From 4e71aff15d77cf0b69bdd22eb685c0d2f0d69d50 Mon Sep 17 00:00:00 2001
From: Daniel Jurek <djurek@microsoft.com>
Date: Mon, 13 Jul 2026 15:06:27 -0700
Subject: [PATCH 1/5] Use Microsoft hosted asset sources

---
 .../pipelines/templates/steps/set-vcpkg-cache-vars.yml       | 5 +++--
 eng/common/scripts/Set-VcpkgWriteModeCache.ps1               | 1 -
 eng/pipelines/templates/steps/cmake-build.yml                | 1 -
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml b/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml
index c7ece396e0..7827494c5c 100644
--- a/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml
+++ b/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml
@@ -6,9 +6,10 @@ parameters:
 
 steps:
   - pwsh: |
-      Write-Host "Setting vcpkg cache variables for read only access to vcpkg binary and asset caches"
+      Write-Host "Setting vcpkg cache variables for read only access to the vcpkg binary cache"
       Write-Host '##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear;x-azcopy,https://azuresdkartifacts.blob.core.windows.net/public-vcpkg-container,read'
-      Write-Host '##vso[task.setvariable variable=X_VCPKG_ASSET_SOURCES_SECRET;issecret=true;]clear;x-azurl,https://azuresdkartifacts.blob.core.windows.net/public-vcpkg-container,,read'
+      Write-Host "Setting Terrapin asset source for read only access to the vcpkg source mirror"
+      Write-Host '##vso[task.setvariable variable=X_VCPKG_ASSET_SOURCES]clear;x-azurl,https://vcpkg.storage.devpackages.microsoft.io/artifacts/;x-block-origin'
     displayName: Set vcpkg variables
 
   - ${{if eq(variables['System.TeamProject'], 'internal') }}:
diff --git a/eng/common/scripts/Set-VcpkgWriteModeCache.ps1 b/eng/common/scripts/Set-VcpkgWriteModeCache.ps1
index 37bca90019..27bdef477d 100755
--- a/eng/common/scripts/Set-VcpkgWriteModeCache.ps1
+++ b/eng/common/scripts/Set-VcpkgWriteModeCache.ps1
@@ -20,4 +20,3 @@ Write-Host "##vso[task.setvariable variable=VCPKG_BINARY_SAS_TOKEN;issecret=true
 
 Write-Host "Setting vcpkg binary cache to read and write"
 Write-Host "##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear;x-azcopy-sas,https://$StorageAccountName.blob.core.windows.net/$StorageContainerName,$vcpkgBinarySourceSas,readwrite"
-Write-Host "##vso[task.setvariable variable=X_VCPKG_ASSET_SOURCES_SECRET;issecret=true;]clear;x-azurl,https://$StorageAccountName.blob.core.windows.net/$StorageContainerName,$vcpkgBinarySourceSas,readwrite"
diff --git a/eng/pipelines/templates/steps/cmake-build.yml b/eng/pipelines/templates/steps/cmake-build.yml
index 38f1dac72c..b58d7da0ea 100644
--- a/eng/pipelines/templates/steps/cmake-build.yml
+++ b/eng/pipelines/templates/steps/cmake-build.yml
@@ -49,7 +49,6 @@ steps:
     displayName: cmake generate
     env:
       VCPKG_BINARY_SOURCES: $(VCPKG_BINARY_SOURCES_SECRET)
-      X_VCPKG_ASSET_SOURCES: $(X_VCPKG_ASSET_SOURCES_SECRET)
 
 # Core should build all cmake targets
   - ${{ if and(eq(parameters.Build, true), eq(parameters.ServiceDirectory, 'core')) }}:

From 1c460d05cdb8a341a9a141dda704105caaeaadcb Mon Sep 17 00:00:00 2001
From: Daniel Jurek <djurek@microsoft.com>
Date: Mon, 13 Jul 2026 15:21:15 -0700
Subject: [PATCH 2/5] Disable binary cache

---
 eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml | 4 ++--
 eng/common/scripts/Set-VcpkgWriteModeCache.ps1                | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml b/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml
index 7827494c5c..edd1d5c952 100644
--- a/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml
+++ b/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml
@@ -6,8 +6,8 @@ parameters:
 
 steps:
   - pwsh: |
-      Write-Host "Setting vcpkg cache variables for read only access to the vcpkg binary cache"
-      Write-Host '##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear;x-azcopy,https://azuresdkartifacts.blob.core.windows.net/public-vcpkg-container,read'
+      Write-Host "Binary cache disabled (clear) to force full from-source builds and validate Terrapin asset coverage"
+      Write-Host '##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear'
       Write-Host "Setting Terrapin asset source for read only access to the vcpkg source mirror"
       Write-Host '##vso[task.setvariable variable=X_VCPKG_ASSET_SOURCES]clear;x-azurl,https://vcpkg.storage.devpackages.microsoft.io/artifacts/;x-block-origin'
     displayName: Set vcpkg variables
diff --git a/eng/common/scripts/Set-VcpkgWriteModeCache.ps1 b/eng/common/scripts/Set-VcpkgWriteModeCache.ps1
index 27bdef477d..cf87807e17 100755
--- a/eng/common/scripts/Set-VcpkgWriteModeCache.ps1
+++ b/eng/common/scripts/Set-VcpkgWriteModeCache.ps1
@@ -18,5 +18,5 @@ $vcpkgBinarySourceSas = New-AzStorageContainerSASToken `
 # Ensure redaction of SAS tokens in logs
 Write-Host "##vso[task.setvariable variable=VCPKG_BINARY_SAS_TOKEN;issecret=true;]$vcpkgBinarySourceSas"
 
-Write-Host "Setting vcpkg binary cache to read and write"
-Write-Host "##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear;x-azcopy-sas,https://$StorageAccountName.blob.core.windows.net/$StorageContainerName,$vcpkgBinarySourceSas,readwrite"
+Write-Host "Binary cache disabled (clear) to force full from-source builds and validate Terrapin asset coverage"
+Write-Host "##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear"

From 84d41488f894f7a0d3e3c6df0742510c944a5a82 Mon Sep 17 00:00:00 2001
From: Daniel Jurek <djurek@microsoft.com>
Date: Tue, 11 Aug 2026 16:02:56 -0700
Subject: [PATCH 3/5] Revert "Disable binary cache"

This reverts commit 1c460d05cdb8a341a9a141dda704105caaeaadcb.
---
 eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml | 4 ++--
 eng/common/scripts/Set-VcpkgWriteModeCache.ps1                | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml b/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml
index edd1d5c952..7827494c5c 100644
--- a/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml
+++ b/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml
@@ -6,8 +6,8 @@ parameters:
 
 steps:
   - pwsh: |
-      Write-Host "Binary cache disabled (clear) to force full from-source builds and validate Terrapin asset coverage"
-      Write-Host '##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear'
+      Write-Host "Setting vcpkg cache variables for read only access to the vcpkg binary cache"
+      Write-Host '##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear;x-azcopy,https://azuresdkartifacts.blob.core.windows.net/public-vcpkg-container,read'
       Write-Host "Setting Terrapin asset source for read only access to the vcpkg source mirror"
       Write-Host '##vso[task.setvariable variable=X_VCPKG_ASSET_SOURCES]clear;x-azurl,https://vcpkg.storage.devpackages.microsoft.io/artifacts/;x-block-origin'
     displayName: Set vcpkg variables
diff --git a/eng/common/scripts/Set-VcpkgWriteModeCache.ps1 b/eng/common/scripts/Set-VcpkgWriteModeCache.ps1
index cf87807e17..27bdef477d 100755
--- a/eng/common/scripts/Set-VcpkgWriteModeCache.ps1
+++ b/eng/common/scripts/Set-VcpkgWriteModeCache.ps1
@@ -18,5 +18,5 @@ $vcpkgBinarySourceSas = New-AzStorageContainerSASToken `
 # Ensure redaction of SAS tokens in logs
 Write-Host "##vso[task.setvariable variable=VCPKG_BINARY_SAS_TOKEN;issecret=true;]$vcpkgBinarySourceSas"
 
-Write-Host "Binary cache disabled (clear) to force full from-source builds and validate Terrapin asset coverage"
-Write-Host "##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear"
+Write-Host "Setting vcpkg binary cache to read and write"
+Write-Host "##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear;x-azcopy-sas,https://$StorageAccountName.blob.core.windows.net/$StorageContainerName,$vcpkgBinarySourceSas,readwrite"

From 5c7672a79f1da83d9a8c1775e3186c731b086ce7 Mon Sep 17 00:00:00 2001
From: Daniel Jurek <djurek@microsoft.com>
Date: Tue, 11 Aug 2026 16:08:14 -0700
Subject: [PATCH 4/5] Fix cargo feed auth for fork builds

cmake build All failed in public PR validation with:

  token rejected for `azure-sdk-for-rust`
  failed to get successful HTTP response from
  .../_packaging/azure-sdk-for-rust/Cargo/index/config.json, got 401
  TF400813: The user 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa' is not authorized

Two problems, both already solved in azure-sdk-for-rust
(eng/templates/config.toml.template and
eng/pipelines/templates/steps/use-rust.yml):

1. The feed was the org-scoped azure-sdk-for-rust index with no ~force-auth
   suffix, so Azure DevOps answered anonymously. Point at the project-scoped
   public feed with ~force-auth, which reports auth-required and is the same
   crates.io upstream azure-sdk-for-rust consumes.

2. CargoAuthenticate@0 authenticates with SYSTEM_ACCESSTOKEN, which Azure
   DevOps does not deliver to fork builds. The task still reports success but
   writes the anonymous identity, so the failure only surfaces later when cargo
   fetches the index. NuGetAuthenticate@1 uses the SYSTEMVSSCONNECTION endpoint
   token, which fork builds do get, and publishes it as VSS_NUGET_ACCESSTOKEN;
   feed that to CargoAuthenticate@0 as SYSTEM_ACCESSTOKEN.

NuGetAuthenticate@1 is declared in cmake-build.yml rather than taken from
nuget-config.yml because archetype-sdk-client.yml includes cmake-build.yml
without it.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f3a428db-e276-4363-afd9-a944e8533203
---
 eng/pipelines/templates/steps/cmake-build.yml | 22 +++++++++++++++++++
 eng/templates/config.toml.template            | 14 ++++++++----
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/eng/pipelines/templates/steps/cmake-build.yml b/eng/pipelines/templates/steps/cmake-build.yml
index b58d7da0ea..64ad4c0d0d 100644
--- a/eng/pipelines/templates/steps/cmake-build.yml
+++ b/eng/pipelines/templates/steps/cmake-build.yml
@@ -30,10 +30,32 @@ steps:
       Write-Host "##vso[task.setvariable variable=CargoConfigPath]$configPath"
     displayName: Configure cargo to use the azure-sdk-for-rust feed
 
+  # Workaround issue in public pipelines. Revert when root cause issue is fixed:
+  # https://github.com/microsoft/azure-pipelines-tasks/issues/22421
+  # CargoAuthenticate@0 authenticates with SYSTEM_ACCESSTOKEN, which Azure DevOps does
+  # not deliver to fork builds. The task still "succeeds", but writes the anonymous
+  # identity, and cargo then fails the index fetch with 401 / TF400813 for user
+  # aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa. NuGetAuthenticate@1 uses the SYSTEMVSSCONNECTION
+  # endpoint token, which is delivered to fork builds, and publishes it as
+  # VSS_NUGET_ACCESSTOKEN for later steps. It runs as `public Build Service (azure-sdk)`,
+  # which holds Feed and Upstream Reader on the cargo feed.
+  #
+  # This is declared here rather than relying on nuget-config.yml because
+  # archetype-sdk-client.yml includes this template without it.
+  - task: NuGetAuthenticate@1
+    displayName: Acquire an Azure Artifacts token that fork builds can use
+
   - task: CargoAuthenticate@0
     displayName: Authenticate cargo to the azure-sdk-for-rust feed
     inputs:
       configFile: $(CargoConfigPath)
+    # Workaround issue in public pipelines. Revert when root cause is fixed:
+    # https://github.com/microsoft/azure-pipelines-tasks/issues/22421
+    #
+    # NuGetAuthenticate@1 above publishes the endpoint token as VSS_NUGET_ACCESSTOKEN,
+    # which is populated in fork builds and useful as SYSTEM_ACCESSTOKEN here.
+    env:
+      SYSTEM_ACCESSTOKEN: $(VSS_NUGET_ACCESSTOKEN)
 
   - script: cmake --version
     workingDirectory: build
diff --git a/eng/templates/config.toml.template b/eng/templates/config.toml.template
index 3d77616cd4..3299314b3d 100644
--- a/eng/templates/config.toml.template
+++ b/eng/templates/config.toml.template
@@ -6,15 +6,21 @@
 # CMake/Corrosion invokes cargo for the azure-core-amqp rust_wrapper crate.
 #
 # CargoAuthenticate@0 parses the [registries] table below and exports the
-# CARGO_REGISTRIES_AZURE_SDK_FOR_RUST_TOKEN / _CREDENTIAL_PROVIDER variables that cargo
-# needs to authenticate against the feed.
+# CARGO_REGISTRIES_AZURE_SDK_FOR_RUST_PUBLIC_TOKEN / _CREDENTIAL_PROVIDER variables that
+# cargo needs to authenticate against the feed.
+#
+# The feed is the project-scoped `public` one shared with azure-sdk-for-rust, and the
+# `~force-auth` suffix on the feed name is required. Without it Azure DevOps answers the
+# index anonymously, and cargo fails with "token rejected ... got 401" for the anonymous
+# identity aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa. See
+# https://learn.microsoft.com/azure/devops/artifacts/cargo/cargo-upstream-source.
 #
 # The [source] replacement is what actually redirects index.crates.io and
 # static.crates.io to the feed. Cargo does not honor environment variables for the
 # [source] table, so an on-disk config file is required.
 
 [registries]
-azure-sdk-for-rust = { index = "sparse+https://pkgs.dev.azure.com/azure-sdk/_packaging/azure-sdk-for-rust/Cargo/index/" }
+azure-sdk-for-rust-public = { index = "sparse+https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-rust-public~force-auth/Cargo/index/" }
 
 [source.crates-io]
-replace-with = "azure-sdk-for-rust"
+replace-with = "azure-sdk-for-rust-public"

From e62f4020b0b4f169b9fd21603290811e4273a048 Mon Sep 17 00:00:00 2001
From: Daniel Jurek <djurek@microsoft.com>
Date: Tue, 11 Aug 2026 17:22:11 -0700
Subject: [PATCH 5/5] Reword cargo auth comment to satisfy cspell

cspell flagged SYSTEMVSSCONNECTION as an unknown word, failing the
GenerateReleaseArtifacts job at 'Check spelling' and cascading into the
package artifact and APIView steps. Describe the service connection in prose
instead of adding a one-off entry to the repo dictionary.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f3a428db-e276-4363-afd9-a944e8533203
---
 eng/pipelines/templates/steps/cmake-build.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/eng/pipelines/templates/steps/cmake-build.yml b/eng/pipelines/templates/steps/cmake-build.yml
index 64ad4c0d0d..b2a7d6d0a5 100644
--- a/eng/pipelines/templates/steps/cmake-build.yml
+++ b/eng/pipelines/templates/steps/cmake-build.yml
@@ -35,10 +35,11 @@ steps:
   # CargoAuthenticate@0 authenticates with SYSTEM_ACCESSTOKEN, which Azure DevOps does
   # not deliver to fork builds. The task still "succeeds", but writes the anonymous
   # identity, and cargo then fails the index fetch with 401 / TF400813 for user
-  # aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa. NuGetAuthenticate@1 uses the SYSTEMVSSCONNECTION
-  # endpoint token, which is delivered to fork builds, and publishes it as
-  # VSS_NUGET_ACCESSTOKEN for later steps. It runs as `public Build Service (azure-sdk)`,
-  # which holds Feed and Upstream Reader on the cargo feed.
+  # aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa. NuGetAuthenticate@1 authenticates with the
+  # build's service connection, whose token Azure DevOps does deliver to fork builds, and
+  # publishes it as VSS_NUGET_ACCESSTOKEN for later steps. It runs as
+  # `public Build Service (azure-sdk)`, which holds Feed and Upstream Reader on the cargo
+  # feed.
   #
   # This is declared here rather than relying on nuget-config.yml because
   # archetype-sdk-client.yml includes this template without it.