From c8d909c693cb8639941bc53c1aeba15f03c6e800 Mon Sep 17 00:00:00 2001
From: elwrcl <elwerici@proton.me>
Date: Fri, 28 Aug 2026 20:55:43 +0300
Subject: [PATCH] drm

---
 README.md                | 29 +++++++++++++++++++++++++----
 modules/home-manager.nix | 26 +++++++++++++++++++++++++-
 modules/package.nix      |  6 +++++-
 3 files changed, 55 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index db623b6..3090861 100644
--- a/README.md
+++ b/README.md
@@ -25,20 +25,41 @@ nix run github:elwrcl/heliux
 
 ## DRM / Widevine
 
-Helium is compiled with ***Widevine*** support, but upstream ships no CDM library and
-the wrapper passes `--disable-component-update`, so the component updater can
+Helium is compiled with ***Widevine*** support but upstream ships no CDM library,
+and the wrapper passes `--disable-component-update`, so the component updater can
 never fetch one at runtime. The result is that DRM playback silently fails.
 
-The `helium-widevine` package bundles the CDM next to the binary, which fixes
-playback without re-enabling the update machinery:
+Supplying the CDM takes two steps, and the second one is easy to miss. Helium is
+built with `enable_widevine` but *without* `bundle_widevine_cdm`, so it never
+looks beside its own binary for a CDM — dropping the library into the package is
+not enough by itself. The only location it consults at startup is the hint file
+the component updater would normally leave in the user data dir:
+
+```
+~/.config/net.imput.helium/WidevineCdm/latest-component-updated-widevine-cdm
+```
+
+So `helium-widevine` pins the CDM in the store, and the home-manager module
+writes that hint file pointing at it. The update machinery stays off — the hint
+file is read directly at startup and does not depend on the updater:
 
 ```nix
 programs.helium.package = helium.packages.${system}.helium-widevine;
 ```
 
+Switching the package back to plain `helium` removes the hint file again, but
+only when it points into the Nix store; a hint left by a real component update
+is not touched.
+
 The CDM is proprietary, so this output requires `allowUnfree`. Plain `helium` is
 unchanged and stays free-software only.
 
+> [!NOTE]
+> The hint file is written by the home-manager module, so `helium-widevine` on
+> its own — installed with `nix profile` or `environment.systemPackages` — still
+> will not play DRM. Check with `helium://components`, or from the console:
+> `navigator.requestMediaKeySystemAccess('com.widevine.alpha', [{initDataTypes:['cenc'],videoCapabilities:[{contentType:'video/mp4; codecs="avc1.42E01E"'}]}])`
+
 ## NixOS + home-manager
 
 > [!IMPORTANT]
diff --git a/modules/home-manager.nix b/modules/home-manager.nix
index b5ae570..eff729e 100644
--- a/modules/home-manager.nix
+++ b/modules/home-manager.nix
@@ -100,6 +100,14 @@ let
     ExtensionInstallForcelist = map (ext: "${ext.id};${webStoreUpdateUrl}") cfg.extensions;
   }
   // cfg.extraPolicies;
+  userDataDir = "${config.xdg.configHome}/net.imput.helium";
+  widevineCdm =
+    let
+      subdir = cfg.package.widevineCdmSubdir or null;
+    in
+    if subdir == null then null else "${cfg.package}/${subdir}";
+
+  widevineHintFile = "${userDataDir}/WidevineCdm/latest-component-updated-widevine-cdm";
 
   extensionRoot = "${config.xdg.dataHome}/helium/extensions";
   loadExtensionFlag =
@@ -317,9 +325,25 @@ in
             ''
         );
 
+        heliumWidevine = lib.hm.dag.entryAfter [ "writeBoundary" ] (
+          if widevineCdm != null then
+            ''
+              run ${lib.getExe' pkgs.coreutils "install"} -Dm644 \
+                ${pkgs.writeText "helium-widevine-cdm-hint" (builtins.toJSON { Path = widevineCdm; })} \
+                ${lib.escapeShellArg widevineHintFile}
+            ''
+          else
+            ''
+              if [ -f ${lib.escapeShellArg widevineHintFile} ] \
+                 && grep -q '"/nix/store/' ${lib.escapeShellArg widevineHintFile}; then
+                run rm -f ${lib.escapeShellArg widevineHintFile}
+              fi
+            ''
+        );
+
         heliumPreferences = lib.mkIf (cfg.preferences != { }) (
           lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-            prefs_file="$HOME/.config/net.imput.helium/Default/Preferences"
+            prefs_file=${lib.escapeShellArg "${userDataDir}/Default/Preferences"}
             nix_prefs=${lib.escapeShellArg (builtins.toJSON cfg.preferences)}
             merged_prefs="$(mktemp)"
 
diff --git a/modules/package.nix b/modules/package.nix
index 9a86925..136a04e 100644
--- a/modules/package.nix
+++ b/modules/package.nix
@@ -220,7 +220,11 @@ stdenv.mkDerivation {
     })
   ];
 
-  passthru = { inherit enabledFeatures; };
+  passthru = {
+    inherit enabledFeatures;
+    widevineCdmSubdir = if enableWidevine then "opt/helium/WidevineCdm" else null;
+  };
+
   meta = {
     description = "Private, fast, and honest web browser based on ungoogled-chromium";
     homepage = "https://helium.computer/";