netflix e100 error

[ntoskrnl7]

I am using electron-v35.1.2+wvcus-win32-x64\electron.exe to access Netflix at https://netflix.com/. After logging in and attempting to play a video, the E100 error occurs.

[khwaaj]

This will simply not work the way you are doing it, please read the project README for additional information.

In short, properly installing/loading the Widevine CDM requires you to use the components API. In addition, for commercial services (that are not using a Widevine UAT backend), you will need a production VMP signature - which is not provided with the release builds. For official ECS (Electron for Content Security) builds you can freely register and use for our VMP signing service to generate VMP signatures suitable for production.

Issue #200 is a duplicate of this issue.

[coreybruce]

Having the same issue, all my other desktop apps I maintain that require Widevine DRM all work except for Netflix now for some unknown reason

[khwaaj]

Just re-tested this on macOS/Windows, and Netflix works fine assuming you are using a supported version, correctly installing/registering the CDM using the components API, and VMP signing the result. This is the gist of what I did:

% npm init
% npm install "https://github.com/castlabs/electron-releases#v35.1.5+wvcus" --save-dev

Copied the following into index.js, and edited the package.json to have a simple start script (just running electron .):

const {app, components, BrowserWindow} = require('electron');

function createWindow () {
  const mainWindow = new BrowserWindow();
  mainWindow.loadURL('https://netflix.com/');
}

app.whenReady().then(async () => {
  await components.whenReady();
  console.log('components ready:', components.status());
  createWindow();
});

Then I generated a VMP signature and started the app:

% python3 -m castlabs_evs.vmp sign-pkg node_modules/electron/dist
Signing: node_modules/electron/dist/Electron.app
 - Verifying existing VMP signature
 - Signature invalid: Certificate is valid for development only
 - Requesting VMP signature
% npm start

> [email protected] start
> electron .

components ready: {
  oimompecagnajdejgnnjijobebaeigek: {
    status: 'new',
    title: 'Widevine Content Decryption Module',
    version: '4.10.2891.0'
  }
}

At this point Netflix works and I can play back content. If I don't do the VMP signing step I end up with the e100 error, so I'm guessing that something is wrong with how/when you generate the signature (see the documentation as there are differences between platforms when VMP is used together with code-signing).

If you are uncertain about the VMP signing status you can verify the signature after packaging/installing your app with the verify-pkg command, e.g. something like (but of course with a path to the installed application instead of the one in node_modules):

% python3 -m castlabs_evs.vmp verify-pkg node_modules/electron/dist
Verifying signature for: node_modules/electron/dist/Electron.app
 - Signature is valid [streaming, 1915 days of validity]

[coreybruce]

The frustrating and annoying part of this is none of my other apps that need Widevine Like Disney+, Bing and FoxtelGo for example don't need signing and still work except for Netflix and the second issue is while the signing Works on Mac for example it doesn't on Linux and doesn't even detect a binary even tho it exists and I'm doing it from within the folder

 python3 -m castlabs_evs.vmp sign-pkg ./node_modules/electron/dist
FileNotFoundError: No matching executable found in: ./node_modules/electron/dist

[khwaaj]

They may not be enforcing a VMP check then. VMP is recommended, but not mandatory (except for use with persistent licenses) , so services can choose to enable it or not (or configure it more granularly, depending on content quality, VMP status, and so on). For example Linux is often (but not always) excepted since it doesn't support VMP at all (only macOS and Windows does), so that is why you can't sign/verify a Linux build.

[coreybruce]

Ah I see well if I can sign Linux binaries then the python script needs to be fixed.

[khwaaj]

I'm not sure what you are expecting here. The script can't sign Linux binaries, but you can sign macOS/Windows binaries on Linux. If you'd try to sign an ELF binary directly using the sign command you would get a different error, i.e. UnsupportedError: Binary type or architecture not supported.

sign-pkg is a convenience command that tries to determine what to sign automatically, and when it can't guess the binaries to sign it will give the general error above (which will be the case when trying to sign a Linux package).

[coreybruce]

Well I was hoping and expecting to be able to use Netflix with Electron Castlab in Linux like I used to be able to, the code and command you gave me doesn't allow Widevine to work on Linux and that's an issue.

[khwaaj]

That is because Widevine does not support VMP on Linux, at all. This has always been the case, and there are no indications that this will change anytime soon (if ever).

Because of this the service DRM proxy needs to explicitly allow non-VMP verified implementations on Linux, and for example Netflix has been known to change if they do from time to time. We have no way to know or remedy this on the client side, the only recourse is to reach out to Netflix (or whatever service is problematic) and ask if they would consider supporting Linux without VMP.

There could of course be something else that is restricting playback too. For example some services have been known to use other client-side data to restrict playback - for example looking at the User-Agent. If playback works in Chrome on Linux, and not your app, something akin to that could be going on.

[coreybruce]

That is because Widevine does not support VMP on Linux, at all. This has always been the case, and there are no indications that this will change anytime soon (if ever).

Because of this the service DRM proxy needs to explicitly allow non-VMP verified implementations on Linux, and for example Netflix has been known to change if they do from time to time. We have no way to know or remedy this on the client side, the only recourse is to reach out to Netflix (or whatever service is problematic) and ask if they would consider supporting Linux without VMP.

There could of course be something else that is restricting playback too. For example some services have been known to use other client-side data to restrict playback - for example looking at the User-Agent. If playback works in Chrome on Linux, and not your app, something akin to that could be going on.

Ahh I see that's a pain, must be a bug in Electron Castlab because it works on Google Chrome and I used the example code you gave and it gives me that same error sadly

[khwaaj]

That is verifiably not the case since you yourself say ECS works with other services requiring Widevine. My initial testing in this thread was not done on Linux though, since you initially didn't mention that was your target platform, so I just re-tested on Ubuntu using my example above and I can play back Netflix content just fine.

I'm not sure what is wrong in your specific case, but something is different from what I see here.

[coreybruce]

That is verifiably not the case since you yourself say ECS works with other services requiring Widevine. My initial testing in this thread was not done on Linux though, since you initially didn't mention that was your target platform, so I just re-tested on Ubuntu using my example above and I can play back Netflix content just fine.

I'm not sure what is wrong in your specific case, but something is different from what I see here.

I was referring to specifically Netflix, it does not work on Electron Castlab on Linux but Netflix does work on Google Chrome on Linux, all the other services do work with Electron Castlab but the issue is with Netflix not working on Electron Castlab.

[khwaaj]

If you re-read my comment above you'll see that it explicitly addresses Netflix as well, and that my tests on playing back content from Netflix on Ubuntu (x64) using ECS (and the example above) were successful.

Something else is going on here, and it is not directly related to ECS. Are you per chance running in a VM, using non-local mounts (host or network) , or something along those lines? This is known to cause issues with the Chromium sandbox and Widevine. If so, you could try launching with the --no-sandbox command-line argument to see if that makes a difference.

[coreybruce]

I figured out the issue and there was a couple things causing the issue

First issue was with using electron-castlab from npm so I used the compiled binary from the releases and modified the electron launch script that is used for electron which resolves the issue. https://gitlab.com/linuxbombay/electron-castlab-aur/-/blob/main/electroncastlab

Original script I forked https://gitlab.archlinux.org/archlinux/packaging/packages/electron35/-/blob/main/electron-launcher.sh

I also updated my code and found out that using a user agent also causes the DRM video to fail to load. https://gitlab.com/linuxbombay/netflix-desktop/application/-/commit/a50068841b930b2c1fe0efff628b243f2b1e6b7b

This might need to be double checked and looked over to confirm as it could be not completely the case and only due to the user agent change that cause the issue.

[jtvberg]

It was setting the userAgent for me as well. Took that code out and g2g. Thanks for the tip @coreybruce

[Kilian]

@khwaaj do you have additional information on this when it comes to user agent requirements etc? Because the support matrix I experience is wild.

	Ubuntu	Macos	Windows
Spotify	Works	~~Doesn't work [1]~~	Works
Netflix	Works	~~Doesn't work [2]~~	~~Doesn't work~~mostly works [3]
protected demo on demo.castlabs.com	Works	~~Doesn't work [4]~~	Works
Bitmovin drm [0]	Works	Works	Works

I develop primarily on Ubuntu so when it works there and signing on the other platforms works and validated with castlabs_evs.vmp (and components is loaded), that isn't quite the behavior I expected. Mac and windows are tested both on the plain Electron from this repo, as well as a signed build.

[0] https://bitmovin.com/demos/drm [1] It will cycle through a number of songs caused by a 403 error on their widevine API call, then play sound for a couple of seconds for a song and then stop playing audio. Similar to https://github.com/castlabs/electron-releases/issues/193 except it also happens in fully signed applications. [2] Here I get the e100 error code. [3] Here I get just a spinner. [4] On Windows, it does a mediaKeySystem permission request, after which it works. It never requests this permission on Mac and the page gives me Clpp-Error Category 6 code 6007 caused by Category 1, code 1001.

---

Update

When I run verify-pkg I get a 'failure to read signature' error on mac because Electron Framework.sig can't be found. This is because I followed @khwaaj's comment here: https://github.com/castlabs/electron-releases/issues/105#issuecomment-905087389 on deleting it for mac universal builds after signing. After testing, it seems you should only do that for the temp builds created for the universal build. Now on Mac the demo on castlab.com works, as does Spotify. Netflix still has issues but I'm unsure if they're directly widevine related, or something else so still investigating that.

Can I suggest updating the wiki here to only remove this file for the two temp arches you build for the universal build?

---

Update 2

Netflix on mac now also works ( I probably triggered some abuse protection yesterday) but netflix on windows is still broken, only showing that spinner. I'll see what logging I can do.

[jtvberg]

@Kilian strictly on the UA topic: You may also want to add auth.google.com to your matrix as it can be very touchy. For Spotify (and Peacock BTW) you need to pass a legit UA on url load e.g.:

.webContents.loadURL(url, { userAgent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36' })

I have seen people try to just do this:

.webContents.userAgent = '*agent string*'

Which does not work. At least, not anymore.

It is odd that Netlfix is giving you a hassle. It works for me on MacOS without one but the UA thing is a little bit of an arms race. The two companies I listed won't load if they see Electron in the UA. The both seem to be using a parser and neither fails gracefully. Peacock, for instance, will say you un/pw is incorrect. I pass a legit one for everything except Google Auth as passing one at all get's me the "your browser isn't safe" message. If I pass nothing, it works. That said, Netflix and Spotify work for me on Linux/Windows/MacOS.

Be sure to load a UA inspection site in your app to see what it is parsing to make sure you look the way you need to.

[Kilian]

My UA should be fine. It's consistent, formed similarly to other browsers, doesn't contain "electron" and already works for stringent checkers like google auth, cloudflare captcha etc.

I think on Mac it's caused that Electron Framework.sig file where the wiki entry is lacking information, though I'm not sure what the expectation for the development build is then.

[khwaaj]

Abut the UA debacle I don't really have much to add in general. This has been a moving target for as long as I can remember with various restrictions coming and going for different services. I'm not sure it is even possible to compile a complete list that would be valid for very long... 🤷‍♂️

IIUC only the issue with Netflix on Windows still exists though? I don't have any immediate ideas about that, but are there any relevant logs that can provide hints as to what is going on?

Can I suggest updating the wiki here to only remove this file for the two temp arches you build for the universal build?

Fair suggestion, I added some additional text to the FAQ to make it explicit that the newly generated VMP signature should not also be removed.

[Kilian]

Netflix on windows is still giving me issues by showing an infinite spinner, but only intermittently. This is fine for now, i'll keep monitoring it.

[coreybruce]

If you guys want a Netflix app for Windows Mac and Linux check mine out

https://gitlab.com/linuxbombay/netflix-desktop/application

It's also on the AUR

[superhuai]

I still have the question that 'e100' on windows

what can i do to solve this question?

The following are my current steps

1.npm i

2.electron-builder --arm64 --mac

3.python3 -m castlabs_evs.vmp sign-pkg generate/dist/xxx.exe

[khwaaj]

@superhuai, one immediate thing that stands out is your (3) bullet. You should not pass the executable directly when using sign-pkg, but rather the path to the package. So in this case you would simply do:

$ python3 -m castlabs_evs.vmp sign-pkg generate/dist

There are other things that can break the VMP signature after it has been generated as well, especially on Windows. For example if you do code-signing (or other operations that may change something in the executable itself, e.g. changing the icon) you will break the VMP signature. For this reason you always need to generate the VMP signature after you have done these operations on Windows.