Skip to content

bookdl: yt-dlp for DRM-free ebooks (0.72.0) - #209

Merged
ralyodio merged 1 commit into
masterfrom
feat/bookdl
Oct 26, 2026
Merged

ralyodio merged 1 commit into
masterfrom
feat/bookdl

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

New command bookdl: download the ebooks you are allowed to keep as files.

  • bookdl <url>...: Project Gutenberg, Standard Ebooks, archive.org open items, a Humble order (downloads?key=), or any direct DRM-free link (Leanpub, Gumroad, itch.io, Google Play Export, Kobo DRM-free)
  • bookdl info, bookdl search <query> (Gutenberg), bookdl humble [list|get], bookdl check <file>
  • Library: Author - Title.ext in ~/Books, download archive so reruns only fetch what is new, -f preference order, --all-formats, --calibre
  • Humble session cookie lives in the credential store as humble / HUMBLE_SESSION

DRM: every file is checked after download (ADEPT, LCP, Mobipocket, KFX, .acsm, PDF EBX/APS; font obfuscation passes) and refused with exit 3. Nothing removes DRM. Kindle/Apple/Google Play/Kobo store links get an explanation of what each store does let you export.

Tested: 17 new unit tests (hand-built zip/PDF/MOBI fixtures for DRM detection); live downloads from Gutenberg, Standard Ebooks and archive.org; Kindle link and archive.org lending item refused with exit 3; rerun skipped via the archive. Humble is covered by fixture tests only (no session on this box). The proxy and dev2-deploy test failures exist on master too.

🤖 Generated with Claude Code

bookdl <url>, info, search, humble [list|get], check. Sources: Project
Gutenberg (gutendex metadata, fallback URLs), Standard Ebooks (?source=download,
the bare link is a thank-you page), Internet Archive open items (lending-library
items and LCP/ACS copies refused), Humble Bundle library via the
_simpleauth_sess cookie (HUMBLE_SESSION in the credential store, md5 checked),
and any direct DRM-free link.

Library: "Author - Title.ext" in ~/Books ($BOOKDL_DIR, --to), a yt-dlp style
download archive so reruns fetch only what is new, -f preference order,
--all-formats, --calibre.

Every file is checked for DRM after download (ADEPT, LCP, Mobipocket, KFX,
.acsm, PDF EBX/APS; EPUB font obfuscation passes) and refused with exit 3, never
removed. Kindle/Apple/Google Play/Kobo store links get what that store does
allow instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio
ralyodio merged commit c6179bd into master Oct 26, 2026
5 checks passed
@ralyodio
ralyodio deleted the feat/bookdl branch October 26, 2026 11:04
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

41 finding(s)

HIGH/CRITICAL: 15 | MEDIUM: 12 | LOW: 14

Severity Rule Location
HIGH py-ssrf-outbound-request dev2/dev2-site:151
HIGH py-ssrf-outbound-request dev2/dev2-site:1060
HIGH py-ssrf-outbound-request dev2/dev2-site:1798
HIGH sh-remote-script-execution root-ubuntu.sh:3262
HIGH sh-remote-script-execution root-ubuntu.sh:3263
HIGH sh-remote-script-execution root-ubuntu.sh:5168
HIGH sh-remote-script-execution root-ubuntu.sh:5172
HIGH sh-remote-script-execution root-w3bs-os.sh:3639
HIGH sh-remote-script-execution root-w3bs-os.sh:3640
HIGH sh-remote-script-execution root-w3bs-os.sh:5569
HIGH sh-remote-script-execution root-w3bs-os.sh:5579
HIGH sh-remote-script-execution root-w3bs-os.sh:5586
HIGH sh-remote-script-execution root-w3bs-os.sh:5602
HIGH sh-remote-script-execution root-w3bs-os.sh:5607
HIGH sh-plaintext-download root-w3bs-os.sh:6289
MEDIUM sql-template-interpolation dev2/dev2-site:1287
MEDIUM sql-template-interpolation dev2/dev2-site:1364
MEDIUM sh-remote-script-execution root-ubuntu.sh:5376
MEDIUM redos-nested-quantifier src/domain-free.ts:56
MEDIUM redos-nested-quantifier src/emoji.ts:167
MEDIUM redos-nested-quantifier src/icon.ts:166
MEDIUM redos-nested-quantifier src/mail.ts:1047
MEDIUM sql-template-interpolation src/users-dump.ts:487
MEDIUM sql-string-concatenation src/users-dump.ts:507
MEDIUM sql-template-interpolation src/users-dump.ts:540
MEDIUM sql-string-concatenation src/users-dump.ts:574
MEDIUM redos-nested-quantifier src/wcag.ts:556
LOW secret-generic-credential src/credentials.ts:36
LOW secret-generic-credential src/credentials.ts:53
LOW secret-generic-credential src/credentials.ts:56
LOW secret-generic-credential src/credentials.ts:61
LOW secret-generic-credential src/user-export.ts:689
LOW secret-generic-credential src/user-export.ts:695
LOW secret-generic-api-key test/credentials.test.ts:208
LOW secret-generic-credential test/mail.test.ts:141
LOW secret-generic-credential test/proxy.test.ts:69
LOW secret-generic-credential test/proxy.test.ts:85
LOW secret-generic-credential test/shorten.test.ts:36
LOW secret-database-url test/users-dump.test.ts:108
LOW secret-database-url test/users-dump.test.ts:119
LOW secret-database-url test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant