivers seemed to indicate you just uplifted to aurora and wanted to uplift to beta. * Aurora is Gecko 50 (already deploy) * Beta is Gecko 49 * Linux Widevine has not yet shipped on gecko 49 * Windows/Mac Widevine is also pretty old on Gecko 49, but per :cpeterson in c#18 may need more time So, to ask: * Are you actually asking to enable Widevine on all (supported) platforms on Beta/Gecko 49? * Can you be sure this plan is properly understood in r-d and to communicate that we are indeed shipping it to beta users if so? ** Note if Beta required uplifts to support Widevine, the earliest those uplifts would be in a beta audience build is Friday if the uplifts landed after monday. -- So we *may* not want to enable on 49 just yet. Thanks in advance for the clarity
Flags: needinfo?(bugspam.Callek) → needinfo?(cpearce)
(In reply to Justin Wood (:Callek) from comment #19) > :cpearce. > > I want to cross check some assumptions here and be *sure* what you're asking. > > * The e-mails to drivers seemed to indicate you just uplifted to aurora and > wanted to uplift to beta. > * Aurora is Gecko 50 (already deploy) > * Beta is Gecko 49 > * Linux Widevine has not yet shipped on gecko 49 > * Windows/Mac Widevine is also pretty old on Gecko 49, but per :cpeterson in > c#18 may need more time > > So, to ask: > > * Are you actually asking to enable Widevine on all (supported) platforms on > Beta/Gecko 49? Yes, I want to push out the new Widevine CDM 903 out to Firefox >= 49 on all plaforms. > * Can you be sure this plan is properly understood in r-d and to communicate > that we are indeed shipping it to beta users if so? I'll email drivers. Remember, I'm authorized to push out CDM updates. > ** Note if Beta required uplifts to support Widevine, the earliest those > uplifts would be in a beta audience build is Friday if the uplifts landed > after monday. -- So we *may* not want to enable on 49 just yet. The uplifts landed on beta yesterday. I want to push out so that when users get the builds, they work ASAP. (In reply to Chris Peterson [:cpeterson] from comment #18) > For all platforms or just Linux? I understand rushing Widevine for Linux, > where those users have no EME today, but do we need to rush Widevine 903 for > Windows and Mac? All platforms. I don't want to have different version for different platforms, and there are some bug fixes in this version of the CDM that we should have ASAP.
Flags: needinfo?(cpearce) → needinfo?(bugspam.Callek)
(In reply to Chris Pearce (:cpearce) from comment #20) > (In reply to Justin Wood (:Callek) from comment #19) > > * Are you actually asking to enable Widevine on all (supported) platforms on > > Beta/Gecko 49? > > Yes, I want to push out the new Widevine CDM 903 out to Firefox >= 49 on all > plaforms. Ok, done! > > * Can you be sure this plan is properly understood in r-d and to communicate > > that we are indeed shipping it to beta users if so? > > I'll email drivers. Remember, I'm authorized to push out CDM updates. Understood, I just want everyone on the same page, and if I was confused, I imagine others could have been as well (and not even realized it)
Flags: needinfo?(bugspam.Callek)
werty20, you do not need to download Widevine file yourself. Firefox should handle that automatically in the background. Do you have the URL to the website or web page that tried to download the 903-win-x64.zip file?
This is a bug with Internet Download Manager (IDM). Check for addon updates in Firefox and for IDM. You need to open the IDM options > file types > delete all in automatically download, then click restore defaults in IDM. (I don't have IDM installed so the instructions may be a little unclear) If you still have issues contacting IDM using their form at the bottom of this page would be best http://www.internetdownloadmanager.com/register/new_faq/functions_main.cgi?mode=0
Kevin, has this bug been fixed in recent IDM releases? I wonder if there is a possible Firefox workaround. It is worrisome that IDM would intercept Firefox's internal (not web content) HTTP requests.
Flags: needinfo?(kbrosnan)
I have no idea. I don't use IDM as I mentioned in my comment. I am just parroting a comment from r/firefox which sounds similar to the issue mentioned in comment 22.
Flags: needinfo?(kbrosnan)
thx , i update idm to latest ver , clean and everything , i still get the download even if i open firefox without any website but if is no harm im ok with it i will just forbid idm to download from this site
I can reproduce the issue with IDM intercepting the Widevine CDM download. I'll contact IDM.
For those with problems with IDM, a workaround wound be to add an exception telling IDM not to download the file. Go to Downloads > Options, then got to File types tab, click the Edit list button, then add the following as exception: *903-win-ia32.zip The * will make IDM not download the file from any location.
(In reply to Alexandre da Costa from comment #30) > For those with problems with IDM, a workaround wound be to add an exception > telling IDM not to download the file. > > Go to Downloads > Options, then got to File types tab, click the Edit list > button, then add the following as exception: > > *903-win-ia32.zip > > The * will make IDM not download the file from any location. Oh and if you use the 64bit version use this: *903-win-x64.zip
IDM responded to my inquiry and said that they've already added the relevant URLs to their whitelist which should be rolling out as an update in the next few weeks. So within about 2 weeks 90% of the user population of IDM users should have the fixed whitelist.
Same issue here with IDM, so i tried to manual install it using this link https://tools.google.com/dlpage/widevine but it fails to install, it says "it appears to be corrupt".
(In reply to Gilbert Consellado from comment #33) > Same issue here with IDM, so i tried to manual install it using this link > https://tools.google.com/dlpage/widevine but it fails to install, it says > "it appears to be corrupt". That's the "Widevine Media Optimizer", which is a different plugin that's not going to help you watch Netflix. Try updating IDM.
(In reply to Chris Pearce (:cpearce) from comment #34) > (In reply to Gilbert Consellado from comment #33) > > Same issue here with IDM, so i tried to manual install it using this link > > https://tools.google.com/dlpage/widevine but it fails to install, it says > > "it appears to be corrupt". > > That's the "Widevine Media Optimizer", which is a different plugin that's > not going to help you watch Netflix. > > Try updating IDM. Thanks for the clarification. BTW I just check my installed plugins, does the Widevine Content Decryption Module comes with the Google Update plugin? Because I can't remember that I installed Google Update and I don't have google chrome installed.
(In reply to Gilbert Consellado from comment #35) > (In reply to Chris Pearce (:cpearce) from comment #34) > > (In reply to Gilbert Consellado from comment #33) > > > Same issue here with IDM, so i tried to manual install it using this link > > > https://tools.google.com/dlpage/widevine but it fails to install, it says > > > "it appears to be corrupt". > > > > That's the "Widevine Media Optimizer", which is a different plugin that's > > not going to help you watch Netflix. > > > > Try updating IDM. > > Thanks for the clarification. > BTW I just check my installed plugins, does the Widevine Content Decryption > Module comes with the Google Update plugin? > > Because I can't remember that I installed Google Update and I don't have > google chrome installed. The Widevine Content Decryption Module is installed automatically by Firefox. The Google Update plugin comes with something else, like maybe the legacy Google Talk app.
Depends on: 1307997
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: