Brave-browser: libwidevinecdm.dylib signing issue on macOS Catalina

[rebron]

Description

Brave users on macOS Catalina (does not effect Mojave 10.14 and below) will initially download Widevine Content Decryption Module - Version: 4.10.1440.18.

On browser close and next restart, users will be updated to an unsigned version and will get updated to 4.10.1582.1.

Users will then get the prompt below:

Websites requiring libwidevinecdm.dylib will no longer work unless using the workaround below.

Steps to Reproduce

1. Download release version of Brave (tested on 70.123), fresh install and profile.
2. Go to Netflix. Login w/ credentials (or could be before) but important step is get Widevine prompt and install.
3. Ensure ability to watch Netflix video.
4. Go to brave://components and notice Widevine version 4.10.1440.18
5. Close browser.
6. Restart.
7. Go to brave://components and notice you've been updated to 4.10.1582.1
8. Go to Netflix and login. Notice screenshot above and a Netflix error message.

Workaround:

Users will need to allow libwidevinecdm.dylib from Systems Preferences -> Security and Privacy -> General:

and then select open when prompted.

Close and restart the browser.

Expected result:

Same behavior with Widevine on websites using macOS Mojave with no additional macOS security prompts.

Reproduces how often:

Easily.

Brave version (brave://version info)

Brave 70.123 macOS Catalina 10.15.1

Version/Channel Information:

• Can you reproduce this issue with the current release? yes
• Can you reproduce this issue with the beta channel? yes
• Can you reproduce this issue with the dev channel? yes
• Can you reproduce this issue with the nightly channel? yes

[kjozwiak]

Verification PASSED on macOS 10.15.1 x64 using the following build:

Brave | 0.70.123 Chromium: 78.0.3904.97 (Official Build) (64-bit)
-- | --
Revision | 021b9028c246d820be17a10e5b393ee90f41375e-refs/branch-heads/3904@{#859}
OS | macOS Version 10.15.1 (Build 19B88)

• launch 0.70.123 enabled Widevine and checked brave://components/
  
  
  
  • Widevine Content Decryption Module - Version: 4.10.1440.18
  
  
• restarted 0.70.123 CR: 78.0.3904.97 and checked brave://components/
  
  
  
  • Widevine Content Decryption Module - Version: 4.10.1582.2
  
  

Once I pulled 4.10.1582.2, ensured that the netflix.com, Prime and YT worked as expected.

Kamils-MBP:~ kjozwiak$ codesign -vvv ~/Library/ApplicationSupport/BraveSoftware/Brave-Browser/WidevineCdm/4.10.1582.2/_platform_specific/mac_x64/libwidevinecdm.dylib
/Users/kjozwiak/Library/ApplicationSupport/BraveSoftware/Brave-Browser/WidevineCdm/4.10.1582.2/_platform_specific/mac_x64/libwidevinecdm.dylib: valid on disk
/Users/kjozwiak/Library/ApplicationSupport/BraveSoftware/Brave-Browser/WidevineCdm/4.10.1582.2/_platform_specific/mac_x64/libwidevinecdm.dylib: satisfies its Designated Requirement

[rebron]

Confirmed. Widevine Content Decryption Module - Version: 4.10.1582.2. Same set up as @kjozwiak only checked on netflix.com. Works great.