Setting up codespaces with private Devops Artifacts repo

devcontainer feature の構成と、issue に示されている Azure Artifacts Credential Provider の出力から始めます。不足している libsecret 依存関係と認証フローを調査します。完了の条件は、dotnet restore で永続化エラーや認証情報エラーを発生させずに、非公開の Azure DevOps フィードからパッケージを取得できることです。

I'm unsuccessfully trying to setup my codespaces to use a private artifacts repo hosted on Azure Devops.

• The base image for the devcontainer used is mcr.microsoft.com/devcontainers/dotnet:1-8.0
• I've added the ghcr.io/microsoft/codespace-features/artifacts-helper:latest to the features list of the devcontainer.

Assuming my understanding is correct this should install the Azure Devops Codespaces Authentication extension and the Azure Artifacts Credential Provider nuget credentials plugin which should enable us to fetch the nuget packages.

This is installed as expected and the ~/azure-auth-helper get-access-token will returns a token as expected, the dotnet restore still fails with

warning : [CredentialProvider]Warning: Cannot persist Microsoft authentication token cache securely!

Verbose output will show

[CredentialProvider]Handling 'Request' 'GetAuthenticationCredentials'. Time elapsed in ms: 0 - Payload: {"Uri":"https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json","IsRetry":false,"IsNonInteractive":true,"CanShowDialog":false}
[CredentialProvider]Creating a progress reporter with interval: 00:00:02
[CredentialProvider]Handling auth request, Uri: https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json, IsRetry: False, IsNonInteractive: True, CanShowDialog: False
[CredentialProvider]URI: https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json
[CredentialProvider]VstsBuildTaskServiceEndpointCredentialProvider - This credential provider must be run under the Team Build tasks for NuGet with external endpoint credentials. Appropriate environment variable needs to be set.
[CredentialProvider]Skipping NuGetCredentialProvider.CredentialProviders.VstsBuildTaskServiceEndpoint.VstsBuildTaskServiceEndpointCredentialProvider, cannot provide credentials for https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json
[CredentialProvider]VstsBuildTaskCredentialProvider - This credential provider must be run under the Team Build tasks for NuGet. Appropriate environment variables must be set.
[CredentialProvider]Skipping NuGetCredentialProvider.CredentialProviders.VstsBuildTask.VstsBuildTaskCredentialProvider, cannot provide credentials for https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json
[CredentialProvider]VstsCredentialProvider - Matched well-known Azure DevOps Service hostname: pkgs.dev.azure.com
[CredentialProvider]Using NuGetCredentialProvider.CredentialProviders.Vsts.VstsCredentialProvider to try to get credentials for https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json.
[CredentialProvider]IsRetry: False
[CredentialProvider]Could not find cached SessionToken for https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json
[CredentialProvider]Found AAD Authority from 401 headers: https://login.windows.net/xxx
[CredentialProvider]VstsCredentialProvider - Using Entra authority: https://login.windows.net/xxx
[CredentialProvider]VstsCredentialProvider - Not running bearer token provider 'MSAL Service Principal'
[CredentialProvider]VstsCredentialProvider - Not running bearer token provider 'MSAL Managed Identity'
[CredentialProvider]VstsCredentialProvider - Attempting to acquire bearer token using provider 'MSAL Silent'
[CredentialProvider]MSAL Log (Always): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z] [Internal cache] Clearing user token cache accessor.
[CredentialProvider]MSAL Log (Always): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z] [Internal cache] Total number of cache partitions found while getting refresh tokens: 0
[CredentialProvider]MSAL Log (Info): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z - 78391143-6cee-437c-b3dd-aefa95bef200] IsLegacyAdalCacheEnabled: yes
[CredentialProvider]MSAL Log (Info): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z - 78391143-6cee-437c-b3dd-aefa95bef200] [Region discovery] Not using a regional authority.
[CredentialProvider]MSAL Log (Info): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z - 78391143-6cee-437c-b3dd-aefa95bef200] IsLegacyAdalCacheEnabled: yes
[CredentialProvider]MSAL Log (Info): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z - 78391143-6cee-437c-b3dd-aefa95bef200] IsLegacyAdalCacheEnabled: yes
[CredentialProvider]MSAL Log (Info): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z] Found 0 cache accounts and 0 broker accounts
[CredentialProvider]MSAL Log (Info): False MSAL 4.64.0.0 MSAL.NetCore .NET 8.0.19 Linux [2025-09-11 16:46:08Z] Returning 0 accounts
[CredentialProvider]VstsCredentialProvider - Bearer token provider 'MSAL Silent' didn't acquire a token
[CredentialProvider]VstsCredentialProvider - Not running bearer token provider 'MSAL Interactive'
[CredentialProvider]VstsCredentialProvider - Not running bearer token provider 'MSAL Device Code'
[CredentialProvider]VstsCredentialProvider - Could not obtain credentials for https://pkgs.dev.azure.com/xxx/_packaging/xxx/nuget/v3/index.json
[CredentialProvider]Unable to acquire credentials.
[CredentialProvider]Sending response: 'Request' 'GetAuthenticationCredentials'. Time elapsed in ms: 2
[CredentialProvider]Time elapsed in milliseconds after sending response 'Request' 'GetAuthenticationCredentials': 2

In addition to this it will also complain about this

[CredentialProvider]Microsoft.Identity.Client.Extensions.Msal.MsalCachePersistenceException: Persistence check failed. Inspect inner exception for details
---> System.DllNotFoundException: Unable to load shared library 'libsecret-1.so.0' or one of its dependencies. In order to help diagnose loading problems, consider using a tool like strace. If you're using glibc, consider setting the LD_DEBUG environment variable:
/usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.19/libsecret-1.so.0: cannot open shared object file: No such file or directory
/home/vscode/.nuget/plugins/netcore/CredentialProvider.Microsoft/libsecret-1.so.0: cannot open shared object file: No such file or directory
/usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.19/liblibsecret-1.so.0: cannot open shared object file: No such file or directory
/home/vscode/.nuget/plugins/netcore/CredentialProvider.Microsoft/liblibsecret-1.so.0: cannot open shared object file: No such file or directory
/usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.19/libsecret-1.so.0.so: cannot open shared object file: No such file or directory
/home/vscode/.nuget/plugins/netcore/CredentialProvider.Microsoft/libsecret-1.so.0.so: cannot open shared object file: No such file or directory
/usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.19/liblibsecret-1.so.0.so: cannot open shared object file: No such file or directory
/home/vscode/.nuget/plugins/netcore/CredentialProvider.Microsoft/liblibsecret-1.so.0.so: cannot open shared object file: No such file or directory
at Microsoft.Identity.Client.Extensions.Msal.Libsecret.secret_schema_new(String name, Int32 flags, String attribute1, Int32 attribute1Type, String attribute2, Int32 attribute2Type, IntPtr end)
at Microsoft.Identity.Client.Extensions.Msal.LinuxKeyringAccessor.GetLibsecretSchema()
at Microsoft.Identity.Client.Extensions.Msal.LinuxKeyringAccessor.Write(Byte[] data)
at Microsoft.Identity.Client.Extensions.Msal.Storage.VerifyPersistence()
--- End of inner exception stack trace ---
at Microsoft.Identity.Client.Extensions.Msal.Storage.VerifyPersistence()
at Microsoft.Identity.Client.Extensions.Msal.MsalCacheHelper.VerifyPersistence()
at Microsoft.Artifacts.Authentication.MsalCache.GetMsalCacheHelperAsync(String cacheLocation, ILogger logger) in D:\a_work\1\s\src\Authentication\MsalCache.cs:line 52

I can't figure what is missing to get this working, any help would be appreciated.