Activation token about acsm-calibre-plugin

[JJTech0130]

Second part was my mistake, for some reason I thought that this plugin did decryption, but with proper rights checking. I see now that it just leaves that for an DeDRM to deal with. I thought DeDRM was only necessary if you wanted to export it something... anyway, still confused about the activation token

[Leseratte10]

The returned data from the /Activate request (the activation token) gets stored inside the activation.xml file, as is. Maybe some of the data isn't needed there, but I tried to implement the XML files identical to how Adobe does it.

I believe the only values that are actually needed are "device", "fingerprint" and "deviceType". "deviceType" will always be "standalone" for authorizations done by this plugin, but as the plugin also supports exporting the authorization files I wanted to keep them as they are supposed to be.

Never looked into that "signature" tag the server returns, I'm assuming it's intended so that the client can somehow verify that the response came from a legit Adobe server and hasn't been modified in transit. As there was no need to implement that signature check to have the plugin work, I never looked into how that parameter works, and I don't think libgourou contains any code related to that either.

If you figure out how to validate that signature parameter feel free to let me know and I'll add it.

And as you already noticed, this plugin does nothing to remove the DRM from fulfilled books. It would be fairly simple to add as all the keys are already there, but I don't want to get involved in potential legal issues.

[JJTech0130]

Yeah, since this was intended to be a reader plugin and will not ever be on a computer with adobe software, I was going to simplify things a bit. For now at least, I'm just going to store the device in the normal preferences store (not XML), along with the fingerprint (which we generate, right?)

[JJTech0130]

Maybe sometime I'll improve it to be identical to ADE, but for now I just want a working implementation 😄

[Leseratte10]

If this is going into an eReader plugin, it might be a good idea to attempt a mobile authorization instead of a standalone Desktop authorization.
Each Adobe ID starts out with 6 desktop and 6 mobile authorizations available, and each activation through ADE, readers, or this plugin will use one of these. If reader plugins / eReaders identify as mobile authorizations as intended, people can actually use more of their available authorizations.

Especially if you plan to "deviate" from the standard and/or do not plan to have an import/export functionality for an existing authorization like my plugin. If you do plan to have that and people can clone their authorizations then desktop auth is probably fine IMO, but that would require you to store the data like Adobe does.

[JJTech0130]

That's a good idea, I'll put it on my to-do list. Perhaps I'll even allow both. Anyhow, I should get basic functionality first 😄