Package one CMAF asset for Widevine, PlayReady, and FairPlay (no second encode)

TL;DR

We package one CMAF asset encrypted with cbcs, emit an HLS and a DASH manifest from the same segments, and play it back with Shaka Player so Widevine, PlayReady, and FairPlay all decrypt the same bytes. No more separate cenc and cbcs encodes for the common case.

If you last set up DRM a few years ago, you probably remember packaging everything twice: a cenc copy for Widevine/PlayReady and a cbcs copy for FairPlay, because the cipher modes were incompatible. For current devices that is no longer necessary. Modern Widevine and PlayReady both decrypt cbcs, and CMAF lets HLS and DASH share one set of segments. Let's build the single-encode version.

We'll do it in four steps:

Understand the cipher-mode constraint (30 seconds of theory).