774cd3f1bc
Because we used require() to read build-matrix.json, the file could be replaced with build-matrix.json.js, allowing code injection into our CI pipelines. This fixes this vulnerability by reading the JSON text with the fs module, then explicitly parsing it, rather than relying on require(). This also changes the location of the file, to match its location in other projects. Note that this workflow is not currently giving any elevated permissions to users, so it is not currently possible to damage the repo through a PR. But this might have been possible in the past, due to organization-wide defaults for token permissions (recently fixed). No evidence has been found of past exploit. See also https://github.com/shaka-project/shaka-streamer/issues/216 and https://github.com/shaka-project/static-ffmpeg-binaries/issues/57 |
||
|---|---|---|
| .github | ||
| docs | ||
| include | ||
| link-test | ||
| npm | ||
| packager | ||
| .clang-format | ||
| .dockerignore | ||
| .gitignore | ||
| .gitmodules | ||
| .release-please-config.json | ||
| .release-please-manifest.json | ||
| AUTHORS | ||
| CHANGELOG.md | ||
| CMakeLists.txt | ||
| CONTRIBUTING.md | ||
| CONTRIBUTORS | ||
| Dockerfile | ||
| LICENSE | ||
| README.md | ||
| build-matrix.json | ||
| chromium-LICENSE | ||
README.md
Shaka Packager is a tool and a media packaging SDK for DASH and HLS packaging and encryption. It can prepare and package media content for online streaming.
Shaka Packager supports:
-
Both Video-On-Demand and Live.
-
Streaming formats:
-
Key systems:
-
Encryption standards:
-
Media Containers and codecs
Codecs ISO-BMFF WebM MPEG2-TS WVM Packed Audio² H264 (AVC) I / O - I / O I - H265 (HEVC) I / O - I - - VP8 I / O I / O - - - VP9 I / O I / O - - - AV1 I / O I / O - - - AAC I / O - I / O I O MP3 O - I / O - O Dolby AC3 I / O - I / O - O Dolby EAC3 I / O - O - O MPEG-H Audio I / O - - - - Dolby AC4 I / O - - - - DTS I / O - - - - FLAC I / O - - - - Opus I / O³ I / O - - - Vorbis - I / O - - - IAMF I / O - - - - NOTES:
- I for input and O for output.
- ²: https://tools.ietf.org/html/draft-pantos-http-live-streaming-23#section-3.4
- ³: Opus support in ISO-BMFF is experimental.
-
Subtitles
Format Input Output Text WebVTT Y Y WebVTT in MP4 #405 Y Text TTML ⁴ Y TTML in MP4 - Y DVB-SUB Y - Teletext #272 - - ⁴: TTML input is only supported with TTML output (pass-through, DASH only), see also #584.
- Platforms
- Linux
- Mac
- Windows
- Cross compiling for ARM is also supported.
1: Limited support
Getting Shaka Packager
There are several ways you can get Shaka Packager.
- Using Docker. Instructions are available here.
- Get prebuilt binaries from release.
- Built from source, see Build Instructions for details.
Useful Links
- Announcement List (join for infrequent announcements and surveys)
- Subscribe to releases by following instructions from this blog
- Documentation
- Tutorials
- Several open source players:
Contributing
If you have improvements or fixes, we would love to have your contributions. See https://github.com/shaka-project/shaka-packager/blob/main/CONTRIBUTING.md for details.