4 files changed, 87 insertions, 12 deletions

diff --git a/src/lib/film.cc b/src/lib/film.cc
index 2ff02d799..426c7f81d 100644
--- a/src/lib/film.cc
+++ b/src/lib/film.cc
@@ -1259,7 +1259,7 @@ Film::frame_size () const
 }
 
 /** @param recipient KDM recipient certificate.
- *  @param trusted_devices Certificates of other trusted devices (can be empty).
+ *  @param trusted_devices Certificate thumbprints of other trusted devices (can be empty).
  *  @param cpl_file CPL filename.
  *  @param from KDM from time expressed as a local time with an offset from UTC.
  *  @param until KDM to time expressed as a local time with an offset from UTC.
@@ -1271,7 +1271,7 @@ Film::frame_size () const
 dcp::EncryptedKDM
 Film::make_kdm (
 	dcp::Certificate recipient,
-	vector<dcp::Certificate> trusted_devices,
+	vector<string> trusted_devices,
 	boost::filesystem::path cpl_file,
 	dcp::LocalTime from,
 	dcp::LocalTime until,
@@ -1357,7 +1357,7 @@ Film::make_kdms (
 		if (i->recipient) {
 			dcp::EncryptedKDM const kdm = make_kdm (
 				i->recipient.get(),
-				i->trusted_devices,
+				i->trusted_device_thumbprints(),
 				cpl_file,
 				dcp::LocalTime (from, i->cinema->utc_offset_hour(), i->cinema->utc_offset_minute()),
 				dcp::LocalTime (until, i->cinema->utc_offset_hour(), i->cinema->utc_offset_minute()),
diff --git a/src/lib/film.h b/src/lib/film.h
index d251c7fcc..4656da9de 100644
--- a/src/lib/film.h
+++ b/src/lib/film.h
@@ -130,7 +130,7 @@ public:
 
 	dcp::EncryptedKDM make_kdm (
 		dcp::Certificate recipient,
-		std::vector<dcp::Certificate> trusted_devices,
+		std::vector<std::string> trusted_devices,
 		boost::filesystem::path cpl_file,
 		dcp::LocalTime from,
 		dcp::LocalTime until,
diff --git a/src/lib/screen.cc b/src/lib/screen.cc
index fe8369cb8..5ec00f9c1 100644
--- a/src/lib/screen.cc
+++ b/src/lib/screen.cc
@@ -21,6 +21,10 @@
 #include "screen.h"
 #include <libxml++/libxml++.h>
 #include <boost/foreach.hpp>
+#include <boost/algorithm/string.hpp>
+
+using std::string;
+using std::vector;
 
 Screen::Screen (cxml::ConstNodePtr node)
 	: name (node->string_child("Name"))
@@ -33,7 +37,11 @@ Screen::Screen (cxml::ConstNodePtr node)
 	}
 
 	BOOST_FOREACH (cxml::ConstNodePtr i, node->node_children ("TrustedDevice")) {
-		trusted_devices.push_back (dcp::Certificate (i->content ()));
+		if (boost::algorithm::starts_with(i->content(), "-----BEGIN CERTIFICATE-----")) {
+			trusted_devices.push_back (TrustedDevice(dcp::Certificate(i->content())));
+		} else {
+			trusted_devices.push_back (TrustedDevice(i->content()));
+		}
 	}
 }
 
@@ -47,7 +55,49 @@ Screen::as_xml (xmlpp::Element* parent) const
 
 	parent->add_child("Notes")->add_child_text (notes);
 
-	BOOST_FOREACH (dcp::Certificate const & i, trusted_devices) {
-		parent->add_child("TrustedDevice")->add_child_text (i.certificate (true));
+	BOOST_FOREACH (TrustedDevice i, trusted_devices) {
+		parent->add_child("TrustedDevice")->add_child_text(i.as_string());
+	}
+}
+
+vector<string>
+Screen::trusted_device_thumbprints () const
+{
+	vector<string> t;
+	BOOST_FOREACH (TrustedDevice i, trusted_devices) {
+		t.push_back (i.thumbprint());
 	}
+	return t;
+}
+
+TrustedDevice::TrustedDevice (string thumbprint)
+	: _thumbprint (thumbprint)
+{
+
+}
+
+TrustedDevice::TrustedDevice (dcp::Certificate certificate)
+	: _certificate (certificate)
+{
+
+}
+
+string
+TrustedDevice::as_string () const
+{
+	if (_certificate) {
+		return _certificate->certificate(true);
+	}
+
+	return *_thumbprint;
+}
+
+string
+TrustedDevice::thumbprint () const
+{
+	if (_certificate) {
+		return _certificate->thumbprint ();
+	}
+
+	return *_thumbprint;
 }
diff --git a/src/lib/screen.h b/src/lib/screen.h
index 5e8f1f975..eff2e5ffe 100644
--- a/src/lib/screen.h
+++ b/src/lib/screen.h
@@ -1,5 +1,5 @@
 /*
-    Copyright (C) 2013-2016 Carl Hetherington <cth@carlh.net>
+    Copyright (C) 2013-2018 Carl Hetherington <cth@carlh.net>
 
     This file is part of DCP-o-matic.
 
@@ -18,6 +18,9 @@
 
 */
 
+#ifndef DCPOMATIC_SCREEN_H
+#define DCPOMATIC_SCREEN_H
+
 #include <dcp/certificate.h>
 #include <libcxml/cxml.h>
 #include <boost/optional.hpp>
@@ -25,16 +28,35 @@
 
 class Cinema;
 
+class TrustedDevice
+{
+public:
+	explicit TrustedDevice (std::string);
+	explicit TrustedDevice (dcp::Certificate);
+
+	boost::optional<dcp::Certificate> certificate () const {
+		return _certificate;
+	}
+
+	std::string thumbprint () const;
+	std::string as_string () const;
+
+private:
+	boost::optional<dcp::Certificate> _certificate;
+	boost::optional<std::string> _thumbprint;
+};
+
 /** @class Screen
  *  @brief A representation of a Screen for KDM generation.
  *
- *  This is the name of the screen and the certificate of its
- *  `recipient' (i.e. the servers).
+ *  This is the name of the screen, the certificate of its
+ *  `recipient' (i.e. the mediablock) and the certificates/thumbprints
+ *  of any trusted devices.
  */
 class Screen
 {
 public:
-	Screen (std::string const & n, boost::optional<dcp::Certificate> rec, std::vector<dcp::Certificate> td)
+	Screen (std::string const & n, boost::optional<dcp::Certificate> rec, std::vector<TrustedDevice> td)
 		: name (n)
 		, recipient (rec)
 		, trusted_devices (td)
@@ -43,10 +65,13 @@ public:
 	explicit Screen (cxml::ConstNodePtr);
 
 	void as_xml (xmlpp::Element *) const;
+	std::vector<std::string> trusted_device_thumbprints () const;
 
 	boost::shared_ptr<Cinema> cinema;
 	std::string name;
 	std::string notes;
 	boost::optional<dcp::Certificate> recipient;
-	std::vector<dcp::Certificate> trusted_devices;
+	std::vector<TrustedDevice> trusted_devices;
 };
+
+#endif