Fix Widevine DRM sandbox access

[rakonkido]

Summary

Enable Zypak's Widevine handling and provide Cobalt with the Edge profile directory.

Problem

Netflix failed with error D7702-1003 even though edge://components reported that the Widevine Content Decryption Module was installed. Edge logged the following error when loading the downloaded CDM:

libwidevinecdm.so: cannot open shared object file: Operation not permitted

Granting broader Flatpak filesystem access did not resolve the error. Running Edge with Chromium's --no-sandbox option did, which isolated the failure to the Chromium/Zypak sandbox rather than the outer Flatpak filesystem sandbox.

Widevine components downloaded at runtime are stored under the browser profile directory. Zypak must explicitly expose this directory to Chromium's sandbox. Cobalt uses ConfigDir to locate the profile and, when ExposeWidevine is enabled, configures Zypak to expose its WidevineCdm directory.

For the stable Edge package, the profile directory is $XDG_CONFIG_HOME/microsoft-edge.

This follows the same Cobalt/Zypak configuration used to fix DRM handling in the Opera Flatpak: flathub/com.opera.Opera#127.

Testing

The equivalent change was built and tested locally from the repository's beta branch on SteamOS. The beta-specific profile directory, microsoft-edge-beta, was used for that build.

Testing included:

1. Building and installing the Flatpak with Zypak enabled.
2. Verifying the installed cobalt.ini contained the expected ConfigDir and ExposeWidevine=true settings.
3. Clearing the existing Widevine component state.
4. Launching Edge normally, without --no-sandbox.
5. Playing DRM-protected Netflix content successfully.
6. Closing Edge completely and repeating playback after reopening it, preserving the downloaded Widevine state.
7. Checking terminal output for widevine, cdm, and Operation not permitted.

Playback succeeded both before and after restarting Edge. The Chromium/Zypak sandbox remained enabled, and the previous libwidevinecdm.so permission error did not recur.

[flathubbot]

🚧 Test build enqueued.

[flathubbot]

🚧 Started test build.

[flathubbot]

✅ Test build succeeded. To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/309735/com.microsoft.Edge.flatpakref

Built for x86_64 architecture.

[rakonkido]

Test results from the above build:

• Netflix playback succeeded with Chromium/Zypak sandboxing enabled.
• Playback succeeded again after fully restarting Edge.
• Downloaded Widevine 4.10.3050.1 was loaded from the expected stable profile directory.
• Neither log contains widevine, cdm, or Operation not permitted errors.
• No --no-sandbox workaround was used.

[evan-a-a]

Zypak is not enabled for Edge in this configuration, so this is likely not the solution to the playback issue.

[rakonkido]

@evan-a-a What do you mean by that? I ran the following to check if the current stable (unpatched) release is using Zypak:

(deck@steamdeck com.microsoft.Edge)$ flatpak run --system --env=G_MESSAGES_DEBUG=cobalt com.microsoft.Edge//stable --version
(cobalt:2): cobalt-DEBUG: 10:05:08.898: Loading config file '/app/etc/cobalt.ini'
(cobalt:2): cobalt-DEBUG: 10:05:08.900: Inferred application name 'edge'
(cobalt:2): cobalt-DEBUG: 10:05:08.901: Exec= line is: /app/bin/edge %U
(cobalt:2): cobalt-DEBUG: 10:05:08.901: Zypak is available
(cobalt:2): cobalt-DEBUG: 10:05:08.901: Flextop is available
(cobalt:2): cobalt-DEBUG: 10:05:08.901: Inferred sandbox filename 'msedge-sandbox'
(cobalt:2): cobalt-DEBUG: 10:05:08.901: expose-pids is available
(cobalt:2): cobalt-DEBUG: 10:05:08.906: Flags file '/home/deck/.var/app/com.microsoft.Edge/config/edge-flags.conf' not found
(cobalt:2): cobalt-DEBUG: 10:05:08.907: Flatpak version: 1.16.6
(cobalt:2): cobalt-DEBUG: 10:05:08.907: Flatpak version is >= 1.11.1, shared /tmp is available
(cobalt:2): cobalt-DEBUG: 10:05:08.907: setenv: TMPDIR=/tmp
(cobalt:2): cobalt-DEBUG: 10:05:08.907: setenv: LIBGL_DRIVERS_PATH=/usr/lib/x86_64-linux-gnu/GL/lib/dri
(cobalt:2): cobalt-DEBUG: 10:05:08.907: setenv: VK_DRIVER_FILES=/usr/lib/x86_64-linux-gnu/GL/vulkan/icd.d
(cobalt:2): cobalt-DEBUG: 10:05:08.907: setenv: XCURSOR_PATH=~/.icons:/app/share/icons:/usr/share/icons:/usr/share/pixmaps:/usr/share/runtime/share/icons:/run/host/user-share/icons:/run/host/share/icons
(cobalt:2): cobalt-DEBUG: 10:05:08.907: setenv: CHROME_DESKTOP=com.microsoft.Edge.desktop
(cobalt:2): cobalt-DEBUG: 10:05:08.907: setenv: CHROME_WRAPPER=/app/bin/edge
(cobalt:2): cobalt-DEBUG: 10:05:08.907: setenv: ZYPAK_SANDBOX_FILENAME=msedge-sandbox
(cobalt:2): cobalt-DEBUG: 10:05:08.907: setenv: ZYPAK_SPAWN_LATEST_ON_REEXEC=1
(cobalt:2): cobalt-DEBUG: 10:05:08.907: Arg: 'zypak-wrapper.sh'
(cobalt:2): cobalt-DEBUG: 10:05:08.907: Arg: '/app/extra/msedge'
(cobalt:2): cobalt-DEBUG: 10:05:08.907: Arg: '--enable-features=WebRTCPipeWireCapturer'
(cobalt:2): cobalt-DEBUG: 10:05:08.907: Arg: '--disable-features=WebAssemblyTrapHandler,DesktopPWAsRunOnOsLogin'
(cobalt:2): cobalt-DEBUG: 10:05:08.907: Arg: '--version'
Microsoft Edge 151.0.4129.78

I see zypak-wrapper.sh as the initial argument, suggesting that Cobalt automatically selected it as its backend. This is consistent with Cobalt's documentation:

[Zypak]
# If true, then zypak-wrapper.sh will be prepended to the command. If omitted,
# it will be set to 'true' of zypak-wrapper.sh is present in the Flatpak.
Enabled=true

The zypak wrapper is indeed installed by the Edge manifest:

com.microsoft.Edge/com.microsoft.Edge.yaml

Line 106 in 9796a2d

- name: zypak