mirror of
https://github.com/CloakHQ/CloakBrowser.git
synced 2026-06-23 11:41:46 +02:00
CloakHQ
61365cea48
Add bin/fetch-widevine.py — a stdlib-only fetcher that pulls the Widevine CDM from Google's component server (arch-aware, sha256-verified, atomic, cached). The Docker entrypoint runs it when CLOAKBROWSER_FETCH_WIDEVINE is set (off by default), exporting CLOAKBROWSER_WIDEVINE_CDM so persistent profiles get a working CDM without a local Chrome to copy from. Fail-soft; skips when a CDM is already set or CLOAKBROWSER_WIDEVINE=0. Bare-metal Linux users can run the script directly. README: document the flag, drop the outdated storage-quota note.
39 lines
2.0 KiB
Bash
39 lines
2.0 KiB
Bash
#!/bin/bash
|
|
# Clean up any stale Xvfb lock left behind by a previous container instance.
|
|
# `/tmp` is not a tmpfs in this image, so on `docker restart` the previous
|
|
# container's `/tmp/.X99-lock` survives, and Xvfb refuses to start with an
|
|
# existing lock — leaving the container with no X server, every Chrome
|
|
# launch dying with "Missing X server or $DISPLAY", and `cloakserve`
|
|
# returning 502 forever. See CloakHQ/CloakBrowser#283.
|
|
rm -f /tmp/.X99-lock /tmp/.X11-unix/X99
|
|
|
|
# Start Xvfb for headed mode (Turnstile, CAPTCHAs), then run user command
|
|
Xvfb :99 -screen 0 1920x1080x24 -nolisten tcp &
|
|
sleep 1
|
|
|
|
# Opt-in: fetch the Widevine CDM so persistent contexts present as a real
|
|
# Chrome (a DRM/EME probe is used by some bot detectors). Off by default — only
|
|
# runs when CLOAKBROWSER_FETCH_WIDEVINE is set, and never if the user already
|
|
# pointed at a CDM or disabled seeding. The CDM is fetched per-container from
|
|
# Google's component server (the same source Chrome uses), cached in the
|
|
# ~/.cloakbrowser volume, and is best-effort: a failure must never block launch.
|
|
_fetch_widevine="${CLOAKBROWSER_FETCH_WIDEVINE:-}"
|
|
case "${_fetch_widevine,,}" in
|
|
1|true|yes|on)
|
|
# printf (not echo) so a value like `-n` isn't swallowed as a flag.
|
|
if [ -z "${CLOAKBROWSER_WIDEVINE_CDM:-}" ] && \
|
|
! printf '%s' "${CLOAKBROWSER_WIDEVINE:-}" | grep -qiE '^(0|false|off|no)$'; then
|
|
# Fetch to the default location (the version-independent cache root,
|
|
# ~/.cloakbrowser/WidevineCdm). The wrapper's auto-detection
|
|
# (cloakbrowser/widevine.py, js/src/widevine.ts) falls back to this path
|
|
# after the per-binary dir, so the CDM is discoverable by ANY process (CMD
|
|
# or `docker exec`) and ANY binary (free or Pro, any version) with no env
|
|
# var. Best-effort: a failure must never block launch.
|
|
python /usr/local/bin/fetch-widevine.py --quiet \
|
|
|| echo "[cloakbrowser] Widevine fetch failed; continuing without it" >&2
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
exec "$@"
|