nicholasraimbault/silvervine v2.1.0

2.1.0 - 2026-08-02

on GitHub

Release Notes

Added

• Added doctor --media-stack [--browser] passive browser/CDM provenance,
  binary architecture, codec, VA-API, and macOS VideoToolbox diagnostics
  with stable JSON evidence sources and failure domains. The passive path
  performs no migration, log initialization, network access, or browser launch.
• Added an explicit test --browser <name> normal-profile EME probe for
  temporary Widevine key-system access, SW/HW robustness, cenc/cbcs schemes,
  AVC/HEVC/VP9/AV1 codec matrix (720p/1080p/4K), MSE/direct playback,
  MediaCapabilities, and HDCP 1.4/2.2 policy evidence. Rust returns one
  bounded assessment to the page and terminal. Automatic test --json emits
  exactly one StoredProbeReport; cache write failures are warnings with a
  null cache path. test --url remains a manual page launcher.
• Added BrowserProbeFailed error category/exit code for live probe timeout,
  malformed transport, and software-playback baseline failure.

Changed

• Batched patching now resolves the CDM, acquires the patch lock, and snapshots
  running processes once per operation; watcher scheduling uses one deadline
  loop instead of a separate ticker thread.
• Streamed CLI JSON directly to its destination, centralized platform CDM
  layout constants, and aligned the macOS Objective-C dependency graph.
• Raised the minimum supported Rust version from 1.85 to 1.88 so the locked
  dependency graph can include current security fixes.
• Browser patching now records and validates a Silvervine ownership marker
  bound to the installed manifest, platform, version, and CDM library SHA-512.
  Existing unmarked CDMs are preserved unless the user passes the explicit
  --replace-external-cdm override.

Fixed

• Published Linux CDM directories and macOS application bundles through
  staged transactions, with verification before publication and rollback on
  failed live verification.
• Removed crash-vulnerable non-native filesystem-exchange fallbacks; filesystems
  without native atomic exchange now fail closed before either path moves.
• Added versioned cache-integrity metadata for corruption detection; reuse now
  requires current library and root-manifest digests to match the exact payload
  extracted from a manifest-authenticated CRX.

Security

• Updated time to 0.3.54, resolving
  RUSTSEC-2026-0009
  in the notification and rolling-log dependency graph.
• The live EME probe uses an ephemeral IPv4 loopback server with a random
  single-use token, strict same-origin POST validation, CSP, bounded request
  size/count/output, and a fixed timeout. Probe data never leaves the device.
• Privileged patch children now inherit the parent's exact CDM replacement
  consent, and invalid ownership markers cannot bypass provenance checks.
• Elevated patching now passes only a bounded, parent-authenticated payload,
  rejects writable or symlinked install ancestry, and revalidates Linux
  install/parent device and inode identities around publication.
• Manifest retrieval now fails closed when both fixed Mozilla HTTPS origins
  fail; mutable on-disk manifest snapshots are write-only and cannot authorize
  executable content.
• CRX downloads now enforce strict SHA-512 syntax and a 256 MiB bound, reject
  symlink cache entries, and extract from the exact verified buffer rather than
  reopening a mutable pathname.

Install silvervine 2.1.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nicholasraimbault/silvervine/releases/download/v2.1.0/silvervine-installer.sh | sh

Download silvervine 2.1.0