Joren/qbz
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,481 Commits 1 Branch 0 Tags
a5efd6ae194602b5a1eba84c1ee4e556aa93c9df
Commit Graph
3 Commits
Author SHA1 Message Date
vicrodh 4505312280 fix(security): remove hardcoded crypto seed from cmaf crate 
Move the CMAF app seed from a hardcoded constant in qbz-cmaf to a
parameter passed by callers. The seed now lives in qbz-qobuz::auth
where other app-level constants are defined. This resolves CodeQL
alerts for hard-coded cryptographic values.

Also truncate session_id in logs to avoid cleartext logging of
sensitive session identifiers.

cc
 2026-04-07 07:04:33 -06:00
vicrodh b3a9069712 feat(cmaf): add CMAF segment parser 
Parse init segment (FLAC header + segment table) and audio segments
(frame entries with IVs for AES-CTR decryption).

cc
 2026-04-06 13:12:55 -06:00
vicrodh 794dd9f24c feat(cmaf): add qbz-cmaf crate with crypto module 
HKDF-SHA256 session key derivation, AES-128-CBC content key unwrap,
AES-128-CTR frame decryption, and MD5 request signing for Qobuz
CMAF segmented streaming.

cc
 2026-04-06 13:10:00 -06:00