netflix e100 error

[ntoskrnl7]

I am using electron-v35.1.2+wvcus-win32-x64\electron.exe to access Netflix at https://netflix.com/. After logging in and attempting to play a video, the E100 error occurs.

[khwaaj]

This will simply not work the way you are doing it, please read the project README for additional information.

In short, properly installing/loading the Widevine CDM requires you to use the components API. In addition, for commercial services (that are not using a Widevine UAT backend), you will need a production VMP signature - which is not provided with the release builds. For official ECS (Electron for Content Security) builds you can freely register and use for our VMP signing service to generate VMP signatures suitable for production.

Issue #200 is a duplicate of this issue.

[coreybruce]

Having the same issue, all my other desktop apps I maintain that require Widevine DRM all work except for Netflix now for some unknown reason

[khwaaj]

Just re-tested this on macOS/Windows, and Netflix works fine assuming you are using a supported version, correctly installing/registering the CDM using the components API, and VMP signing the result. This is the gist of what I did:

% npm init
% npm install "https://github.com/castlabs/electron-releases#v35.1.5+wvcus" --save-dev

Copied the following into index.js, and edited the package.json to have a simple start script (just running electron .):

const {app, components, BrowserWindow} = require('electron');

function createWindow () {
  const mainWindow = new BrowserWindow();
  mainWindow.loadURL('https://netflix.com/');
}

app.whenReady().then(async () => {
  await components.whenReady();
  console.log('components ready:', components.status());
  createWindow();
});

Then I generated a VMP signature and started the app:

% python3 -m castlabs_evs.vmp sign-pkg node_modules/electron/dist
Signing: node_modules/electron/dist/Electron.app
 - Verifying existing VMP signature
 - Signature invalid: Certificate is valid for development only
 - Requesting VMP signature
% npm start

> ecs-example@1.0.0 start
> electron .

components ready: {
  oimompecagnajdejgnnjijobebaeigek: {
    status: 'new',
    title: 'Widevine Content Decryption Module',
    version: '4.10.2891.0'
  }
}

At this point Netflix works and I can play back content. If I don't do the VMP signing step I end up with the e100 error, so I'm guessing that something is wrong with how/when you generate the signature (see the documentation as there are differences between platforms when VMP is used together with code-signing).

If you are uncertain about the VMP signing status you can verify the signature after packaging/installing your app with the verify-pkg command, e.g. something like (but of course with a path to the installed application instead of the one in node_modules):

% python3 -m castlabs_evs.vmp verify-pkg node_modules/electron/dist
Verifying signature for: node_modules/electron/dist/Electron.app
 - Signature is valid [streaming, 1915 days of validity]

[coreybruce]

The frustrating and annoying part of this is none of my other apps that need Widevine Like Disney+, Bing and FoxtelGo for example don't need signing and still work except for Netflix and the second issue is while the signing Works on Mac for example it doesn't on Linux and doesn't even detect a binary even tho it exists and I'm doing it from within the folder

 python3 -m castlabs_evs.vmp sign-pkg ./node_modules/electron/dist
FileNotFoundError: No matching executable found in: ./node_modules/electron/dist

[khwaaj]

They may not be enforcing a VMP check then. VMP is recommended, but not mandatory (except for use with persistent licenses) , so services can choose to enable it or not (or configure it more granularly, depending on content quality, VMP status, and so on). For example Linux is often (but not always) excepted since it doesn't support VMP at all (only macOS and Windows does), so that is why you can't sign/verify a Linux build.

[coreybruce]

Ah I see well if I can sign Linux binaries then the python script needs to be fixed.

[khwaaj]

I'm not sure what you are expecting here. The script can't sign Linux binaries, but you can sign macOS/Windows binaries on Linux. If you'd try to sign an ELF binary directly using the sign command you would get a different error, i.e. UnsupportedError: Binary type or architecture not supported.

sign-pkg is a convenience command that tries to determine what to sign automatically, and when it can't guess the binaries to sign it will give the general error above (which will be the case when trying to sign a Linux package).

[coreybruce]

Well I was hoping and expecting to be able to use Netflix with Electron Castlab in Linux like I used to be able to, the code and command you gave me doesn't allow Widevine to work on Linux and that's an issue.

[khwaaj]

That is because Widevine does not support VMP on Linux, at all. This has always been the case, and there are no indications that this will change anytime soon (if ever).

Because of this the service DRM proxy needs to explicitly allow non-VMP verified implementations on Linux, and for example Netflix has been known to change if they do from time to time. We have no way to know or remedy this on the client side, the only recourse is to reach out to Netflix (or whatever service is problematic) and ask if they would consider supporting Linux without VMP.

There could of course be something else that is restricting playback too. For example some services have been known to use other client-side data to restrict playback - for example looking at the User-Agent. If playback works in Chrome on Linux, and not your app, something akin to that could be going on.

[coreybruce]

That is because Widevine does not support VMP on Linux, at all. This has always been the case, and there are no indications that this will change anytime soon (if ever).

Because of this the service DRM proxy needs to explicitly allow non-VMP verified implementations on Linux, and for example Netflix has been known to change if they do from time to time. We have no way to know or remedy this on the client side, the only recourse is to reach out to Netflix (or whatever service is problematic) and ask if they would consider supporting Linux without VMP.

There could of course be something else that is restricting playback too. For example some services have been known to use other client-side data to restrict playback - for example looking at the User-Agent. If playback works in Chrome on Linux, and not your app, something akin to that could be going on.

Ahh I see that's a pain, must be a bug in Electron Castlab because it works on Google Chrome and I used the example code you gave and it gives me that same error sadly

[khwaaj]

That is verifiably not the case since you yourself say ECS works with other services requiring Widevine. My initial testing in this thread was not done on Linux though, since you initially didn't mention that was your target platform, so I just re-tested on Ubuntu using my example above and I can play back Netflix content just fine.

I'm not sure what is wrong in your specific case, but something is different from what I see here.

[coreybruce]

That is verifiably not the case since you yourself say ECS works with other services requiring Widevine. My initial testing in this thread was not done on Linux though, since you initially didn't mention that was your target platform, so I just re-tested on Ubuntu using my example above and I can play back Netflix content just fine.

I'm not sure what is wrong in your specific case, but something is different from what I see here.

I was referring to specifically Netflix, it does not work on Electron Castlab on Linux but Netflix does work on Google Chrome on Linux, all the other services do work with Electron Castlab but the issue is with Netflix not working on Electron Castlab.

[khwaaj]

If you re-read my comment above you'll see that it explicitly addresses Netflix as well, and that my tests on playing back content from Netflix on Ubuntu (x64) using ECS (and the example above) were successful.

Something else is going on here, and it is not directly related to ECS. Are you per chance running in a VM, using non-local mounts (host or network) , or something along those lines? This is known to cause issues with the Chromium sandbox and Widevine. If so, you could try launching with the --no-sandbox command-line argument to see if that makes a difference.