Dockerized DCP & IMF OSS Binaries

Jack Watts | Oct 1, 2023 min read

A free dockerized instance of common DCP and IMF open source tools. Contains compiled binaries from CineCert’s asdcplib, openjpeg and more. Freely mount your own storage and either EXEC or SSH into your scalable container.

The DCP & IMF OSS Binaries image runs a rocky linux 9 OS holding the following binaries from ASDCP, OpenJpeg and Trench.

  • as-02-info
  • as-02-unwrap
  • as-02-wrap
  • asdcp-wrap
  • asdcp-unwrap
  • asdcp-util
  • asdcp-info
  • asdcp-test
  • blackwave
  • j2c-test
  • klvsplit
  • klvwalk
  • kmfilegen
  • kmuuidgen
  • opj_compress
  • opj_decompress
  • opj_dump
  • phdr-wrap
  • phdr-unwrap
  • pinkwave
  • trd-cplread
  • trd-digest
  • trd-kdm-decrypt
  • wavesplit

Installation & Usage

Pull the image from docker hub

$ docker pull trenchdigital/dcp-imf-oss-binaries:1.0

The following runs the docker image with port 22 open for SSH connection

$ docker run -it -d -p 22:22 -v host-filepath:container-mount-path --name dcp-imf-oss-binaires trenchdigital/dcp-imf-oss-binaries:1.0

Note: be sure to substitute flag -v value host-filepath:container-mount-path with your own paths. This could be your asset registry or equivalent DCP or IMF store.

To access the container via a BASH terminal running as user oss from the host perform the following.

$ docker exec -it --user oss dcp-imf-oss-binaires /bin/bash


Common asdcp expressions can be found here


For OpenJpeg please see the following post



  trd-randgen will generate random numbers of a given byte length.
  When the command is invoked, the program will generate a UUID of varying Type
  as per IETF RFC 4122;

  trd-randgen [flags]
  trd-randgen [command]

Available Commands:
  c4          Generate a C4ID
  help        Help about any command
  uuid        Generate an RFC4122 compliant UUID

      --b64        Generate a base64 string based on --size value
  -h, --help       help for trd-randgen
      --size int   Number of random bytes generated (default 16)
  -v, --version    version for trd-randgen

Use "trd-randgen [command] --help" for more information about a command.


$ trd-randgen uuid --c 10 --t4 # will return 10 T4 uuids

$ trd-randgen uuid --t3  <path-to-file> # will return a T3 uuid

$ trd-randgen c4 <path-to-file> # will return a C4ID

$ trd-randgen --size 16 # will return 16 bytes of data


  trd-digest will calculate and return the SHA-1, SHA-256, SHA-512
  or MD5 message digest of a given file or group of files. Each
  returned digest is printed to standard outpcb trd-digest has an
  optional flag which implements base64 encoding as specified 
  by RFC 4648. It is intended to be used in the creation and assessment
  of DCinema and IMF assets.

  trd-digest [command]

Available Commands:
  help        Help about any command
  sha1        Calculate a SHA1 digest
  sha256      Calculate a SHA256 digest
  sha512      Calculate a SHA512 digest

  -b, --b64       return base64 encoded digest
  -h, --help      help for trd-digest
  -v, --version   version for trd-digest

Use "trd-digest [command] --help" for more information about a command.


$ trd-digest sha1 --b64 <path-to-file>


trd-cplread, D-Cinema CPL Parser. Written by Jack Watts for the SMPTE DCP Virtual Course

Usage: $ trd-cplread [-p] [-j] <path-to-cpl-file>


$ trd-cplread -j <path-to-cpl-file> # returns a CPL file as a JSON object


trd-kdm-decrypt, Dcrypt a D-Cinema KDM with a given Private Key. Written by Jack Watts.

$ trd-kdm-decrypt [-j] -kdm <kdm-file.xml> -key <priv-key.pem>

Decrypt D-Cinema ciphertext payloads with a given KDM and target x.509 certificate's private key. Plaintext representation  will be returned to stdout by default or as JSON if the relevant  option is toggled.

-k, -kdm                 - The path to a ST 430-1 KDM XML file (*.xml).
-p, -priv-key,           - The path to the target x.509 certificate's private key (*.pem).
-j, -json                - Returns a JSON representation of the decrypted values to stdout.

-h, -help                - Returns this 'help' dialogue.

Go implemenation (c) 2019 Jack Watts


# return decrypted cipher payloads as a slice of JSON ogjects
$ trd-kdm-decrypt -j -k <path-to-kdm-file> -p <path-to-private-key>