Installing Widevine on Chromium on GNU/Linux

Or: How to get Spotify/Netflix working on Chromium in Linux

Most distributions' package managers come with Chromium but without Widevine, a proprietary binary blob required for DRM protected content (e.g., Netflix or Spotify). Normally your only option to access DRM-protected content would be to use Google Chrome or Mozilla Firefox, but here are some alternate ways you can keep using stock Chromium.

Instructions are for Debian GNU/Linux amd64; should work for other Debian-based distros like Ubuntu.

(easiest) Install Google Chrome and use its Widevine distribution

Install Google Chrome stable (beta or unstable won't work)

Skip this if you already have it.

$ wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
$ echo 'deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main' | sudo tee /etc/apt/sources.list.d/google-chrome.list
$ sudo apt update && sudo apt install -y google-chrome-stable

Run script

The following script symlinks Google Chrome's Widevine library to Chromium's directory.

Paste this into your terminal:

git clone https://github.com/proprietary/chromium-widevine.git && \
    cd chromium-widevine && \
    ./use-from-google-chrome.sh

Test Widevine

Paste into terminal (warning: restarts Chromium):

killall -q -SIGTERM chromium-browser || \
    killall -q -SIGTERM chromium && \
    exec $(command -v chromium-browser || command -v chromium) ./test-widevine.html &

…Or manually:

Restart Chromium. If it was already open, then go to chrome://restart.
Make sure Protected Content is enabled in settings: chrome://settings/content/protectedContent.
Open test-widevine.html from this cloned repo in Chromium.

…Alternatively, visit Netflix, Spotify, or $DEGENERATE_DRM_CONTENT_PROVIDER to see if it works directly.

Limitations

Some streaming sites refuse to run at all on Linux because the kernel does not provide access to chipset-level fencing of DRM decryption as provided by Microsoft and Apple systems.
These scripts assume a standard instlalation from Debian/Ubuntu packages. If you installed Google Chrome or Chromium manually, you might have to edit the scripts.
Because we are installing files directly to /usr (as opposed to the more appropriate /usr/local), and we have to for Chromium to find Widevine, on system upgrades your package manager might clobber these files, and you will have to redo these steps.
These instructions only work for amd64 (64-bit x86_64) on GNU/Linux. For alternate architectures like ARM or i386 (32-bit x86), please fork this and submit a pull request.

(alternative) Install Widevine alone without Google Chrome

Paste this into your shell:

git clone https://github.com/proprietary/chromium-widevine.git && \
    cd chromium-widevine && \
    ./use-standalone-widevine.sh && \
    killall -q -SIGTERM chromium-browser || \
    killall -q -SIGTERM chromium && \
    exec $(command -v chromium-browser || command -v chromium) ./test-widevine.html &

The first method using Google Chrome just copied one directory from its installation. Observe the Widevine directory in the Google Chrome distribution:

/opt/google/chrome/WidevineCdm
├── LICENSE
├── manifest.json
└── _platform_specific
    └── linux_x64
            └── libwidevinecdm.so

We don't actually need the whole Google Chrome installation. We can recreate that tree in the Chromium directory (i.e., /usr/lib/chromium) with a standalone distribution of the Widevine shared library. Copying just libwidevinecdm.so into /usr/lib/chromium doesn't work.

N.B. Disadvantage of this method: You might have to manually re-run this script whenever Chromium updates to get the latest Widevine. The first method piggybacks Google Chrome's distribution which is assumed to be up-to-date and updated by the same package manager that updates Chromium. Use that method unless you really don't want Google Chrome on your system.

proprietary / chromium-widevine

readme