Source release 17.1.1

2022-11-29 12:54:04 -08:00
parent 694cf6fb25
commit f11df1e144
139 changed files with 11266 additions and 771 deletions
--- a/cdm/cdm.gyp
+++ b/cdm/cdm.gyp
@@ -2,10 +2,9 @@
 # source code may only be used and distributed under the Widevine License
 # Agreement.
 #
-# Refer to the distribution package's integration guide
-# (Widevine_CE_CDM_IntegrationGuide_x.x.x.pdf) for information about
-# setting up your system, performing the build, and using/testing
-# the build targets.
+# Refer to the distribution package's integration guide for information about
+# setting up your system, performing the build, and using/testing the build
+# targets.

 {
  'includes': [
@@ -15,6 +14,7 @@
  ],    # Get list of core source files.
  'variables': {
    'has_dual_key%': 'false',
+    'embedded_cert%': '',
  },
  'targets': [
    {
@@ -86,9 +86,6 @@
        '../third_party/jsmn',
        '../util/include',
      ],
-      'defines': [
-        'CORE_UTIL_IMPLEMENTATION',
-      ],
      'direct_dependent_settings': {
        'include_dirs': [
          '../core/include',
@@ -104,6 +101,40 @@
      ],
      'includes': [ '../util/libcrypto_dependency.gypi' ],
      'conditions': [
+        ['client_info_source=="compiled"', {
+          'conditions': [
+            ['client_company_name=="" or " | " in client_company_name or "%" in client_company_name', {
+              'sources': [ 'invalid_client_company_name.c' ],
+            }],
+            ['client_model_name=="" or " | " in client_model_name or "%" in client_model_name', {
+              'sources': [ 'invalid_client_model_name.c' ],
+            }],
+            # year may be a number, so use __str__ to convert to string.  Can't use
+            # str() since we can't use global functions.
+            ['client_model_year=="" or " | " in client_model_year.__str__() or "%" in client_model_year.__str__()', {
+              'sources': [ 'invalid_client_model_year.c' ],
+            }],
+            ['client_product_name=="" or " | " in client_product_name or "%" in client_product_name', {
+              'sources': [ 'invalid_client_product_name.c' ],
+            }],
+            ['client_device_name=="" or " | " in client_device_name or "%" in client_device_name', {
+              'sources': [ 'invalid_client_device_name.c' ],
+            }],
+            ['client_arch_name=="" or " | " in client_arch_name or "%" in client_arch_name', {
+              'sources': [ 'invalid_client_arch_name.c' ],
+            }],
+            ['client_platform=="" or " | " in client_platform or "%" in client_platform', {
+              'sources': [ 'invalid_client_platform.c' ],
+            }],
+            ['client_form_factor=="" or " | " in client_form_factor or "%" in client_form_factor', {
+              'sources': [ 'invalid_client_form_factor.c' ],
+            }],
+            ['client_version=="" or " | " in client_version or "%" in client_version', {
+              'sources': [ 'invalid_client_version.c' ],
+            }],
+          ],
+        }],
+
        ['privacy_crypto_impl=="boringssl" or privacy_crypto_impl=="openssl"', {
          'sources': [
            '../core/src/privacy_crypto_boringssl.cpp',
@@ -173,7 +204,6 @@
      ],
      'defines': [
        'CDM_IMPLEMENTATION',
-        'CORE_UTIL_IMPLEMENTATION',
      ],
      'include_dirs': [
        'include',
@@ -191,6 +221,60 @@
        'src/log.cpp',
        'src/properties_ce.cpp',
      ],
+      'conditions': [
+        ['embedded_cert!=""', {
+          'actions': [{
+            'action_name': 'generate_cert',
+            'msvs_cygwin_shell': 0,
+            'message': 'Generating cert.cc',
+            'inputs': [
+              'create_cert_cc.py',
+              '<(embedded_cert)',
+            ],
+            'outputs': [
+              '<(INTERMEDIATE_DIR)/cert.cc',
+            ],
+            'action': [
+              'python3',
+              '>@(_inputs)',
+              '>@(_outputs)',
+            ],
+          }],
+          'sources': [
+            '<(INTERMEDIATE_DIR)/cert.cc',
+          ],
+          'defines': ['HAS_EMBEDDED_CERT'],
+        }],  # embedded_cert!=""
+
+        # This block defines preprocessor values that match the client
+        # information variables in platform properties.gypi. If you are writing
+        # your own build files to build CE CDM insted of using these GYP files
+        # and you are using compile-time client info, make sure to define these
+        # values, following the rules in the client info section in
+        # platform_properties.gypi.
+        ['client_info_source=="compiled"', {
+          'defines': [
+            'CLIENT_COMPANY_NAME="<(client_company_name)"',
+            'CLIENT_MODEL_NAME="<(client_model_name)"',
+            'CLIENT_MODEL_YEAR="<(client_model_year)"',
+            'CLIENT_PRODUCT_NAME="<(client_product_name)"',
+            'CLIENT_DEVICE_NAME="<(client_device_name)"',
+            'CLIENT_ARCH_NAME="<(client_arch_name)"',
+            'CLIENT_PLATFORM="<(client_platform)"',
+            'CLIENT_FORM_FACTOR="<(client_form_factor)"',
+            'CLIENT_VERSION="<(client_version)"',
+          ],
+        }],  # client_info_source=="compiled"
+
+        ['client_info_source=="runtime"', {
+          'defines': [
+            'RUNTIME_CLIENT_INFO',
+          ],
+          'dependencies': [
+            '<(read_client_info_path)',
+          ],
+        }],  # client_info_source=="runtime"
+      ],  # conditions
    },  # widevine_cdm_static target
    {
      'toolsets' : [  'target' ],
--- a/cdm/cdm_reboot_tests.gyp
+++ b/cdm/cdm_reboot_tests.gyp
@@ -16,8 +16,6 @@
    'util_dir': '../util',
    'metrics_target': 'cdm.gyp:metrics_proto',
    'device_files_target': 'cdm.gyp:device_files',
-    # The path to the test device cert source file.
-    'device_cert_path%': 'test/device_cert.cpp',
  },
  'targets': [{
    'toolsets' : [ 'target' ],
@@ -26,8 +24,6 @@
      'test/cdm_reboot_test_main.cpp',
      'test/cdm_test_runner.cpp',
      'test/create_test_file_system.cpp',
-      '<(device_cert_path)',
-      'test/device_cert.h',
      'test/test_host.cpp',
      'test/test_host.h',
      '../core/test/config_test_env.cpp',
@@ -66,10 +62,6 @@
      '<(device_files_target)',
    ],
    'defines': [
-      # The methods in util/ are marked as dllimport but in this case are
-      # being loaded in the static library.  So define this so Windows
-      # doesn't look in a DLL for the implementations.
-      'CORE_UTIL_IMPLEMENTATION',
      'UNIT_TEST',
      'CDM_TESTS',
    ],
@@ -104,11 +96,6 @@
      }, {
        'type': 'executable',
      }],
-      ['oemcrypto_lib=="ref"', {
-        'dependencies': [
-          'oemcrypto_reference_implementation.gyp:oec_ref',
-        ],
-      }],
      # TODO(b/139814713): For testing and internal use only.
      ['oemcrypto_adapter_type=="static_v15"', {
        'defines': [
@@ -137,7 +124,7 @@
      }],
      ['oemcrypto_lib=="target"', {
        'dependencies': [
-          '<(oemcrypto_gyp_target)',
+          '<(oemcrypto_gyp_path)',
        ],
      }],
    ],
--- a/cdm/cdm_unittests.gyp
+++ b/cdm/cdm_unittests.gyp
@@ -16,11 +16,8 @@
    'util_dir': '../util',
    'metrics_target': 'cdm.gyp:metrics_proto',
    'device_files_target': 'cdm.gyp:device_files',
-    # The path to the test device cert source file.
-    'device_cert_path%': 'test/device_cert.cpp',
    # The path to the prebuilt CDM to test against. (iOS only)
    'prebuilt_cdm_path%': '',
-    'prebuilt_cdm_cert%': '',
    'supports_dynamic_perf_test%': 0,
  },
  'targets': [{
@@ -30,8 +27,6 @@
      'test/cdm_test_main.cpp',
      'test/cdm_test_runner.cpp',
      'test/create_test_file_system.cpp',
-      '<(device_cert_path)',
-      'test/device_cert.h',
      # The test host, which is required for all test suites on CE.
      'test/test_host.cpp',
      'test/test_host.h',
@@ -52,12 +47,6 @@
      '../third_party/googletest.gyp:gmock',
      '../third_party/googletest.gyp:gtest',
    ],
-    'defines': [
-      # The methods in util/ are marked as dllimport but in this case are
-      # being loaded in the static library.  So define this so Windows
-      # doesn't look in a DLL for the implementations.
-      'CORE_UTIL_IMPLEMENTATION',
-    ],
    'msvs_settings': {
      'VCLinkerTool': {
        # Additionally, since they are loaded locally, suppress these
@@ -91,11 +80,6 @@
      }, {
        'type': 'executable',
      }],
-      ['oemcrypto_lib=="ref"', {
-        'dependencies': [
-          'oemcrypto_reference_implementation.gyp:oec_ref',
-        ],
-      }],
      # TODO(b/139814713): For testing and internal use only.
      ['oemcrypto_adapter_type=="static_v15"', {
        'defines': [
@@ -124,7 +108,7 @@
      }],
      ['oemcrypto_lib=="target"', {
        'dependencies': [
-          '<(oemcrypto_gyp_target)',
+          '<(oemcrypto_gyp_path)',
        ],
      }],
    ],
@@ -135,7 +119,6 @@
        'target_name': 'widevine_perf_test_dynamic',
        'type': 'executable',
        'sources': [
-          '<(device_cert_path)',
          '../core/test/config_test_env.cpp',
          '../core/test/http_socket.cpp',
          '../core/test/license_request.cpp',
@@ -199,27 +182,6 @@
      'conditions': [
        ['supports_dynamic_perf_test', {
          'targets': [{
-            'target_name': 'create_cert_cc',
-            'type': 'none',
-            'actions': [{
-              'action_name': 'gen_cert',
-              'message': 'Generating device_cert.cc',
-              'msvs_cygwin_shell': 0,
-              'inputs': [
-                'create_cert_cc.py',
-                '<(prebuilt_cdm_cert)',
-              ],
-              'outputs': [
-                '<(INTERMEDIATE_DIR)/cert.cc',
-              ],
-              'action': [
-                'python',
-                'create_cert_cc.py',
-                '<(prebuilt_cdm_cert)',
-                '<(INTERMEDIATE_DIR)/cert.cc',
-              ],
-            }],
-          }, {
            'target_name': 'widevine_perf_test_xctest',
            'type': 'loadable_module',
            'mac_xctest_bundle': '1',
@@ -242,7 +204,6 @@
              '<(prebuilt_cdm_path)',
            ],
            'sources': [
-              '<(INTERMEDIATE_DIR)/cert.cc',
              '../core/test/config_test_env.cpp',
              '../core/test/http_socket.cpp',
              '../core/test/license_request.cpp',
@@ -266,7 +227,6 @@
            'dependencies': [
              '../third_party/googletest.gyp:gmock',
              '../third_party/googletest.gyp:gtest',
-              'create_cert_cc',
              'dummy_app',
            ],
          }],
--- a/cdm/create_cert_cc.py
+++ b/cdm/create_cert_cc.py
@@ -23,8 +23,12 @@ if __name__ == '__main__':

 #include <stdint.h>
 #include <stddef.h>
+namespace widevine {{
+
 extern const uint8_t k{options.variable}[];
 const uint8_t k{options.variable}[] = {{ {dat} }};

 extern const size_t k{options.variable}Size;
-const size_t k{options.variable}Size = sizeof(k{options.variable});""")
+const size_t k{options.variable}Size = sizeof(k{options.variable});
+
+}}  // namespace widevine""")
--- a/cdm/include/cdm.h
+++ b/cdm/include/cdm.h
@@ -12,20 +12,28 @@
 #include <string>
 #include <vector>

+// Uncomment this line when making static CDM builds.  This will be edited by
+// release scripts.
+//#define CDM_STATIC 1
+
 // Define CDM_EXPORT to export functionality across shared library boundaries.
-#if defined(_WIN32)
-#  if defined(CDM_IMPLEMENTATION)
-#    define CDM_EXPORT __declspec(dllexport)
-#  else
-#    define CDM_EXPORT __declspec(dllimport)
-#  endif  // defined(CDM_IMPLEMENTATION)
-#else     // defined(_WIN32)
-#  if defined(CDM_IMPLEMENTATION)
-#    define CDM_EXPORT __attribute__((visibility("default")))
-#  else
-#    define CDM_EXPORT
-#  endif
-#endif  // defined(_WIN32)
+#if defined(CDM_STATIC)
+#  define CDM_EXPORT
+#else
+#  if defined(_WIN32)
+#    if defined(CDM_IMPLEMENTATION)
+#      define CDM_EXPORT __declspec(dllexport)
+#    else
+#      define CDM_EXPORT __declspec(dllimport)
+#    endif  // defined(CDM_IMPLEMENTATION)
+#  else     // defined(_WIN32)
+#    if defined(CDM_IMPLEMENTATION)
+#      define CDM_EXPORT __attribute__((visibility("default")))
+#    else
+#      define CDM_EXPORT
+#    endif
+#  endif  // defined(_WIN32)
+#endif  // defined(CDM_STATIC)

 namespace widevine {

--- a/cdm/include/cdm_version.h
+++ b/cdm/include/cdm_version.h
@@ -13,7 +13,7 @@
 #  define CDM_VERSION_MINOR 1
 #endif
 #ifndef CDM_VERSION_PATCH
-#  define CDM_VERSION_PATCH 0
+#  define CDM_VERSION_PATCH 1
 #endif
 #ifndef CDM_VERSION_TAG
 #  define CDM_VERSION_TAG ""
--- a/cdm/include/compiler_detection.h
+++ b/cdm/include/compiler_detection.h
@@ -5,7 +5,7 @@
 #define WVCDM_CDM_COMPILER_DETECTION_H_

 // This file makes some best-effort attempts to detect details about the
-// compilation environment used by CacheBuildInfo.
+// compilation environment used by SetClientInfo.

 #if defined(CDM_DISABLE_LOGGING)
 #  define LOGGING_MESSAGE "Logging Disabled"
--- a/cdm/include/properties_ce.h
+++ b/cdm/include/properties_ce.h
@@ -19,6 +19,7 @@ class PropertiesCE {
  // If this is set to an empty string, (which is the default) then PropertiesCE
  // will report that there is no Sandbox ID in use.
  static void SetSandboxId(const std::string& sandbox_id);
+  static bool ClientInfoIsValid();

 private:
  static void SetSecureOutputType(Cdm::SecureOutputType secure_output_type);
--- a/cdm/include/read_client_info.h
+++ b/cdm/include/read_client_info.h
@@ -0,0 +1,32 @@
+// Copyright 2022 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine License
+// Agreement.
+#ifndef WVCDM_CDM_READ_CLIENT_INFO_H_
+#define WVCDM_CDM_READ_CLIENT_INFO_H_
+
+#include <string>
+
+namespace widevine {
+
+// This function must be implemented by partners who wish to use run-time client
+// information. (i.e. Those that set 'client_info_source' to 'runtime' in their
+// platform's properties.) These partners must set 'read_client_info_path' to
+// a GYP target that contains an implementation of this function. This function
+// will be called by the CE CDM during Cdm::initialize() to retrieve the client
+// information at runtime.
+//
+// This function should fill in each of the strings with the relevant piece of
+// client information and return true. If for any reason the platform cannot
+// fill in all the strings or an error occurs, the function should return false.
+//
+// For a definition of each string's meaning, see the client info property
+// documentation in platform_properties.gypi.
+bool ReadClientInformation(std::string* company_name, std::string* model_name,
+                           std::string* model_year, std::string* product_name,
+                           std::string* device_name, std::string* arch_name,
+                           std::string* platform, std::string* form_factor,
+                           std::string* version);
+
+}  // namespace widevine
+
+#endif  // WVCDM_CDM_READ_CLIENT_INFO_H_
--- a/cdm/platform_properties.gypi
+++ b/cdm/platform_properties.gypi
@@ -16,42 +16,71 @@
 # achieve.
 {
  'variables': {
+    # Choose whether the client information is compiled into the binary at
+    # compile-time or whether it is gathered by the CDM at runtime. The client
+    # information ends up as client identification in license requests. All
+    # values may be used by a license server proxy to drive business logic.
+    # Valid values are:
+    #
+    # 'compiled' - The client information is read from the platform properties
+    #              and compiled into the CE CDM binary. The platform properties
+    #              that define client info must be defined.
+    #
+    # 'runtime' - The client information is read at runtime using
+    #             read_client_info.h. The property 'read_client_info_path' must
+    #             also be defined, pointing to a GYP target that provides an
+    #             implementation of read_client_info.h.
+    'client_info_source%': 'compiled',
+
    # The following variables define the client info that is baked into the CDM
-    # binary at build-time. These parameters end up as client identification in
-    # license requests. All values may be used by a license server proxy to
-    # drive business logic. You *must* set meaningful values for all of these
-    # variables as part of defining your platform. Values may not contain
-    # double quotes, percent signs, or the substring " | ". (a vertical pipe
-    # surrounded by spaces)
+    # binary at build-time. If 'client_info_source' is 'compiled'. You *must*
+    # set meaningful values for all of these variables as part of defining your
+    # platform. Values may not contain double quotes, percent signs, or the
+    # substring " | ". (a vertical pipe surrounded by spaces) If
+    # 'client_info_source' is 'runtime', these variables are ignored.

    # The name of the company who makes the client, e.g. "KubrickTech".
    # This should match the "Make" field in the Widevine Integration Console.
-    'client_company_name%': '',
+    #'client_company_name%': '',
+
    # The client's model name, e.g. "HAL 9000".
    # This should match the "Model" field in the Widevine Integration Console.
-    'client_model_name%': '',
+    #'client_model_name%': '',
+
    # The client's model year, e.g. "2001".
    # Can be used to distinguish different devices with the same model name.
    # This should match the "Year" field in the Widevine Integration Console.
-    'client_model_year%': '',
+    #'client_model_year%': '',
+
    # The name or codename of the product or application, e.g. "clarke".
    # This may be the same as "client_model_name".
-    'client_product_name%': '',
+    #'client_product_name%': '',
+
    # The name or codename of the client, e.g. "HAL".
    # This may be the same as "client_model_name" or "client_product_name".
-    'client_device_name%': '',
+    #'client_device_name%': '',
+
    # The CPU architecture of the client, e.g. "ARMv7".
-    'client_arch_name%': '',
+    #'client_arch_name%': '',
    # The OS platform of the client, e.g. "Linux".
    # This should match the "Platform" field in the Widevine Integration
    # Console.
-    'client_platform%': '',
+    #'client_platform%': '',
+
    # The form factor of the client, e.g. "TV".
    # This should match the "Type" field in the Widevine Integration Console.
-    'client_form_factor%': '',
+    #'client_form_factor%': '',
+
    # The version number of the client that the CE CDM is integrated into. This
    # is the operating system or app version, not the CDM version.
-    'client_version%': '',
+    #'client_version%': '',
+
+    # If 'client_info_source' is 'runtime', this variable must be set to the
+    # path to a GYP target that provides an implementation of
+    # read_client_info.h. This implementation will be compiled into the CDM and
+    # used at runtime to get the client info. If 'client_info_source' is
+    # 'compiled', this variable is ignored.
+    'read_client_info_path%': '',


    # Choose type of OEMCrypto library to compile in. Valid values are:
@@ -60,11 +89,6 @@
    #            they are providing their own OEMCrypto library and the Widevine
    #            CE CDM build system is not responsible for building anything.
    #
-    # 'ref' - The default value of 'ref' builds the OEMCrypto reference code, in
-    #         order to allow the CE CDM to build without a vendor integration.
-    #         This setting should *NEVER* be used in production systems and is
-    #         for testing purposes only.
-    #
    # 'level3' - Partners who have received a Widevine-generated Level 3 library
    #            should use 'level3' to indicate that the Widevine CE CDM build
    #            system should include it in the build.
@@ -72,13 +96,15 @@
    # 'target' - If your vendor OEMCrypto is built using GYP and you would like
    #            the Widevine CE CDM build system to build it as part of the CE
    #            CDM build process, you can use 'target' and also set the
-    #            variable 'oemcrypto_gyp_target' below. Most vendors will want
-    #            to use 'vendor', above, instead. This setting exists primarily
-    #            for Google's internal testing.
-    'oemcrypto_lib%': 'ref',
+    #            variable 'oemcrypto_gyp_path' below. Most vendors will want to
+    #            use 'vendor', above, instead. This setting exists primarily for
+    #            Google's internal testing.
+    #'oemcrypto_lib%': '',
+
    # You only need to set this value if you set 'oemcrypto_lib' to 'target'
    # above.
-    'oemcrypto_gyp_target%': '',
+    #'oemcrypto_gyp_path%': '',
+
    # Choose the oemcrypto adapter type. Valid values are:
    #
    # 'static' - (default). Statically link oemcrypto into the tests.
@@ -152,34 +178,16 @@
    #
    # 2) protobuf_config == 'target'
    # Use an existing protobuf gyp target from your project.
-    # Specify the protobuf gyp file and target in protobuf_lib_target.
-    # Specify the protoc gyp file and target in protoc_host_target.
+    # Specify the protobuf gyp file and target in protobuf_lib_path.
+    # Specify the protoc gyp file and target in protoc_host_path.
    # Specify the path to protoc in protoc_bin.
    #
    # 3) protobuf_config == 'source'  (default)
    # Build protobuf and protoc from the copy in third_party/protobuf.
    'protobuf_config%': 'source',
+    'protobuf_lib%': '',
    'protoc_bin%': '',
-    'protoc_lib%': '',
-    'protoc_lib_target%': '',
-    'protoc_host_target%': '',
+    'protobuf_lib_path%': '',
+    'protoc_host_path%': '',
  },  # variables
-
-  # This block defines preprocessor values that match the client information
-  # variables above. If you are writing your own build files to build CE CDM
-  # insted of using these GYP files, make sure to define these values, following
-  # the rules in the client info section above.
-  'target_defaults': {
-    'defines': [
-      'CLIENT_COMPANY_NAME="<(client_company_name)"',
-      'CLIENT_MODEL_NAME="<(client_model_name)"',
-      'CLIENT_MODEL_YEAR="<(client_model_year)"',
-      'CLIENT_PRODUCT_NAME="<(client_product_name)"',
-      'CLIENT_DEVICE_NAME="<(client_device_name)"',
-      'CLIENT_ARCH_NAME="<(client_arch_name)"',
-      'CLIENT_PLATFORM="<(client_platform)"',
-      'CLIENT_FORM_FACTOR="<(client_form_factor)"',
-      'CLIENT_VERSION="<(client_version)"',
-    ],
-  },
 }
--- a/cdm/src/cdm.cpp
+++ b/cdm/src/cdm.cpp
@@ -36,6 +36,11 @@

 namespace widevine {

+#ifdef HAS_EMBEDDED_CERT
+extern const uint8_t kDeviceCert[];
+extern const size_t kDeviceCertSize;
+#endif
+
 using namespace wvcdm;
 using namespace wvutil;

@@ -45,42 +50,6 @@ constexpr char kNoSandboxId[] = "";
 const int64_t kPolicyTimerDurationMilliseconds = 5000;
 void* const kPolicyTimerContext = nullptr;

-#define STRINGIFY(PARAM) #PARAM
-
-bool isClientInfoValid(const char* tag, const char* value) {
-  constexpr char kForbiddenSeparator[] = " | ";
-  constexpr char kForbiddenPercent[] = "%";
-  if (value[0] == '\0') {
-    LOGE("%s may not be empty, but it is.", tag);
-    return false;
-  }
-  if (strstr(value, kForbiddenSeparator) != nullptr) {
-    LOGE("%s may not contain \"%s\", but it's \"%s\"", tag, kForbiddenSeparator,
-         value);
-    return false;
-  }
-  if (strstr(value, kForbiddenPercent) != nullptr) {
-    LOGE("%s may not contain \"%s\", but it's \"%s\"", tag, kForbiddenPercent,
-         value);
-    return false;
-  }
-  return true;
-}
-
-bool clientInfoIsValid() {
-  return isClientInfoValid(STRINGIFY(CLIENT_COMPANY_NAME),
-                           CLIENT_COMPANY_NAME) &&
-         isClientInfoValid(STRINGIFY(CLIENT_MODEL_NAME), CLIENT_MODEL_NAME) &&
-         isClientInfoValid(STRINGIFY(CLIENT_MODEL_YEAR), CLIENT_MODEL_YEAR) &&
-         isClientInfoValid(STRINGIFY(CLIENT_PRODUCT_NAME),
-                           CLIENT_PRODUCT_NAME) &&
-         isClientInfoValid(STRINGIFY(CLIENT_DEVICE_NAME), CLIENT_DEVICE_NAME) &&
-         isClientInfoValid(STRINGIFY(CLIENT_ARCH_NAME), CLIENT_ARCH_NAME) &&
-         isClientInfoValid(STRINGIFY(CLIENT_PLATFORM), CLIENT_PLATFORM) &&
-         isClientInfoValid(STRINGIFY(CLIENT_FORM_FACTOR), CLIENT_FORM_FACTOR) &&
-         isClientInfoValid(STRINGIFY(CLIENT_VERSION), CLIENT_VERSION);
-}
-
 struct HostType {
  Cdm::IStorage* storage;
  Cdm::IClock* clock;
@@ -1752,8 +1721,6 @@ Cdm::Status Cdm::initialize(SecureOutputType secure_output_type,
      return kTypeError;
  }

-  if (!clientInfoIsValid()) return kUnexpectedError;
-
  if (!storage || !clock || !timer) {
    LOGE("All interfaces are required!");
    return kTypeError;
@@ -1762,6 +1729,8 @@ Cdm::Status Cdm::initialize(SecureOutputType secure_output_type,
  PropertiesCE::SetSecureOutputType(secure_output_type);
  if (sandbox_id != kNoSandboxId) PropertiesCE::SetSandboxId(sandbox_id);
  Properties::Init();
+  if (!PropertiesCE::ClientInfoIsValid()) return kUnexpectedError;
+
  host.storage = storage;
  host.clock = clock;
  host.timer = timer;
@@ -1779,7 +1748,7 @@ Cdm::Status Cdm::getClientInfo(ClientInfo* client_info) {
    return kTypeError;
  }

-  if (!clientInfoIsValid()) return kUnexpectedError;
+  if (!PropertiesCE::ClientInfoIsValid()) return kUnexpectedError;

  if (!Properties::GetCompanyName(&client_info->company_name)) {
    LOGE("Unable to get Company Name.");
@@ -1912,6 +1881,27 @@ class FileImpl final : public File {
  const bool truncate_;
 };

+#ifdef HAS_EMBEDDED_CERT
+class FileCertImpl final : public File {
+ public:
+  // This Read method only gives correct results for the first call.
+  ssize_t Read(char* buffer, size_t bytes) override {
+    if (!buffer) {
+      LOGW("File::Read: buffer is empty");
+      return -1;
+    }
+    size_t to_copy = std::min(bytes, kDeviceCertSize);
+    memcpy(buffer, kDeviceCert, to_copy);
+    return to_copy;
+  }
+
+  ssize_t Write(const char* buffer, size_t bytes) override {
+    LOGW("File::Write: device cert is read-only.");
+    return -1;
+  }
+};
+#endif
+
 class FileSystem::Impl {
 public:
  Impl(widevine::Cdm::IStorage* storage) : storage_(storage) {
@@ -1931,6 +1921,12 @@ FileSystem::~FileSystem() {}

 std::unique_ptr<File> FileSystem::Open(const std::string& file_path,
                                       int flags) {
+#ifdef HAS_EMBEDDED_CERT
+  if (file_path == kLegacyCertificateFileName) {
+    return std::unique_ptr<File>(new FileCertImpl);
+  }
+#endif
+
  if (!(flags & kCreate) && !impl_->storage_->exists(file_path)) {
    return nullptr;
  }
@@ -1939,20 +1935,40 @@ std::unique_ptr<File> FileSystem::Open(const std::string& file_path,
 }

 bool FileSystem::Exists(const std::string& file_path) {
+#ifdef HAS_EMBEDDED_CERT
+  if (file_path == kLegacyCertificateFileName) return true;
+#endif
  return !file_path.empty() && impl_->storage_->exists(file_path);
 }

 bool FileSystem::Remove(const std::string& file_path) {
+#ifdef HAS_EMBEDDED_CERT
+  if (file_path == kLegacyCertificateFileName) {
+    LOGE("Cannot remove device cert when embedded.");
+    return false;
+  }
+#endif
  return impl_->storage_->remove(file_path);
 }

 ssize_t FileSystem::FileSize(const std::string& file_path) {
+#ifdef HAS_EMBEDDED_CERT
+  if (file_path == kLegacyCertificateFileName) {
+    return kDeviceCertSize;
+  }
+#endif
  return impl_->storage_->size(file_path);
 }

 bool FileSystem::List(const std::string&,
                      std::vector<std::string>* file_names) {
-  return file_names && impl_->storage_->list(file_names);
+  const bool ret = file_names && impl_->storage_->list(file_names);
+#ifdef HAS_EMBEDDED_CERT
+  if (ret) {
+    file_names->emplace_back(kLegacyCertificateFileName);
+  }
+#endif
+  return ret;
 }

 }  // namespace wvutil
--- a/cdm/src/properties_ce.cpp
+++ b/cdm/src/properties_ce.cpp
@@ -4,6 +4,7 @@
 #include "properties_ce.h"

 #include <stdio.h>
+#include <string.h>

 #include <memory>
 #include <string>
@@ -12,6 +13,8 @@
 #include "compiler_detection.h"
 #include "log.h"
 #include "properties.h"
+#include "read_client_info.h"
+#include "string_format.h"

 // This anonymous namespace is shared between both the widevine namespace and
 // wvcdm namespace objects below.
@@ -26,6 +29,98 @@ std::string sandbox_id_;
 widevine::Cdm::SecureOutputType secure_output_type_ =
    widevine::Cdm::kNoSecureOutput;

+bool client_info_is_valid_;
+std::string company_name_;
+std::string model_name_;
+std::string model_year_;
+std::string product_name_;
+std::string device_name_;
+std::string arch_name_;
+std::string build_info_;
+
+bool isClientInfoFieldValid(const char* tag, const char* value) {
+  constexpr char kForbiddenSeparator[] = " | ";
+  constexpr char kForbiddenPercent[] = "%";
+  if (value[0] == '\0') {
+    LOGE("%s may not be empty, but it is.", tag);
+    return false;
+  }
+  if (strstr(value, kForbiddenSeparator) != nullptr) {
+    LOGE("%s may not contain \"%s\", but it's \"%s\"", tag, kForbiddenSeparator,
+         value);
+    return false;
+  }
+  if (strstr(value, kForbiddenPercent) != nullptr) {
+    LOGE("%s may not contain \"%s\", but it's \"%s\"", tag, kForbiddenPercent,
+         value);
+    return false;
+  }
+  return true;
+}
+
+void SetClientInfo() {
+  std::string platform;
+  std::string form_factor;
+  std::string version;
+
+#if defined(RUNTIME_CLIENT_INFO)
+  if (!widevine::ReadClientInformation(
+          &company_name_, &model_name_, &model_year_, &product_name_,
+          &device_name_, &arch_name_, &platform, &form_factor, &version)) {
+    LOGE("ReadClientInformation failed.");
+    client_info_is_valid_ = false;
+    return;
+  }
+
+  if (!(isClientInfoFieldValid("company_name", company_name_.c_str()) &&
+        isClientInfoFieldValid("model_name", model_name_.c_str()) &&
+        isClientInfoFieldValid("model_year", model_year_.c_str()) &&
+        isClientInfoFieldValid("product_name", product_name_.c_str()) &&
+        isClientInfoFieldValid("device_name", device_name_.c_str()) &&
+        isClientInfoFieldValid("arch_name", arch_name_.c_str()) &&
+        isClientInfoFieldValid("platform", platform.c_str()) &&
+        isClientInfoFieldValid("form_factor", form_factor.c_str()) &&
+        isClientInfoFieldValid("version", version.c_str()))) {
+    client_info_is_valid_ = false;
+    return;
+  }
+#else
+  if (!(isClientInfoFieldValid("CLIENT_COMPANY_NAME", CLIENT_COMPANY_NAME) &&
+        isClientInfoFieldValid("CLIENT_MODEL_NAME", CLIENT_MODEL_NAME) &&
+        isClientInfoFieldValid("CLIENT_MODEL_YEAR", CLIENT_MODEL_YEAR) &&
+        isClientInfoFieldValid("CLIENT_PRODUCT_NAME", CLIENT_PRODUCT_NAME) &&
+        isClientInfoFieldValid("CLIENT_DEVICE_NAME", CLIENT_DEVICE_NAME) &&
+        isClientInfoFieldValid("CLIENT_ARCH_NAME", CLIENT_ARCH_NAME) &&
+        isClientInfoFieldValid("CLIENT_PLATFORM", CLIENT_PLATFORM) &&
+        isClientInfoFieldValid("CLIENT_FORM_FACTOR", CLIENT_FORM_FACTOR) &&
+        isClientInfoFieldValid("CLIENT_VERSION", CLIENT_VERSION))) {
+    client_info_is_valid_ = false;
+    return;
+  }
+
+  company_name_ = CLIENT_COMPANY_NAME;
+  model_name_ = CLIENT_MODEL_NAME;
+  model_year_ = CLIENT_MODEL_YEAR;
+  product_name_ = CLIENT_PRODUCT_NAME;
+  device_name_ = CLIENT_DEVICE_NAME;
+  arch_name_ = CLIENT_ARCH_NAME;
+  platform = CLIENT_PLATFORM;
+  form_factor = CLIENT_FORM_FACTOR;
+  version = CLIENT_VERSION;
+#endif
+
+  if (!wvutil::FormatString(
+          &build_info_, "%s | %s | %s | %s | CE CDM %s | %s | %s | %s",
+          version.c_str(), platform.c_str(), form_factor.c_str(),
+          arch_name_.c_str(), CDM_VERSION, CPU_ARCH_MESSAGE, LOGGING_MESSAGE,
+          BUILD_FLAVOR_MESSAGE)) {
+    client_info_is_valid_ = false;
+    LOGE("Formatting the build info failed.");
+  } else {
+    client_info_is_valid_ = true;
+  }
+}
+
 bool GetValue(const char* source, std::string* output) {
  if (!source || !output) {
    return false;
@@ -34,11 +129,6 @@ bool GetValue(const char* source, std::string* output) {
  return source[0] != '\0';
 }

-constexpr char kBuildInfo[] = CLIENT_VERSION
-    " | " CLIENT_PLATFORM " | " CLIENT_FORM_FACTOR " | " CLIENT_ARCH_NAME
-    " | CE CDM " CDM_VERSION " | " CPU_ARCH_MESSAGE " | " LOGGING_MESSAGE
-    " | " BUILD_FLAVOR_MESSAGE;
-
 }  // namespace

 namespace widevine {
@@ -83,6 +173,9 @@ void PropertiesCE::SetSandboxId(const std::string& sandbox_id) {
  sandbox_id_ = sandbox_id;
 }

+// static
+bool PropertiesCE::ClientInfoIsValid() { return client_info_is_valid_; }
+
 }  // namespace widevine

 namespace wvcdm {
@@ -97,42 +190,43 @@ void Properties::InitOnce() {
  device_files_is_a_real_filesystem_ = false;
  allow_restore_of_offline_licenses_with_release_ = true;
  delay_oem_crypto_termination_ = false;
+  SetClientInfo();
  session_property_set_.reset(new CdmClientPropertySetMap());
 }

 // static
 bool Properties::GetCompanyName(std::string* company_name) {
-  return GetValue(CLIENT_COMPANY_NAME, company_name);
+  return GetValue(company_name_.c_str(), company_name);
 }

 // static
 bool Properties::GetModelName(std::string* model_name) {
-  return GetValue(CLIENT_MODEL_NAME, model_name);
+  return GetValue(model_name_.c_str(), model_name);
 }

 // static
 bool Properties::GetModelYear(std::string* model_year) {
-  return GetValue(CLIENT_MODEL_YEAR, model_year);
+  return GetValue(model_year_.c_str(), model_year);
 }

 // static
 bool Properties::GetArchitectureName(std::string* arch_name) {
-  return GetValue(CLIENT_ARCH_NAME, arch_name);
+  return GetValue(arch_name_.c_str(), arch_name);
 }

 // static
 bool Properties::GetDeviceName(std::string* device_name) {
-  return GetValue(CLIENT_DEVICE_NAME, device_name);
+  return GetValue(device_name_.c_str(), device_name);
 }

 // static
 bool Properties::GetProductName(std::string* product_name) {
-  return GetValue(CLIENT_PRODUCT_NAME, product_name);
+  return GetValue(product_name_.c_str(), product_name);
 }

 // static
 bool Properties::GetBuildInfo(std::string* build_info) {
-  return GetValue(kBuildInfo, build_info);
+  return GetValue(build_info_.c_str(), build_info);
 }

 // static
--- a/cdm/test/cdm_reboot_test_main.cpp
+++ b/cdm/test/cdm_reboot_test_main.cpp
@@ -19,7 +19,6 @@
 #include "cdm.h"
 #include "cdm_test_runner.h"
 #include "clock.h"
-#include "device_cert.h"
 #include "log.h"
 #include "reboot_test.h"
 #include "test_base.h"
--- a/cdm/test/cdm_test.cpp
+++ b/cdm/test/cdm_test.cpp
@@ -1306,6 +1306,12 @@ TEST_F(CdmTest, PerOriginLoadPersistent) {
    // Create another host to use its storage.  This will simulate another
    // origin.
    TestHost other_host;
+    // EnsureProvisioned uses the global host, so set that temporarily to
+    // provision the new host (if needed).
+    TestHost* cur_host = g_host;
+    g_host = &other_host;
+    EnsureProvisioned();
+    g_host = cur_host;

    // Create a new CDM that uses the new host and new storage.
    std::unique_ptr<Cdm> other_cdm(Cdm::create(
@@ -2626,7 +2632,9 @@ TEST_F(CdmIndividualizationTest, RemoveProvisioning) {
  if (!CheckProvisioningSupport()) return;

  // Clear any existing certificates.
-  EXPECT_EQ(Cdm::kSuccess, cdm_->removeProvisioning());
+  g_host->global_storage().remove(kOemCertificateFileName);
+  g_host->per_origin_storage().remove(kCertificateFileName);
+  g_host->per_origin_storage().remove(kLegacyCertificateFileName);

  if (wvoec::global_features.provisioning_method ==
      OEMCrypto_BootCertificateChain) {
@@ -2641,12 +2649,7 @@ TEST_F(CdmIndividualizationTest, RemoveProvisioning) {

  EXPECT_EQ(Cdm::kSuccess, cdm_->removeProvisioning());

-  if (wvoec::global_features.provisioning_method ==
-      OEMCrypto_BootCertificateChain) {
-    EXPECT_EQ(cdm_->getProvisioningStatus(), Cdm::kNeedsOemCertProvisioning);
-  } else {
-    EXPECT_EQ(cdm_->getProvisioningStatus(), Cdm::kNeedsDrmCertProvisioning);
-  }
+  EXPECT_EQ(cdm_->getProvisioningStatus(), Cdm::kNeedsDrmCertProvisioning);
 }

 TEST_F(CdmIndividualizationTest, NoCreateSessionWithoutProvisioning) {
--- a/cdm/test/cdm_test_main.cpp
+++ b/cdm/test/cdm_test_main.cpp
@@ -12,7 +12,6 @@

 #include "cdm.h"
 #include "cdm_test_runner.h"
-#include "device_cert.h"
 #include "log.h"
 #include "test_base.h"
 #include "test_host.h"
--- a/cdm/test/cdm_test_runner.cpp
+++ b/cdm/test/cdm_test_runner.cpp
@@ -11,7 +11,6 @@
 #include <vector>

 #include "cdm.h"
-#include "device_cert.h"
 #include "log.h"
 #include "test_base.h"
 #include "test_host.h"
--- a/cdm/test/device_cert.cpp
+++ b/cdm/test/device_cert.cpp
@@ -1,228 +0,0 @@
-// Copyright 2018 Google LLC. All Rights Reserved. This file and proprietary
-// source code may only be used and distributed under the Widevine License
-// Agreement.
-
-#include "device_cert.h"
-
-const uint8_t kDeviceCert[] = {
-    0x0A, 0x9A, 0x14, 0x08, 0x01, 0x10, 0x01, 0x1A, 0x93, 0x14, 0x0A, 0xED,
-    0x09, 0x0A, 0xAE, 0x02, 0x08, 0x02, 0x12, 0x10, 0x7F, 0x6F, 0x31, 0x50,
-    0xB3, 0x73, 0x26, 0x2C, 0xBD, 0xC3, 0xB2, 0xDA, 0xDE, 0x07, 0x5D, 0xBB,
-    0x18, 0xF3, 0xFA, 0xB0, 0xA9, 0x05, 0x22, 0x8E, 0x02, 0x30, 0x82, 0x01,
-    0x0A, 0x02, 0x82, 0x01, 0x01, 0x00, 0xBF, 0xAF, 0x84, 0xAC, 0x9C, 0x2D,
-    0x57, 0x4C, 0xDE, 0x10, 0xB9, 0x94, 0xF0, 0x51, 0x4F, 0xBE, 0xA0, 0x0D,
-    0xDC, 0x7E, 0x44, 0x38, 0x76, 0xD7, 0xB7, 0xBF, 0x0B, 0x7C, 0x1A, 0x7A,
-    0x15, 0x9B, 0x66, 0xD1, 0xE4, 0x67, 0x83, 0xA8, 0xE5, 0xFA, 0x11, 0xE3,
-    0xEA, 0xB8, 0x84, 0xD8, 0x32, 0x9C, 0x8B, 0xA7, 0xCC, 0x60, 0xBE, 0x68,
-    0x7C, 0x13, 0x29, 0xBD, 0xF5, 0x8A, 0x6E, 0xFC, 0x7B, 0xAA, 0x4A, 0x72,
-    0xB8, 0xB2, 0x52, 0xD8, 0xEA, 0x03, 0x87, 0x75, 0xE4, 0xE4, 0x52, 0xD9,
-    0x83, 0x72, 0x7A, 0xA5, 0x9E, 0x0B, 0x27, 0xD8, 0xA1, 0x6A, 0x23, 0xF4,
-    0x59, 0xAB, 0xE8, 0xD5, 0x5B, 0xDD, 0x64, 0xC8, 0xFD, 0x30, 0x28, 0x5B,
-    0x0D, 0x0E, 0xCE, 0x7F, 0x1E, 0x4C, 0xC0, 0x36, 0x17, 0xC5, 0xC1, 0xD0,
-    0x19, 0x0C, 0x5A, 0x71, 0xCA, 0x3B, 0xCA, 0x41, 0xD9, 0x67, 0x36, 0x0A,
-    0x23, 0xA3, 0xDC, 0x9B, 0x86, 0x53, 0xF6, 0xAC, 0x1E, 0xD9, 0x41, 0x34,
-    0x73, 0x04, 0xE1, 0x68, 0x1C, 0x38, 0xA8, 0x2A, 0xE8, 0x0D, 0x88, 0xF9,
-    0xA9, 0xD4, 0x64, 0x4E, 0xFF, 0xF8, 0x94, 0x56, 0x99, 0xDB, 0xA2, 0x6C,
-    0x15, 0xF2, 0xA1, 0x34, 0xF6, 0x51, 0xC0, 0xAB, 0x2A, 0x99, 0xB9, 0xF3,
-    0x3D, 0x2D, 0x13, 0xCD, 0x8B, 0x6B, 0xAD, 0x82, 0x10, 0x73, 0x4E, 0x42,
-    0x61, 0x78, 0x69, 0x2F, 0x19, 0x09, 0x06, 0x65, 0x0F, 0x7E, 0xA9, 0xB1,
-    0xB3, 0xC2, 0x30, 0x86, 0xE9, 0x0B, 0x29, 0xC0, 0xB6, 0x08, 0x73, 0x7C,
-    0x3B, 0xFA, 0x39, 0x5A, 0x5A, 0xB1, 0xD5, 0x6E, 0xFF, 0x85, 0x41, 0xF3,
-    0xBF, 0xE9, 0xD9, 0x45, 0xE6, 0xDD, 0xB1, 0x35, 0x39, 0x56, 0xA5, 0xCE,
-    0xBD, 0x6C, 0xC3, 0xFD, 0xEA, 0x47, 0xE9, 0x65, 0x58, 0x21, 0x62, 0xFF,
-    0x00, 0x9A, 0xFE, 0xD3, 0x5B, 0x15, 0xC2, 0xC9, 0x64, 0x3F, 0x02, 0x03,
-    0x01, 0x00, 0x01, 0x28, 0x99, 0x20, 0x12, 0x80, 0x02, 0x72, 0xAA, 0xE9,
-    0xCD, 0xE2, 0xF8, 0xFC, 0x8B, 0x85, 0x52, 0xFE, 0x30, 0xAD, 0x49, 0x94,
-    0x3F, 0x56, 0x5A, 0x60, 0xFD, 0xDD, 0x2D, 0x79, 0xDA, 0xB4, 0x5F, 0x3A,
-    0x87, 0x10, 0x82, 0x5F, 0x0B, 0xBD, 0x20, 0x17, 0xF1, 0x59, 0xB0, 0x3F,
-    0xDE, 0x24, 0x3A, 0x13, 0x43, 0xBC, 0xC6, 0xBC, 0xC0, 0xFD, 0xEF, 0xCF,
-    0x3B, 0x19, 0xBF, 0x07, 0xD7, 0xD9, 0xF0, 0x1E, 0x1B, 0xDF, 0xF9, 0x35,
-    0x82, 0x69, 0x3F, 0x3F, 0xF3, 0x71, 0x65, 0xB5, 0x86, 0xF8, 0xCB, 0x44,
-    0x2E, 0xEE, 0x80, 0xE3, 0x53, 0x6D, 0xA8, 0x50, 0xDB, 0x87, 0x1A, 0x3B,
-    0x49, 0x78, 0x6E, 0x61, 0x3D, 0x60, 0x61, 0xFD, 0xE8, 0xBE, 0x05, 0x77,
-    0xFF, 0x2B, 0x0F, 0x0D, 0xE4, 0x53, 0x29, 0xB8, 0x55, 0x52, 0x2E, 0x7F,
-    0xA3, 0x54, 0x0F, 0x66, 0x93, 0x4B, 0x17, 0xFB, 0xE1, 0x82, 0x33, 0x59,
-    0x21, 0x9E, 0x44, 0x02, 0x27, 0x4E, 0xEC, 0x86, 0xC4, 0x6C, 0x5E, 0xF9,
-    0xD0, 0x31, 0xDD, 0xFA, 0xB8, 0x5D, 0x05, 0x2E, 0xBC, 0xE9, 0x48, 0xB8,
-    0xC2, 0xF4, 0x15, 0x2C, 0xDF, 0x51, 0x6B, 0x75, 0x62, 0x7D, 0x99, 0x67,
-    0x25, 0x6F, 0x0D, 0xA9, 0x5A, 0x96, 0x01, 0x3D, 0x8F, 0x14, 0x13, 0x36,
-    0x9D, 0x8D, 0x34, 0xF1, 0xEC, 0xFC, 0xFE, 0xEA, 0xBA, 0xAD, 0xFC, 0x7C,
-    0xCE, 0xA3, 0x36, 0x80, 0xFF, 0xB8, 0x9D, 0x60, 0x70, 0x78, 0xE1, 0x42,
-    0x7F, 0xD7, 0x99, 0x61, 0xBB, 0x51, 0x70, 0xC7, 0xE5, 0xA3, 0x74, 0xFA,
-    0x18, 0x02, 0x4B, 0x2A, 0x5D, 0xC4, 0x40, 0x1E, 0x6A, 0x22, 0xA9, 0xC5,
-    0x37, 0xF3, 0xD9, 0x7F, 0x8B, 0x1A, 0xD4, 0x8B, 0x3B, 0x00, 0x78, 0xB3,
-    0xAA, 0x7C, 0x04, 0xBB, 0x96, 0x31, 0x33, 0x65, 0xFA, 0xF2, 0xEB, 0x87,
-    0x2D, 0xF1, 0x8A, 0xFA, 0xEE, 0x7B, 0x1F, 0xD4, 0x67, 0xBD, 0x3F, 0x0F,
-    0x61, 0x1A, 0xB6, 0x05, 0x0A, 0xB0, 0x02, 0x08, 0x01, 0x12, 0x10, 0x08,
-    0x4D, 0x60, 0xBC, 0x65, 0x93, 0x7D, 0xB6, 0xAC, 0x7F, 0x99, 0x2B, 0x41,
-    0xEC, 0xF5, 0xF2, 0x18, 0xA2, 0xD3, 0x8A, 0x8C, 0x05, 0x22, 0x8E, 0x02,
-    0x30, 0x82, 0x01, 0x0A, 0x02, 0x82, 0x01, 0x01, 0x00, 0x99, 0x1B, 0x35,
-    0x7B, 0xB7, 0x14, 0xDE, 0xCA, 0xC1, 0xE7, 0x0E, 0xAA, 0x36, 0xD1, 0xD0,
-    0x83, 0x4D, 0xF2, 0x4A, 0x3D, 0x10, 0x36, 0x9F, 0x90, 0xA2, 0x27, 0x34,
-    0xA3, 0xAD, 0x4A, 0xEB, 0xCC, 0xFC, 0x24, 0x32, 0xBD, 0xD6, 0xDC, 0xD1,
-    0xFF, 0xD7, 0x56, 0x99, 0xBA, 0x56, 0x08, 0xC4, 0x45, 0x79, 0x72, 0xD2,
-    0x7C, 0x47, 0xAB, 0xCF, 0xF8, 0xC8, 0x8C, 0xD9, 0x90, 0x09, 0x38, 0x26,
-    0x0B, 0x8C, 0x85, 0x79, 0x53, 0x27, 0xB2, 0xAE, 0xF3, 0xA1, 0xDB, 0x27,
-    0xE8, 0xB9, 0x62, 0x03, 0x92, 0x84, 0xD6, 0x02, 0xC6, 0xA7, 0x4C, 0x6A,
-    0x14, 0x3A, 0x67, 0xBE, 0x64, 0xA1, 0x6A, 0x1C, 0x8F, 0x44, 0xFA, 0xFA,
-    0xDA, 0xC2, 0x42, 0xCE, 0xB6, 0xD8, 0xAD, 0xE9, 0xC4, 0xD4, 0x54, 0x2E,
-    0xBD, 0x3E, 0xE9, 0xD2, 0xA0, 0xA7, 0x1E, 0xB7, 0xA4, 0xCC, 0xF9, 0x16,
-    0xE0, 0x2F, 0x26, 0x79, 0x3B, 0x0C, 0x13, 0xA4, 0x92, 0x1C, 0x3E, 0xED,
-    0x49, 0xC5, 0xC9, 0x6C, 0xD4, 0x55, 0x59, 0x8E, 0xDE, 0x04, 0x0C, 0xE4,
-    0x72, 0xB0, 0x15, 0xA9, 0xAF, 0x3C, 0xDA, 0x82, 0xC4, 0x97, 0x92, 0xAA,
-    0x7F, 0x6B, 0xBF, 0xBF, 0x46, 0x67, 0x29, 0x3B, 0x44, 0xEC, 0x74, 0x29,
-    0xC3, 0x9A, 0x03, 0x89, 0x11, 0xCE, 0x1F, 0xE4, 0x62, 0xC3, 0x5E, 0x95,
-    0xC2, 0x64, 0xD3, 0x63, 0x34, 0x3C, 0x3A, 0xDB, 0x94, 0x4F, 0xA2, 0xAA,
-    0xBD, 0xBA, 0x0F, 0xB6, 0x1C, 0x40, 0x27, 0x97, 0x58, 0x5F, 0x3D, 0xFB,
-    0x79, 0x6F, 0x6C, 0xE1, 0xDC, 0xF3, 0xB7, 0x9C, 0x98, 0x87, 0xBE, 0x98,
-    0x14, 0x70, 0xEC, 0xBC, 0xB0, 0x48, 0xE5, 0x9E, 0x56, 0x4F, 0xC3, 0xAD,
-    0x2C, 0x4B, 0x86, 0x0F, 0x70, 0xAA, 0x46, 0x8F, 0xB6, 0x6C, 0x4A, 0x28,
-    0x47, 0xEE, 0xC7, 0x55, 0xAD, 0xE8, 0x9B, 0xD6, 0x22, 0x57, 0x40, 0xC9,
-    0xA5, 0x02, 0x03, 0x01, 0x00, 0x01, 0x28, 0x99, 0x20, 0x30, 0x01, 0x12,
-    0x80, 0x03, 0x21, 0x2D, 0xE1, 0x41, 0xC1, 0x30, 0x57, 0xC1, 0x98, 0x72,
-    0x18, 0xDD, 0x7F, 0xBC, 0x2D, 0xC9, 0xF8, 0x4C, 0x82, 0xF9, 0x1F, 0x5B,
-    0x16, 0x3D, 0x03, 0x70, 0xC7, 0x06, 0x93, 0x87, 0xC7, 0x0C, 0x90, 0xC3,
-    0x06, 0x0F, 0x05, 0x04, 0x57, 0x3C, 0x6E, 0x0B, 0xD3, 0xAC, 0xB9, 0x84,
-    0xFC, 0x3A, 0xB7, 0xB2, 0x21, 0xA7, 0x7D, 0x37, 0x33, 0x32, 0x4D, 0x67,
-    0x0A, 0x9A, 0x5E, 0xEA, 0x64, 0x69, 0x1D, 0x56, 0x66, 0xA9, 0xB6, 0x7D,
-    0xD3, 0x67, 0x80, 0x3C, 0xD5, 0x75, 0x3B, 0xD7, 0x5E, 0xA7, 0x23, 0x9B,
-    0xEC, 0x0C, 0x00, 0x82, 0x97, 0x69, 0x57, 0x71, 0xCE, 0x20, 0x3C, 0x60,
-    0x89, 0x8D, 0x4F, 0x26, 0x4A, 0xD5, 0x5D, 0x3D, 0x01, 0xC9, 0x6F, 0x66,
-    0xD6, 0xFB, 0x6C, 0x53, 0xD1, 0x92, 0x8A, 0x60, 0xAD, 0x04, 0x0D, 0x7D,
-    0x48, 0xE9, 0xC8, 0x3D, 0x68, 0x49, 0xC2, 0x48, 0xE4, 0x5C, 0x0F, 0x95,
-    0xBB, 0xB8, 0xCD, 0x0B, 0x1F, 0xEE, 0xE4, 0x45, 0x8C, 0x5C, 0x60, 0xAB,
-    0x0D, 0x52, 0xE1, 0xFB, 0x0F, 0x8E, 0xE9, 0x87, 0x66, 0xAF, 0x9C, 0xF9,
-    0x33, 0x07, 0x57, 0x86, 0x57, 0xE8, 0x00, 0xF1, 0xA4, 0xED, 0x3F, 0x6A,
-    0x00, 0xE8, 0x95, 0x1B, 0x21, 0x58, 0xF4, 0x5C, 0xFC, 0xC2, 0xF7, 0xE5,
-    0xE5, 0xCC, 0x3D, 0x7F, 0x04, 0xEA, 0x2B, 0xE3, 0x4A, 0xA8, 0xDD, 0x49,
-    0xEB, 0xD7, 0x8C, 0x61, 0x8C, 0x14, 0x04, 0xE3, 0x08, 0x25, 0x7E, 0x50,
-    0x2A, 0xAC, 0x8D, 0xF0, 0x0D, 0x52, 0xA8, 0x98, 0x53, 0x01, 0xBF, 0xE5,
-    0xE6, 0xE7, 0x84, 0xD7, 0x7B, 0x0B, 0xC5, 0x2C, 0x93, 0x5A, 0x8B, 0x18,
-    0x3F, 0xB5, 0xAF, 0xED, 0x25, 0xA5, 0x85, 0x5A, 0x77, 0xFC, 0xF2, 0x71,
-    0x5C, 0x90, 0x76, 0x11, 0x62, 0x4A, 0x58, 0xB0, 0x37, 0xD8, 0x19, 0x85,
-    0x7B, 0xAB, 0x92, 0x6B, 0xEE, 0x4D, 0x56, 0x02, 0x77, 0x08, 0x9E, 0xFB,
-    0x07, 0x0F, 0xB3, 0xF5, 0x38, 0x5D, 0x1D, 0xDE, 0x1E, 0x48, 0x6D, 0x8F,
-    0x32, 0xD2, 0x53, 0xDE, 0x86, 0x92, 0xE3, 0x09, 0x8E, 0x35, 0xB3, 0x19,
-    0x26, 0x47, 0xE7, 0x95, 0x44, 0xCF, 0x0F, 0xB2, 0x8B, 0x36, 0x21, 0x33,
-    0xE9, 0x42, 0x97, 0x78, 0x1C, 0xF3, 0xF6, 0x89, 0x60, 0x53, 0x16, 0x67,
-    0xEE, 0x74, 0xE7, 0x02, 0x6B, 0xD7, 0x21, 0x37, 0xEB, 0x1D, 0xDD, 0x05,
-    0x78, 0x34, 0xCF, 0x1D, 0xAB, 0xE8, 0xD7, 0x06, 0x9F, 0x88, 0xAC, 0xB4,
-    0xB7, 0xA4, 0x02, 0x47, 0x0F, 0x28, 0x01, 0x26, 0x4B, 0xB4, 0x9C, 0x3B,
-    0xFE, 0xE2, 0x4F, 0xC6, 0x40, 0xA4, 0x63, 0x74, 0xD6, 0xC1, 0x0B, 0xC7,
-    0xD2, 0xB9, 0x60, 0x79, 0x2D, 0x11, 0xDA, 0x50, 0x86, 0xAB, 0x8C, 0xCF,
-    0xF4, 0x61, 0x80, 0xC2, 0x43, 0xC3, 0x95, 0xD2, 0x2F, 0x1A, 0x9E, 0x4F,
-    0x6B, 0x02, 0x12, 0xA0, 0x0A, 0x92, 0x1C, 0xDD, 0x85, 0x4C, 0xEB, 0x5E,
-    0x8E, 0xF0, 0x48, 0x26, 0x1F, 0xB8, 0x9B, 0xE1, 0x79, 0x96, 0xBF, 0x44,
-    0x0D, 0x88, 0x67, 0xF6, 0x48, 0x65, 0xD8, 0xE5, 0x33, 0x93, 0x05, 0x07,
-    0xAC, 0x0C, 0x0B, 0x60, 0xE5, 0xDB, 0x60, 0xD0, 0x3F, 0x42, 0x58, 0x8E,
-    0x73, 0x9D, 0x91, 0x6F, 0xD7, 0xD3, 0x14, 0x97, 0x75, 0xCA, 0xDC, 0xF2,
-    0xBA, 0x8C, 0x20, 0x13, 0xD8, 0xD2, 0x07, 0x74, 0xAA, 0xC2, 0x07, 0x89,
-    0xFF, 0x95, 0x27, 0x52, 0x63, 0x94, 0xA5, 0xF1, 0xA9, 0x20, 0x61, 0xEE,
-    0x56, 0x81, 0xA0, 0xDD, 0xF7, 0xF0, 0xAF, 0xD6, 0xF3, 0x83, 0x88, 0x9C,
-    0xD2, 0x50, 0xE5, 0x43, 0xB8, 0xD6, 0xF0, 0x93, 0x7D, 0x11, 0x52, 0x82,
-    0xFD, 0xD8, 0xCA, 0xF5, 0xC4, 0xD1, 0xE7, 0x78, 0x1C, 0xEC, 0x5C, 0x34,
-    0x82, 0x8D, 0x82, 0x88, 0xB3, 0x84, 0xBF, 0xCD, 0x82, 0xA5, 0x8D, 0xE7,
-    0xCA, 0xAD, 0x39, 0x9F, 0x98, 0x03, 0xD1, 0x05, 0xE0, 0xA3, 0x0A, 0x88,
-    0xA6, 0x5E, 0xBA, 0x8D, 0xC3, 0xF7, 0xB9, 0x07, 0x75, 0x14, 0x54, 0xE8,
-    0x3A, 0x96, 0x02, 0x94, 0xB5, 0x21, 0x7B, 0xDA, 0x30, 0xE8, 0xC6, 0x25,
-    0x1F, 0xE2, 0x53, 0x1D, 0xDA, 0xE5, 0xE1, 0x2A, 0xDD, 0x74, 0xDE, 0x03,
-    0xDA, 0x73, 0xCB, 0x1D, 0x1B, 0x1F, 0xCA, 0xFE, 0x23, 0x42, 0xFA, 0x47,
-    0x1E, 0xB3, 0x1E, 0x43, 0x55, 0xB4, 0x1B, 0x67, 0x51, 0x3C, 0x20, 0x42,
-    0x36, 0x57, 0xCA, 0x83, 0x5F, 0xD5, 0x1F, 0x7E, 0xC5, 0x80, 0x1E, 0x04,
-    0xCE, 0xD0, 0xDA, 0x72, 0xAF, 0xEA, 0x91, 0x60, 0xC2, 0xC5, 0x4E, 0xA1,
-    0x99, 0x55, 0x93, 0x09, 0xA8, 0x6F, 0xCE, 0x78, 0x71, 0xE1, 0x56, 0x01,
-    0x17, 0x76, 0xA1, 0x37, 0x20, 0x21, 0x42, 0xE9, 0xF5, 0xB7, 0x77, 0xC9,
-    0xF7, 0x18, 0x2A, 0xB4, 0x12, 0xD0, 0x0A, 0x60, 0x14, 0x02, 0x6A, 0xE5,
-    0x63, 0x39, 0x5B, 0xD4, 0xB9, 0xBE, 0xA9, 0x4D, 0x28, 0x86, 0xA3, 0x87,
-    0xB6, 0x91, 0xCF, 0x61, 0xEB, 0x83, 0x0F, 0xE7, 0x4E, 0x42, 0xC2, 0xDC,
-    0xDC, 0xF3, 0x2F, 0x31, 0x78, 0xC7, 0x73, 0x5A, 0xB2, 0x5C, 0x69, 0xDC,
-    0x89, 0x82, 0xDF, 0x2A, 0xEF, 0xC5, 0x36, 0x89, 0x8F, 0xF1, 0x1F, 0x2B,
-    0x8B, 0x56, 0x28, 0x2A, 0x68, 0x34, 0xBE, 0x69, 0x58, 0x89, 0x09, 0x19,
-    0x3D, 0xDE, 0xBC, 0xD3, 0x8F, 0x73, 0x30, 0xAA, 0xA5, 0x5F, 0xDF, 0x65,
-    0x91, 0xC2, 0xC3, 0x70, 0xE5, 0xF8, 0x9D, 0x26, 0x47, 0xBA, 0xAB, 0x90,
-    0x41, 0xD6, 0xE5, 0x84, 0xF7, 0xF8, 0x10, 0x0E, 0x09, 0x75, 0x4D, 0xCC,
-    0x45, 0x8B, 0x9A, 0x58, 0xB3, 0xD4, 0x58, 0xC1, 0x7C, 0x8E, 0x78, 0x11,
-    0xF9, 0x4A, 0xAA, 0xB5, 0xB5, 0x32, 0x04, 0x2E, 0x63, 0x78, 0x5A, 0x0C,
-    0xD0, 0xB2, 0xE7, 0x1F, 0x16, 0xD0, 0xDB, 0x21, 0x3A, 0xC5, 0xEE, 0xBF,
-    0x8F, 0xE8, 0x50, 0xF0, 0x93, 0x9B, 0xAF, 0x7C, 0x95, 0x5A, 0x9F, 0x61,
-    0xB0, 0xFC, 0x98, 0xE8, 0x9D, 0x99, 0xB8, 0xEA, 0x86, 0xDD, 0x4B, 0x84,
-    0x79, 0xD8, 0xEC, 0xCE, 0xE9, 0x66, 0xDC, 0x4F, 0xF8, 0x4E, 0x3D, 0x64,
-    0x28, 0xCB, 0xE0, 0x3E, 0x28, 0x81, 0x11, 0xB6, 0x4D, 0xFE, 0x20, 0x2C,
-    0xF5, 0xC4, 0xD0, 0x5E, 0x12, 0x05, 0x25, 0xEE, 0x6D, 0x81, 0xDE, 0x87,
-    0x5F, 0x45, 0xC8, 0x1B, 0x68, 0x33, 0xE2, 0xC8, 0xF9, 0x13, 0x0F, 0xF4,
-    0x6B, 0xFF, 0x75, 0x02, 0xF7, 0xAC, 0x25, 0xC3, 0xB7, 0x24, 0xC3, 0x88,
-    0xEF, 0xD1, 0xDC, 0xAC, 0xF6, 0x57, 0x5B, 0x4E, 0xC4, 0x74, 0x21, 0x89,
-    0x04, 0x44, 0xCA, 0x11, 0x74, 0xA7, 0xB2, 0x29, 0x43, 0x45, 0x2D, 0xBD,
-    0x2E, 0xB0, 0xA7, 0x81, 0x70, 0x78, 0xD4, 0x7C, 0xE9, 0x22, 0x30, 0x48,
-    0xF2, 0xF0, 0x4B, 0xD4, 0x9F, 0x49, 0x18, 0xF2, 0x82, 0xC9, 0x2C, 0xF0,
-    0xCD, 0xB6, 0x94, 0x86, 0x24, 0x14, 0xBC, 0x3F, 0x07, 0x9A, 0x54, 0x76,
-    0xDE, 0x53, 0x10, 0x2B, 0xAD, 0x54, 0x06, 0xD8, 0xFA, 0xE6, 0x27, 0x49,
-    0x5E, 0xB7, 0x9C, 0x68, 0xAE, 0x3C, 0x1E, 0x66, 0x7E, 0x88, 0xAD, 0xF2,
-    0x2E, 0xAE, 0x5E, 0xDE, 0xAC, 0x89, 0xCE, 0xED, 0x7D, 0x8C, 0x7D, 0x7E,
-    0x68, 0x49, 0x7F, 0x41, 0x79, 0xF4, 0x34, 0x28, 0x1E, 0xCC, 0x83, 0xE1,
-    0xE5, 0xCB, 0x29, 0xCA, 0x41, 0x36, 0xCD, 0x35, 0x84, 0x34, 0x63, 0x15,
-    0xFF, 0x7E, 0x3E, 0xEE, 0x9A, 0x3B, 0x52, 0x16, 0x3B, 0xAF, 0x4B, 0xE7,
-    0x84, 0xF2, 0x5B, 0x0A, 0x9B, 0x9F, 0x35, 0x4D, 0xCE, 0xA6, 0xBE, 0xB4,
-    0xF5, 0xAE, 0xBF, 0xA8, 0x9E, 0xEF, 0xA8, 0x2F, 0x58, 0x22, 0x74, 0xC1,
-    0x02, 0xB4, 0x34, 0x96, 0x57, 0xC4, 0x96, 0x88, 0x24, 0xA1, 0x81, 0xB5,
-    0x33, 0xA6, 0x9E, 0x18, 0x43, 0x3F, 0x35, 0xD3, 0x66, 0x03, 0x53, 0x47,
-    0xF7, 0x4B, 0x10, 0x61, 0x58, 0x06, 0xEE, 0x3B, 0xB1, 0x0F, 0x29, 0x4F,
-    0xFD, 0x62, 0x5C, 0x4B, 0x23, 0x52, 0x4E, 0x16, 0x5A, 0x2E, 0x06, 0x4E,
-    0xCB, 0x00, 0xCA, 0xD6, 0xF1, 0x06, 0x9D, 0x6D, 0x93, 0x72, 0x1D, 0x1D,
-    0x2F, 0x09, 0xBC, 0x66, 0xC6, 0x87, 0xC6, 0xD4, 0xF3, 0xB7, 0xD6, 0xFA,
-    0xFA, 0x67, 0xFD, 0xFF, 0x9A, 0x20, 0x1D, 0x24, 0xF5, 0xCD, 0xC3, 0xD6,
-    0xEC, 0x28, 0xB9, 0x9A, 0x93, 0x67, 0xFF, 0x9E, 0x19, 0x96, 0x70, 0xB9,
-    0x61, 0x26, 0x75, 0x58, 0x29, 0x52, 0x52, 0xDB, 0x75, 0xCC, 0x2E, 0xB2,
-    0x2F, 0xEB, 0x34, 0x7D, 0x83, 0x82, 0x23, 0xA2, 0x61, 0x4F, 0xED, 0x19,
-    0x64, 0xDC, 0xCD, 0x1C, 0x0E, 0xB8, 0x32, 0xF6, 0x5C, 0x68, 0x94, 0xA9,
-    0xDF, 0xBC, 0x23, 0xB4, 0x95, 0x3D, 0x75, 0x18, 0x14, 0xBE, 0xE1, 0x67,
-    0x44, 0xDD, 0x39, 0x7E, 0x10, 0x00, 0xFE, 0x90, 0xF4, 0x56, 0x15, 0x40,
-    0xCF, 0x8E, 0xBC, 0x95, 0xF9, 0x53, 0xA9, 0xD3, 0xFA, 0xB3, 0xCD, 0xF2,
-    0x82, 0xEC, 0xC5, 0xA3, 0xE2, 0xDD, 0xDD, 0xCD, 0xA3, 0xC7, 0x1D, 0x55,
-    0xEA, 0x7B, 0x4E, 0x93, 0xE9, 0xBE, 0x15, 0x34, 0xF2, 0x77, 0xA8, 0x44,
-    0x12, 0x22, 0x81, 0xF0, 0x82, 0xE0, 0x89, 0x71, 0xBE, 0xD3, 0x12, 0x04,
-    0x27, 0xFC, 0xB1, 0xC6, 0x16, 0x7C, 0x3C, 0x6D, 0xA4, 0xD5, 0x6C, 0xBA,
-    0x6B, 0x78, 0x03, 0xA9, 0x77, 0xCB, 0xD6, 0x69, 0xB4, 0x8F, 0xB6, 0xEA,
-    0xE9, 0xAA, 0x54, 0xA6, 0x8A, 0x2B, 0x75, 0x8A, 0x54, 0x3C, 0xE0, 0x24,
-    0xBD, 0x2D, 0xF4, 0xA7, 0x88, 0x84, 0x72, 0x2E, 0x3D, 0x49, 0x01, 0x6E,
-    0xBB, 0x01, 0x4C, 0x0D, 0x17, 0xDB, 0x7F, 0xF0, 0xF7, 0x67, 0x0F, 0xA3,
-    0x2F, 0x75, 0x39, 0x5D, 0x59, 0xEE, 0xD4, 0x0D, 0x12, 0x5A, 0xCA, 0x7A,
-    0x2B, 0xD7, 0xBF, 0x5D, 0xB7, 0xF4, 0xE0, 0x6F, 0x18, 0x29, 0x75, 0x13,
-    0xC7, 0x97, 0x2E, 0xEE, 0xF3, 0x28, 0x3B, 0x13, 0xC1, 0x34, 0x70, 0xA1,
-    0x94, 0x00, 0x5C, 0xA5, 0x5C, 0x41, 0x81, 0xB5, 0xC9, 0x6D, 0xD4, 0xE7,
-    0x1C, 0xC0, 0xC0, 0x4C, 0x23, 0x44, 0x9B, 0xDC, 0x24, 0xCB, 0x72, 0x9D,
-    0xE7, 0xDD, 0x80, 0x34, 0xFD, 0x55, 0xE7, 0xA6, 0xD0, 0x78, 0x3C, 0x0D,
-    0x00, 0x96, 0xC6, 0xBB, 0x33, 0x95, 0x35, 0xD8, 0x8D, 0x78, 0x8B, 0x64,
-    0x76, 0x55, 0x2B, 0xE0, 0x0E, 0xD7, 0x59, 0xC0, 0x21, 0x41, 0xF5, 0x66,
-    0x83, 0x56, 0xF4, 0x56, 0xB2, 0x07, 0x70, 0xE7, 0x71, 0x49, 0x42, 0xF5,
-    0xED, 0x09, 0x30, 0x88, 0x6F, 0xC3, 0x0D, 0x21, 0xD1, 0xF8, 0xC3, 0xD7,
-    0x2C, 0xCE, 0x40, 0x96, 0x5B, 0x30, 0xB3, 0x79, 0xF9, 0x0F, 0x0F, 0x07,
-    0xA7, 0x73, 0xC1, 0x96, 0x0E, 0xD8, 0x3E, 0x2D, 0xF6, 0x04, 0xF4, 0xDE,
-    0x50, 0x50, 0xC8, 0x4F, 0x8A, 0xE2, 0xDC, 0xED, 0x89, 0x5D, 0x2A, 0x07,
-    0xFE, 0xD9, 0x6E, 0xDE, 0xED, 0x2F, 0xDE, 0xC5, 0xE9, 0x18, 0x48, 0xE1,
-    0xAD, 0xC0, 0x27, 0xE7, 0xC5, 0xB2, 0xE8, 0xC8, 0x58, 0x2C, 0x52, 0x23,
-    0x78, 0x1B, 0x9D, 0xC4, 0xA6, 0x01, 0x07, 0xE6, 0xBE, 0xE2, 0x26, 0x17,
-    0x81, 0x5F, 0x49, 0x3A, 0xE6, 0xDB, 0x51, 0xC6, 0x06, 0xD7, 0x2C, 0x36,
-    0x13, 0xB0, 0x2B, 0x04, 0xE4, 0x29, 0xDD, 0xFE, 0x6F, 0x9B, 0xA3, 0xFD,
-    0x68, 0x79, 0x56, 0x24, 0x8A, 0x28, 0x6D, 0x69, 0xD6, 0x54, 0x5C, 0xD7,
-    0xF3, 0x28, 0x45, 0x77, 0x78, 0x27, 0x23, 0x35, 0xCA, 0x68, 0xBB, 0x1A,
-    0x47, 0x41, 0x51, 0x8E, 0x9A, 0x01, 0x49, 0xBD, 0xE8, 0xB6, 0x3A, 0x26,
-    0xFE, 0x4A, 0x43, 0xE5, 0xF7, 0xCB, 0x3B, 0x21, 0xBC, 0xF3, 0xD4, 0xEF,
-    0x38, 0x89, 0x06, 0x0A, 0xA2, 0x3D, 0xA1, 0xF6, 0xEC, 0x84, 0x0E, 0xF4,
-    0xAA, 0x1E, 0xD3, 0x4B, 0x5E, 0x91, 0x6C, 0xD9, 0x83, 0x5F, 0xB3, 0x0B,
-    0x47, 0x3E, 0x85, 0x18, 0xE9, 0x2D, 0x8A, 0x33, 0xAE, 0x34, 0xF6, 0x58,
-    0x54, 0x11, 0xDC, 0xD8, 0xC4, 0x6D, 0x7C, 0xAA, 0x15, 0xCD, 0xCC, 0x17,
-    0x7A, 0xF2, 0x77, 0x57, 0x5F, 0x40, 0xF8, 0x58, 0xF4, 0x96, 0xDF, 0x6E,
-    0xFC, 0xB9, 0x70, 0x17, 0x08, 0x5B, 0x43, 0x29, 0x4D, 0xD4, 0xA7, 0x6C,
-    0xDD, 0x8E, 0xC7, 0xFD, 0x8D, 0xE9, 0xE1, 0xBA, 0x7E, 0xFF, 0x39, 0xE5,
-    0x74, 0x79, 0x5E, 0x9A, 0x29, 0x2F, 0xC3, 0x0D, 0xDD, 0x65, 0x1C, 0x2F,
-    0xBB, 0x3C, 0x50, 0x8F, 0x5B, 0x47, 0x9A, 0x91, 0xEF, 0xC4, 0x0F, 0x7F,
-    0xCD, 0x85, 0xBC, 0x7C, 0x41, 0x9C, 0x96, 0x59, 0x17, 0x9B, 0x95, 0x3E,
-    0x26, 0x41, 0xDD, 0xE5, 0xD1, 0x72, 0x85, 0x10, 0x05, 0x9C, 0xBF, 0x88,
-    0x26, 0x29, 0xBE, 0x96, 0x6C, 0x0C, 0x36, 0x76, 0xE8, 0x06, 0xC5, 0x04,
-    0xD9, 0x06, 0xA8, 0x79, 0xF8, 0xEA, 0xF0, 0x60, 0xAF, 0x12, 0x20, 0xA8,
-    0x98, 0xAD, 0x74, 0xB9, 0x6F, 0x94, 0xCA, 0xCB, 0xDD, 0x9C, 0x4E, 0x62,
-    0xDF, 0xD1, 0x59, 0x3E, 0x58, 0xEE, 0x82, 0xB9, 0xAD, 0x9E, 0xB7, 0x45,
-    0x2C, 0x1F, 0x8C, 0x15, 0x77, 0xCC, 0xD2};
-
-const size_t kDeviceCertSize = sizeof(kDeviceCert);
--- a/cdm/test/device_cert.h
+++ b/cdm/test/device_cert.h
@@ -1,14 +0,0 @@
-// Copyright 2018 Google LLC. All Rights Reserved. This file and proprietary
-// source code may only be used and distributed under the Widevine License
-// Agreement.
-
-#ifndef WVCDM_CDM_TEST_DEVICE_CERT_H_
-#define WVCDM_CDM_TEST_DEVICE_CERT_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-extern const uint8_t kDeviceCert[];
-extern const size_t kDeviceCertSize;
-
-#endif  // WVCDM_CDM_TEST_DEVICE_CERT_H_
--- a/cdm/test/perf_test_xctest.mm
+++ b/cdm/test/perf_test_xctest.mm
@@ -6,7 +6,6 @@
 #import <XCTest/XCTest.h>

 #include "cdm.h"
-#include "device_cert.h"
 #include "perf_test.h"

@interface GtestTests : XCTestCase
@@ -21,8 +20,6 @@
  int argc = 1;
  testing::InitGoogleTest(&argc, argv);

-  std::string cert{kDeviceCert, kDeviceCert + kDeviceCertSize};
-  printf("Size 1: %zu, 2: %zu\n", kDeviceCertSize, cert.size());
  XCTAssertEqual(widevine::PerfTestMain(&widevine::Cdm::initialize, &widevine::Cdm::create, cert), 0);
 }

--- a/cdm/test/test_host.cpp
+++ b/cdm/test/test_host.cpp
@@ -8,7 +8,6 @@
 #include <unordered_set>

 #include "cdm_version.h"
-#include "device_cert.h"
 #include "file_store.h"
 #include "log.h"

@@ -16,20 +15,30 @@ using namespace widevine;

 namespace {

-constexpr char kCertificateFilename[] = "cert.bin";
-
 // Some files are expected to go in global storage. All other files are expected
 // to go in per-origin storage. To help us enforce this in tests, this set
 // tracks the filenames that belong in global storage. TestHost::Storage will
 // reject attempts to access these files via per-origin storage or to access
 // files not in this list via global storage.
 const std::unordered_set<std::string> kGlobalFilenames = {
-    "usgtable.bin",
-    "StoredUsageTime.dat",
-    "GenerationNumber.dat",
-    "persistent.dat",
+    "usgtable.bin",          // CDM usage table data
+    "StoredUsageTime.dat",   // Reference OEMCrypto usage table data
+    "GenerationNumber.dat",  // Reference OEMCrypto master generation number
+    "persistent.dat",        // Persistent data storage for certain TEE
+                             // implementations
+    "keybox.dat",  // Legacy file for storing keybox in non-secure storage.
+    // CDM data for OTA keybox renewal.
    "okp.bin",
-    "keybox.dat",
+    "debug_ignore_keybox_count.txt",
+    "debug_allow_test_keybox.txt",
+    // Widevine L3 data files.
+    "ay64.dat",
+    "ay64.dat2",
+    "ay64.dat3",
+    "ay64.dat4",
+    "ay64.dat5",
+    "ay64.dat6",
+    "l3_failure_file",
    wvutil::kOemCertificateFileName,
 };

@@ -109,10 +118,6 @@ TestHost::Storage::Storage(bool is_global) : is_global_(is_global) { Reset(); }

 void TestHost::Storage::Reset() {
  files_.clear();
-  if (!is_global_) {
-    files_[kCertificateFilename] =
-        std::string((const char*)kDeviceCert, kDeviceCertSize);
-  }
 }

 bool TestHost::Storage::read(const std::string& name, std::string* data) {
--- a/cdm/util.gypi
+++ b/cdm/util.gypi
@@ -4,21 +4,11 @@
 {
  'variables': {
    'wvutil_sources': [
-      '../util/include/advance_iv_ctr.h',
-      '../util/include/arraysize.h',
-      '../util/include/cdm_random.h',
-      '../util/include/clock.h',
-      '../util/include/disallow_copy_and_assign.h',
-      '../util/include/file_store.h',
-      '../util/include/log.h',
-      '../util/include/platform.h',
-      '../util/include/rw_lock.h',
-      '../util/include/string_conversions.h',
-      '../util/include/util_common.h',
      '../util/src/cdm_random.cpp',
      '../util/src/platform.cpp',
      '../util/src/rw_lock.cpp',
      '../util/src/string_conversions.cpp',
+      '../util/src/string_format.cpp',
    ],
  },
 }
--- a/cdm/util_unittests.gypi
+++ b/cdm/util_unittests.gypi
@@ -7,6 +7,7 @@
    '../util/test/cdm_random_unittest.cpp',
    # TODO(b/167126046): Needs test vectors
    # '../util/test/file_store_unittest.cpp',
+    '../util/test/string_format_unittest.cpp',
  ],
  'include_dirs': [
    '../util/include'