Ubisoft DMCA takedown of Slopsmith

Ubisoft DMCA takedown of Slopsmith refers to a Digital Millennium Copyright Act takedown notice that an authorized agent of Ubisoft Entertainment SA filed with GitHub on June 15, 2026 against Slopsmith, an open-source tool that reads and decrypts the encrypted song & note-chart files of Rocksmith 2014.^[1] The notice asserted an anti-circumvention theory under 17 U.S.C. § 1201 over four AES-based protection measures, but GitHub's published notice states it "did not find sufficient information to determine a valid anti-circumvention claim" and instead acted on "other valid copyright claim(s)."^[1] Because the reported network exceeded 100 repositories and Ubisoft alleged that all or most forks infringed equally, GitHub processed the takedown against the entire network of 131 repositories, so users who had forked the project lost their copies.^[1]

The work at issue is "Rocksmith® 2014 Edition - Remastered - Learn & Play" (Steam AppID 221680), which Ubisoft's notice states was first released in October 2013 as Rocksmith 2014 and re-released in its remastered edition in October 2016.^[1] The 2016 Remastered edition shipped on more than one platform. Ubisoft's August 25, 2016 announcement stated it would be available "on Xbox One, PS4, PC, and Mac,"^[2] and the pre-2024 Steam listing carried a macOS system-requirements tab specifying "OS: Mac OS X v10.7."^[3]

Ubisoft removed the one-time-purchase Rocksmith 2014 from sale on October 23, 2023 after its music licensing deals expired.^[4][5] The delisting locked out new buyers and Mac users, but existing owners kept their access. Ubisoft's Rocksmith 2014 Leaving Stores page told players who already owned the game or its downloadable content:

[Y]ou will still be able to install, download, re-download, play, and use those products. You should experience no change or interruption in your access.

^[4]

Ubisoft pointed new players to its subscription service Rocksmith+, which launched on PC on September 6, 2022 at $14.99 per month, $39.99 for three months, & $99.99 for twelve months.^[6] Rocksmith+ has no macOS or Linux client; Ubisoft lists its platforms as "iOS, Android, PC, or PlayStation."^[7] On December 19, 2024 Ubisoft released a "Learn & Play" edition of Rocksmith 2014 whose current Steam page lists Windows as its only operating system.^[5] That Steam page describes the change to the base catalog:

[W]e've replaced all licensed songs with a collection of tracks and exercises from our popular downloadable content bundles.

^[5]

The same Steam page states:

the downloadable songs from the original Rocksmith 2014 Remastered are fully compatible with Learn & Play Edition.

^[5] The licensed base catalog is gone for new buyers; previously purchased DLC still loads. Ubisoft had earlier delisted the original 2011 Rocksmith on October 17, 2021, removing it from sale.^[8]

• 
  The Rocksmith 2014 Steam description states the title was "temporarily removed due to the expiration of our music licensing deals" and that Ubisoft replaced all licensed songs.^[5]
• 
  The current Steam page for Rocksmith 2014 Learn and Play lists "Windows Vista, Windows 8" as the only operating system, with no macOS tab.^[5]

Player-made custom songs for Rocksmith 2014, known as CDLC, are distributed through community hubs such as CustomsForge, whose guidelines require uploaders to confirm:

...that you have acquired the legal rights to the songs in the CDLC that you upload or download.

^[9] A CDLC file is an encrypted archive in the same PSARC format as Rocksmith 2014's own song content.^[1]

The decryption capability Slopsmith reuses is not new. The AES tooling that reads, decrypts, & repacks the PSARC & SNG formats has circulated openly on GitHub since the game's first months. The Rocksmith Custom Song Toolkit, the long-standing community packer for these formats, was created on November 23, 2013, roughly twelve years before Slopsmith.^[10] A Python implementation, rs-utils, followed on February 2, 2014.^[11] The Slopsmith desktop binary bundles a fork of iminashi/Rocksmith2014.NET, an F# library for Rocksmith 2014 first published on July 19, 2020 that carries the same hardcoded keys.^[12][1] Ubisoft's own notice records that the project's profile-import code identifies the EVAS profile key in a comment as the "EVAS profile decryption key (well-known in the Rocksmith community)."^[1]

This was not GitHub's first Rocksmith-related notice. GitHub processed an earlier one in October 2016, before the 2023 delisting and the 2026 Slopsmith filing.^[13]

According to Ubisoft's notice, Slopsmith is an open-source project "designed to operate against the user's installation of Rocksmith 2014."^[1] It opens the game's encrypted .psarc archive containers, decrypts the .sng note-chart files, and converts them "into XML for the highway renderer" that draws the scrolling notes.^[1] The notice also quotes the project's own module docstring, which states a bundled plugin will "Extract Rocksmith 2014 base game songs from songs.psarc into individual CDLC PSARCs."^[1]

The project's archived README describes Slopsmith as "A self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC)," running entirely in Docker with no local dependencies, which is the route by which it runs on Linux.^[14] Beyond the guitar note highway, the README documents a lane-based drum highway with MIDI drum-pad input, a scrolling piano highway for Keys arrangements, per-stem mute and volume controls for separated audio, & a profile importer.^[14] Its split-screen mode places "2-4 highway panels side-by-side for multi-arrangement practice," a local two-to-four-player layout rather than an online one.^[14]

The desktop build adds a tone engine that the README describes this way:

VST3/AU/LV2 plugin hosting, Neural Amp Modeler (NAM) for amp simulation, cabinet IR loading, and automatic tone switching that changes your signal chain as tones change during a song.

^[14] The project is licensed under the GNU Affero General Public License v3.0.^[14]

The README records about 1,000 stars, 99 forks, & 246 commits on the main branch.^[14] Slopsmith launched in April 2026, roughly two months before the June 15, 2026 takedown.^[14][1] It targeted both the PC and Mac builds of Rocksmith 2014: Ubisoft's notice describes a separate AES key for the Mac SNG format and states the tool switches between the PC and Mac keys at runtime.^[1]

The notice named four primary repositories: github.com/byrongamatos/slopsmith, byrongamatos/slopsmith-desktop, byrongamatos/Rocksmith2014.NET, & hestealin/slopsmith.^[1] Ubisoft answered GitHub's licensing question "Is the work licensed under an open source license?" with "No," and stated the requested remedy as "Reported content must be removed."^[1]

Ubisoft described four technological protection measures it applies to Rocksmith 2014, each using a different AES-256 key embedded in the game client (the keys are redacted in the published notice). The first is PSARC archive encryption in CFB mode, which protects the outer container holding audio, note charts, manifests, & artwork. The second is SNG note-chart encryption on the PC build, in CTR mode. The third is the same SNG scheme on the Mac build, keyed differently. The fourth is EVAS profile encryption in ECB mode, which protects player progression & save data.^[1] Ubisoft asserted that all four "effectively control access ... within the meaning of 17 U.S.C. § 1201(a)(3)(B)," and alleged that Slopsmith violated the anti-trafficking provisions at 17 U.S.C. § 1201(a)(2) and § 1201(b)(1).^[1]

Ubisoft flagged that the Slopsmith README had been edited between its audit and the filing to soften direct references to the game, replacing "official Rocksmith DLC" with "official song packs" and "CDLC" with "custom songs."^[1] The notice stated that the README at HEAD on May 25, 2026 still disclosed the underlying conduct and that the plugin module docstrings were unchanged.^[1] For each named repository, Ubisoft confirmed that "The entire repository is infringing" rather than listing individual files.^[1]

GitHub did not limit the takedown to the four primary repositories. The notice records GitHub's reasoning verbatim.

Because the reported network that contained the allegedly infringing content was larger than one hundred (100) repositories, and the submitter alleged that all or most of the forks were infringing to the same extent as the parent repository, GitHub processed the takedown notice against the entire network of 131 repositories, inclusive of the parent repository.

^[1]

The notice itself lists more than 150 individual fork URLs across the /slopsmith and /slopsmith-desktop networks, most of them owned by individual GitHub users.^[1] Under GitHub's policy, a fork is a distinct repository, so users who had clicked "fork" to keep a personal copy received takedown notices when the network was processed. Ubisoft attested that "all or most of the forks are infringing to the same extent as the parent repository."^[1] The notice acted only on the repositories hosted at GitHub; it did not reach copies that users had already cloned or downloaded to their own machines before the June 15, 2026 filing.^[1]

GitHub published the notice with a preamble that separates Ubisoft's anti-circumvention theory from the copyright grounds on which the content was removed.

While GitHub did not find sufficient information to determine a valid anti-circumvention claim, we determined that this takedown notice contains other valid copyright claim(s).

^[1]

GitHub did not act on the 17 U.S.C. § 1201 theory in Ubisoft's notice, and it did not state which "other valid copyright claim(s)" carried the removal.^[1] Before disabling the content, GitHub contacted owners of some or all of the affected repositories to give them a chance to make changes, and provided instructions for submitting a DMCA counter-notice.^[1]

The anti-circumvention provision Ubisoft invoked, 17 U.S.C. § 1201(a)(1)(A), states that "No person shall circumvent a technological measure that effectively controls access to a work protected under this title."^[15]

The statute defines circumventing such a measure at § 1201(a)(3)(A) as "to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner."^[15] Separate provisions at § 1201(a)(2) and § 1201(b)(1), the two Ubisoft cited, prohibit trafficking in any technology that is "primarily designed or produced for the purpose of circumventing" such measures.^[15]

Section 1201 also directs the Librarian of Congress, on the recommendation of the Copyright Office, to grant temporary exemptions every three years for classes of works where the prohibition harms non-infringing uses.^[15] The most recent triennial exemptions were issued in October 2024.^[16] In the same proceeding, the Copyright Office kept the video game preservation exemption limited to on-premises access at libraries, archives, and museums and declined to extend it off-premises; opponents including the Entertainment Software Association argued that "there remains a substantial market for classic games," including re-releases and subscription services.^[17]

• 
  In the 2024 Section 1201 rulemaking, the Entertainment Software Association argued there is "a substantial market for classic games," including re-releases and subscription services, opposing an off-premises preservation exemption.^[17]
• 
  The Copyright Office's 2024 recommendation declined to extend video game preservation off-premises, citing the risk that preserved games "would also be used for recreational purposes."^[17]

• Ubisoft
• Rocksmith
• Digital Millennium Copyright Act
• GitHub