Shaka Packager Integration Guide

This guide explains how to encrypt media content using DoveRunner’s key management service (KMS) with Shaka Packager, Google’s open-source media packaging tool. The integration supports multiple DRM systems including Widevine, PlayReady, and FairPlay.

Shaka Packager vs. DRM CLI Packager

Based on Shaka Packager, DoveRunner provides two packaging options. Choose based on your needs:

Feature	Shaka Packager Integration	DRM CLI Packager
Best for	Developers with existing Shaka workflows	Quick setup without additional configuration
Flexibility	Full access to all Shaka Packager features	Pre-configured for common use cases
Setup	Requires Python environment and manual configuration	Standalone executable, minimal setup
Customization	Maximum control over packaging parameters	Simplified options for standard scenarios
Updates	Use latest Shaka Packager versions independently	Managed releases tested for DoveRunner compatibility

Which should I use?

Use Shaka Packager Integration in this document if you need advanced Shaka features or have existing encoding pipelines. Use DRM CLI Packager if you want a turnkey solution that works immediately with DoveRunner Multi-DRM.

Prerequisites

Before you begin, ensure you have the following:

Requirement	Details
Python	Version 3.6 or later
DoveRunner account	Active subscription with KMS access
Encryption token	Generated from the DoveRunner Console

You will also need to download these components:

• DoveRunner CPIX API client — Python module for KMS communication
• Shaka Packager integration sample — Integration script and examples
• Shaka Packager v3.2.0 — Media packaging binary

Compatibility

This guide is tested with Shaka Packager v3.2.0. Later versions may work but are not guaranteed to be compatible. For compatibility questions, create a support ticket.

Installation

1. Clone the integration sample repository:

   git clone https://github.com/doverunner/shaka-packager-integration-sample
   cd shaka-packager-integration-sample

2. Clone the CPIX API client into the same directory:

   git clone https://github.com/doverunner/cpix-api-client.git

3. Download and place the Shaka Packager binary in the project directory.

   Platform-specific binaries

   Download the appropriate binary for your operating system:

   • Windows: packager-win-x64.exe
   • macOS: packager-osx-x64
   • Linux: packager-linux-x64

   Update the binary name in the script if necessary.

Your directory structure should look like this:

shaka-packager-integration-sample/
├── cpix-api-client/
├── doverunner-integration-script.py
└── packager-win-x64.exe (or platform equivalent)

Usage

Run the integration script with the following syntax:

python3 doverunner-integration-script.py \
  --enc_token <token> \
  --content_id <id> \
  --drm_type <types> \
  [options] \
  [shaka_packager_args]

Required arguments

Argument	Description
--enc_token	Your DoveRunner KMS encryption token for CPIX API authentication
--content_id	Unique identifier for your content. This ID must match the content ID used in DRM license request tokens
--drm_type	Comma-separated list of DRM systems: widevine, playready, fairplay

Optional arguments

Argument	Description	Default
--encryption_scheme	Encryption mode: cenc, cbc1, cens, or cbcs	cenc
--track_type	Comma-separated track types: all_tracks, audio, sd, hd, uhd1, uhd2	all_tracks

Shaka Packager passthrough

All arguments not listed above are passed directly to Shaka Packager. Refer to the Shaka Packager documentation for available options.

Example

The following example encrypts an H.264 video file with Widevine and PlayReady DRM, outputting a DASH manifest:

python3 doverunner-integration-script.py \
  --enc_token your-enc-token \
  --content_id movie123 \
  --drm_type widevine,playready \
  'in=h264_720p.mp4,stream=video,init_segment=output/video/init.mp4,segment_template=output/video/$Number$.m4s' \
  'in=h264_720p.mp4,stream=audio,init_segment=output/audio/init.mp4,segment_template=output/audio/$Number$.m4s' \
  --generate_static_live_mpd \
  --mpd_output output/stream.mpd \
  --clear_lead 0

This command:

• Retrieves Widevine and PlayReady keys from DoveRunner KMS
• Encrypts video and audio streams separately
• Generates segmented output in the output/ directory
• Creates a DASH manifest at output/stream.mpd
• Sets clear_lead to 0, ensuring all content is encrypted from the start

How it works

When you run the integration script:

1. The script authenticates with DoveRunner KMS using your encryption token
2. It requests content keys for the specified DRM systems via the CPIX API
3. The script constructs a Shaka Packager command with the encryption keys and your parameters
4. Shaka Packager executes the packaging operation, encrypting your content with the specified DRM protection
5. The encrypted output files are written to your specified locations

Troubleshooting

Issue	Solution
Authentication errors	Verify your --enc_token is valid and has not expired
Content ID mismatch	Ensure the --content_id matches the ID configured in your license tokens
Binary not found	Confirm the Shaka Packager executable is in the script directory and has execute permissions
Unsupported DRM type	Check that you spelled the DRM type correctly: widevine, playready, or fairplay

Related resources

• CPIX API Reference — DoveRunner key management API documentation
• DoveRunner CPIX API Client — Python client library source code
• Shaka Packager Documentation — Official Shaka Packager documentation