npm - @openclaw/mxc-sandbox - Versions diffs - 2026.9.4 → 2026.9.6 - Mend

@openclaw/mxc-sandbox 2026.9.4 → 2026.9.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (637) hide show

package/assets/activity.svg ADDED Viewed

@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <path fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M12 2 21 6v6c0 5-4 8-9 10-5-2-9-5-9-10V6ZM7 9l3 3-3 3M12 16h5" />
+</svg>

package/assets/icon.png ADDED Viewed

Binary file

package/dist/index.js CHANGED Viewed

@@ -203,6 +203,9 @@ var MxcFsBridge = class {
 			containerPath: target.containerPath
 		};
 	}
+	get pathMappings() {
+		return [...this.protectedSkillMounts, ...this.workspaceMounts];
+	}
 	async readFile(params) {
 		const target = this.resolveTarget(params);
 		return await (await root(target.mount.hostRoot)).readBytes(target.mountRelativePath, {

package/node_modules/@microsoft/mxc-sdk/README.md CHANGED Viewed

@@ -24,7 +24,7 @@ const tools = getAvailableToolsPolicy(process.env);
 const temp  = getTemporaryFilesPolicy();
 const config = createConfigFromPolicy({
-  version: '0.5.0-alpha',
+  version: '0.6.0-alpha',
   filesystem: {
     readonlyPaths:  tools.readonlyPaths,    // PATH, PYTHONPATH, JAVA_HOME, …
     readwritePaths: temp.readwritePaths,    // %TEMP% / $TMPDIR
@@ -45,8 +45,8 @@ child.on('close', (code) => console.log('exit:', code));
 <!--
   Keep this section in sync with:
-    - sdk/src/sandbox.ts          (SUPPORTED_VERSION / MIN_VERSION)
-    - sdk/src/platform.ts         (availableMethods per platform)
+    - sdk/node/src/sandbox.ts          (SUPPORTED_VERSION / MIN_VERSION)
+    - sdk/node/src/platform.ts         (availableMethods per platform)
     - schemas/{stable,dev}/*.json (supported policy.version values)
   When a new schema graduates or a new backend ships, update only this block.
 -->
@@ -55,24 +55,90 @@ child.on('close', (code) => console.log('exit:', code));
 | Version | Status | Schema file |
 | --- | --- | --- |
-| `0.4.0-alpha` | Stable | [`schemas/stable/mxc-config.schema.0.4.0-alpha.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.4.0-alpha.json) |
-| `0.5.0-alpha` | Stable (legacy — see strict sibling below) | [`schemas/stable/mxc-config.schema.0.5.0-alpha.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.5.0-alpha.json) |
-| `0.5.0-alpha` (strict) | Stable, non-experimental surface only | [`schemas/stable/mxc-config.schema.0.5.0-alpha-strict.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.5.0-alpha-strict.json) |
-| `0.6.0-alpha` | Stable | [`schemas/stable/mxc-config.schema.0.6.0-alpha.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.6.0-alpha.json) |
-| `0.7.0-alpha` | Stable (current) | [`schemas/stable/mxc-config.schema.0.7.0-alpha.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.7.0-alpha.json) |
-| `0.8.0-alpha` | Dev (experimental backends, the `experimental.*` block, state-aware sandbox lifecycle) | [`schemas/dev/mxc-config.schema.0.8.0-dev.json`](https://github.com/microsoft/mxc/blob/main/schemas/dev/mxc-config.schema.0.8.0-dev.json) |
+| `0.4.0-alpha` | Retired — below the `0.6.0-alpha` floor (no longer accepted) | [`schemas/stable/mxc-config.schema.0.4.0-alpha.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.4.0-alpha.json) |
+| `0.5.0-alpha` | Retired — below the `0.6.0-alpha` floor (no longer accepted) | [`schemas/stable/mxc-config.schema.0.5.0-alpha.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.5.0-alpha.json) |
+| `0.6.0-alpha` | Stable (minimum supported) | [`schemas/stable/mxc-config.schema.0.6.0-alpha.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.6.0-alpha.json) |
+| `0.7.0-alpha` | Stable | [`schemas/stable/mxc-config.schema.0.7.0-alpha.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.7.0-alpha.json) |
+| `0.8.0-alpha` | Stable (current) | [`schemas/stable/mxc-config.schema.0.8.0-alpha.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.8.0-alpha.json) |
+| `0.9.0-alpha` | Dev (experimental backends, the `experimental.*` block, state-aware sandbox lifecycle) | [`schemas/dev/mxc-config.schema.0.9.0-dev.json`](https://github.com/microsoft/mxc/blob/main/schemas/dev/mxc-config.schema.0.9.0-dev.json) |
-Pick `0.7.0-alpha` for new code on any supported platform.
+Pick `0.8.0-alpha` for new code on any supported platform.
-> **Stable schemas document only the non-experimental surface.** Experimental backends (`windows_sandbox`, `wslc`, `microvm`, `hyperlight`, `isolation_session`), the `experimental.*` block, and state-aware lifecycle live in `0.8.0-dev`. The parser still accepts them when paired with `--experimental` regardless of which schema your config validates against — schema choice affects editor validation, not runtime behavior.
+> **Stable schemas document only the non-experimental surface.** Experimental backends (`windows_sandbox`, `wslc`, `microvm`, `hyperlight`, `isolation_session`), the `experimental.*` block, and state-aware lifecycle live in `0.9.0-dev`. The parser still accepts them when paired with `--experimental` regardless of which schema your config validates against — schema choice affects editor validation, not runtime behavior.
 > **Network host allow/block lists are not implemented on Windows.** `network.allowedHosts` / `network.blockedHosts` have no enforcement on this platform — use `network.defaultPolicy` (`allow` / `block`) or `network.proxy` to constrain network access.
+<a id="schema-080-networking"></a>
+**Schema 0.8 directional networking:** `createConfigFromPolicy` accepts
+`network.egress` / `network.ingress`, `runtimeConfig.networkProxy`, and
+`processContainer.network.allowedProxyPeer`. Do not mix those fields with the
+legacy `network.allowOutbound`, `network.allowLocalNetwork`,
+`network.allowedHosts`, `network.blockedHosts`, or `network.proxy` fields.
+`createConfigFromPolicy` authors either shape according to the supplied policy
+version and fields. Schema 0.6 and 0.7 policies continue to produce the legacy
+wire shape. With schema 0.8, omitting all network fields leaves the
+`network` block out of the generated config; the native parser interprets that
+as directional default-deny for egress, ingress, and host loopback. See the
+[Sandbox Policy 0.8.0 specification](https://github.com/microsoft/mxc/blob/main/docs/sandbox-policy/0.8.0/policy.md)
+for the complete cross-platform authoring shape.
+Model 1 permits direct connections selected by IP/CIDR, protocol, and port
+rules; it does not configure an application-layer proxy. Model 2 denies direct
+internet access and supplies a loopback HTTP/S proxy endpoint. Backend-specific
+requirements determine how that proxy endpoint is made reachable.
+**Simple model 1 example — direct egress with L3/L4 filtering:**
+```typescript
+import {
+  createConfigFromPolicy,
+  spawnSandboxFromConfig,
+} from '@microsoft/mxc-sdk';
+const directConfig = createConfigFromPolicy({
+  version: '0.8.0-alpha',
+  network: {
+    egress: {
+      default: 'deny',
+      allow: [{
+        to: [{ cidr: '192.0.2.0/24' }],
+        ports: [{ protocol: 'tcp', port: 443 }],
+      }],
+    },
+    ingress: { default: 'deny', hostLoopback: 'deny' },
+  },
+});
+directConfig.process!.commandLine = 'node agent.js';
+spawnSandboxFromConfig(directConfig);
+```
+**Simple model 2 example — loopback HTTP/S proxy:**
+```typescript
+const proxyConfig = createConfigFromPolicy({
+  version: '0.8.0-alpha',
+  network: {
+    egress: { default: 'deny' },
+    ingress: { default: 'deny', hostLoopback: 'deny' },
+  },
+  runtimeConfig: { networkProxy: 'http://127.0.0.1:8080' },
+});
+proxyConfig.process!.commandLine = 'node agent.js';
+spawnSandboxFromConfig(proxyConfig);
+```
+These are example configurations rather than universal backend recipes.
+ProcessContainer proxy configurations have additional criteria; see the
+[ProcessContainer 0.8 proxy example](https://github.com/microsoft/mxc/blob/main/docs/process-container/examples/0.8.0-schema.md).
+See the [networking specification](https://github.com/microsoft/mxc/blob/main/docs/sandbox-policy/0.8.0/networking/networking.md)
+for all three connectivity modes and backend-specific support.
 **Platforms:**
 | Platform | Default backend | Other backends | Minimum build |
 | --- | --- | --- | --- |
-| Windows 11 24H2+ (verified on 25H2) | `processcontainer` | `windows_sandbox`, `wslc`, `microvm`, `isolation_session` | `processcontainer`: 26100 (24H2)<br>`isolation_session`: 26300.8553 ([Insider Preview](https://learn.microsoft.com/en-us/windows-insider/release-notes/experimental/preview-build-26300-8553)) |
+| Windows 11 24H2+ (verified on 25H2) | `processcontainer` | `windows_sandbox`, `wslc`, `microvm`, `isolation_session` | `processcontainer`: 26100 (24H2)<br>`isolation_session`: 26340.9212 ([Insider Preview](https://learn.microsoft.com/en-us/windows-insider/release-notes/experimental/preview-build-26340-9212)) |
 | Linux x64 / ARM64 | `bubblewrap` | `lxc` | — |
 | macOS ARM64 (schema `0.7.0-alpha`+) | `seatbelt` | — | — |
@@ -103,7 +169,7 @@ const temp  = getTemporaryFilesPolicy();
 const config = createConfigFromPolicy(
   {
-    version: '0.5.0-alpha',
+    version: '0.6.0-alpha',
     filesystem: {
       readonlyPaths:  tools.readonlyPaths,
       readwritePaths: temp.readwritePaths,
@@ -143,7 +209,7 @@ const tools = getAvailableToolsPolicy(process.env);
 const temp  = getTemporaryFilesPolicy();
 const pty = spawnSandbox('python script.py', {
-  version: '0.5.0-alpha',
+  version: '0.6.0-alpha',
   filesystem: {
     readonlyPaths:  tools.readonlyPaths,
     readwritePaths: temp.readwritePaths,
@@ -170,7 +236,7 @@ const temp  = getTemporaryFilesPolicy();
 const result = await spawnSandboxAsync(
   'python -c "import sys; print(sys.version)"',
   {
-    version: '0.5.0-alpha',
+    version: '0.6.0-alpha',
     filesystem: {
       readonlyPaths:  tools.readonlyPaths,
       readwritePaths: temp.readwritePaths,
@@ -194,14 +260,14 @@ console.log(result.stdout);
 | Backend | Intent | Platforms | Stable? | Guide |
 | --- | --- | --- | --- | --- |
-| `processcontainer` | `process` | Windows | ✅ | [`docs/base-process-container/guide.md`](https://github.com/microsoft/mxc/blob/main/docs/base-process-container/guide.md) |
+| `processcontainer` | `process` | Windows | ✅ | [`docs/process-container/guide.md`](https://github.com/microsoft/mxc/blob/main/docs/process-container/guide.md) |
 | `bubblewrap` | `process` | Linux | ✅ | [`docs/bwrap-support/bubblewrap-backend.md`](https://github.com/microsoft/mxc/blob/main/docs/bwrap-support/bubblewrap-backend.md) |
 | `lxc` | (concrete only) | Linux | ✅ | [`docs/lxc-support/lxc-backend.md`](https://github.com/microsoft/mxc/blob/main/docs/lxc-support/lxc-backend.md) |
-| `seatbelt` | `process` | macOS | ✅ (schema `0.7.0-alpha`+) | [`docs/macos-support/seatbelt-backend.md`](https://github.com/microsoft/mxc/blob/main/docs/macos-support/seatbelt-backend.md) |
+| `seatbelt` | `process` | macOS | ✅ (schema `0.7.0-alpha`+) | [`docs/seatbelt/seatbelt-backend.md`](https://github.com/microsoft/mxc/blob/main/docs/seatbelt/seatbelt-backend.md) |
 | `windows_sandbox` | `vm` | Windows | Experimental | [`docs/windows-sandbox/windows-sandbox.md`](https://github.com/microsoft/mxc/blob/main/docs/windows-sandbox/windows-sandbox.md) |
 | `microvm` | `microvm` | Windows | Experimental | [`docs/nanvix-microvm/nanvix.md`](https://github.com/microsoft/mxc/blob/main/docs/nanvix-microvm/nanvix.md) — MicroVM via NanVix on Windows Hypervisor Platform |
 | `wslc` | (concrete only) | Windows | Experimental | [`docs/wsl/wsl-container-getting-started.md`](https://github.com/microsoft/mxc/blob/main/docs/wsl/wsl-container-getting-started.md) |
-| `isolation_session` | (concrete only) | Windows | Experimental | [`docs/isolation-session/initial-bringup-plan.md`](https://github.com/microsoft/mxc/blob/main/docs/isolation-session/initial-bringup-plan.md) |
+| `isolation_session` | (concrete only) | Windows | Experimental | [`docs/isolation-session/oneshot.md`](https://github.com/microsoft/mxc/blob/main/docs/isolation-session/oneshot.md) |
 Experimental backends require `{ experimental: true }` in `SandboxSpawnOptions`:
@@ -216,7 +282,13 @@ Backend-specific tuning lives on the returned `ContainerConfig`. The full set of
 - Stable backends: [`schemas/stable/`](https://github.com/microsoft/mxc/tree/main/schemas/stable/)
 - Experimental backends: [`schemas/dev/`](https://github.com/microsoft/mxc/tree/main/schemas/dev/)
-Open the schema file matching your `policy.version` (e.g. `mxc-config.schema.0.5.0-alpha.json`) and look up `processContainer`, `lxc`, `experimental.wslc`, `experimental.windows_sandbox`, etc.
+Open the schema file matching your `policy.version` (e.g. `mxc-config.schema.0.6.0-alpha.json`) and look up `processContainer`, `lxc`, `experimental.wslc`, `experimental.windows_sandbox`, etc.
+For Windows ProcessContainer configs, `processContainer.learningMode: true`
+enables deny-and-record learning mode: failed accesses are logged but remain
+denied. The internal `learningModeLogging` and `permissiveLearningMode`
+capability names are reserved and must not be added directly to
+`processContainer.capabilities`.
 </details>
@@ -227,7 +299,7 @@ Open the schema file matching your `policy.version` (e.g. `mxc-config.schema.0.5
 For long-lived sandboxes where you provision once, exec many times, and tear down at the end (e.g. agentic loops), use the state-aware lifecycle.
-> **Backend support:** the state-aware lifecycle is currently only implemented for `isolation_session` (Windows). The one-shot spawn APIs (`spawnSandbox` / `spawnSandboxFromConfig`) are the supported path for every other backend.
+> **Backend support:** the state-aware lifecycle is currently implemented for `isolation_session`, `windows_sandbox`, and `wslc` (all Windows-only; all still experimental, so every call must pass `{ experimental: true }`). The one-shot spawn APIs (`spawnSandbox` / `spawnSandboxFromConfig`) are the supported path for every other backend.
 ```typescript
 import {
@@ -235,16 +307,54 @@ import {
   stopSandbox, deprovisionSandbox,
 } from '@microsoft/mxc-sdk';
-const { sandboxId } = await provisionSandbox('isolation_session');
-await startSandbox(sandboxId);
+// Every call takes a single options object (3rd arg). Experimental backends
+// must pass `experimental: true`.
+// isolation_session provision requires the unrestricted-network acknowledgment:
+// the container's network cannot be filtered or denied, so you must opt in.
+const { sandboxId } = await provisionSandbox(
+  'isolation_session',
+  { network: { defaultPolicy: 'allow', allowLocalNetwork: true } },
+  { experimental: true },
+);
+const opts = { experimental: true };
+await startSandbox(sandboxId, undefined, opts);
+const r1 = await execInSandboxAsync(sandboxId, { process: { commandLine: 'echo hello' } }, opts);
+const r2 = await execInSandboxAsync(sandboxId, { process: { commandLine: 'whoami' } }, opts);
+await stopSandbox(sandboxId, undefined, opts);
+await deprovisionSandbox(sandboxId, undefined, opts);
+```
+`windows_sandbox` follows the same shape (substitute the containment string and provide `filesystem.readwritePaths` / `readonlyPaths` at provision if needed). See [`docs/windows-sandbox/windows-sandbox.md`](https://github.com/microsoft/mxc/blob/main/docs/windows-sandbox/windows-sandbox.md) for the per-phase config matrix.
+`wslc` follows the same shape and needs no provision config at all (it defaults to an `alpine:latest` container with no network). Provide `filesystem.readwritePaths` / `readonlyPaths` (mounted for the sandbox's lifetime), `network.defaultPolicy: 'allow'` (a bridged container; the default `'block'` gives no network), and/or a backend-specific `image` / `imageTarPath` at provision; inject a cooperative `network.proxy: { url }` per-exec. WSLc state-aware requests default to schema `0.8.0-alpha`. See [`docs/wsl/wslc-state-aware.md`](https://github.com/microsoft/mxc/blob/main/docs/wsl/wslc-state-aware.md) for the per-phase config matrix.
-const r1 = await execInSandboxAsync(sandboxId, { process: { commandLine: 'echo hello' } });
-const r2 = await execInSandboxAsync(sandboxId, { process: { commandLine: 'whoami' } });
+**Handling failures.** Every lifecycle call rejects with a typed `MxcError`. Branch on `code` first; when the failure came from an underlying platform API, the error also carries discrete diagnostic fields rather than a prose blob:
-await stopSandbox(sandboxId);
-await deprovisionSandbox(sandboxId);
+```typescript
+import { MxcError } from '@microsoft/mxc-sdk';
+try {
+  await startSandbox(sandboxId, {}, { experimental: true });
+} catch (err) {
+  if (err instanceof MxcError) {
+    if (err.code === 'stale_id') { /* the sandbox is gone -- re-provision */ }
+    console.error(err.message);      // bare, human-readable
+    console.error(err.operation);    // e.g. 'IsoSessionOps.StartSessionAsync'
+    console.error(err.nativeCode);   // e.g. '0x80070490'
+    console.error(err.remediation);  // the API's own fix-it hint, when it supplies one
+  }
+}
 ```
+`operation`, `nativeCode` and `remediation` are optional. A failure MXC raises before reaching the backend — a malformed request or id, or a policy rejection — carries only `code` and `message`.
+These three are currently populated only by **IsolationSession state-aware** operations. Windows Sandbox has no semantic error channel to derive them from, and the one-shot surface folds the same detail into `message` instead, so they are uniformly absent there — always treat them as optional.
+Branch program logic on `code`, which is a closed, versioned union. The *values* of `operation` and `nativeCode` are best-effort diagnostics derived from the underlying platform API and may change without a version bump — use them for telemetry, logging and diagnosis rather than control flow.
 Full design and API: [`docs/state-aware-lifecycle/`](https://github.com/microsoft/mxc/tree/main/docs/state-aware-lifecycle/).
 </details>
@@ -266,7 +376,7 @@ const profile = getUserProfilePolicy();               // %LOCALAPPDATA%\Programs
 const tmp     = getTemporaryFilesPolicy();            // %TEMP% / $TMPDIR
 const policy = {
-  version: '0.5.0-alpha',
+  version: '0.6.0-alpha',
   filesystem: {
     readonlyPaths: [...tools.readonlyPaths, ...profile.readonlyPaths],
     readwritePaths: tmp.readwritePaths,
@@ -285,13 +395,13 @@ Each helper returns `{ readonlyPaths, readwritePaths }` — merge what you want
 ### UI is blocked by default on 0.5.0+ — some shells need it
-The `policy.ui` block is enforced starting with schema `0.5.0-alpha` (it has no effect on `0.4.0-alpha`). When you use `0.5.0-alpha`, `0.6.0-alpha`, or `0.7.0-alpha`, `policy.ui.allowWindows` defaults to `false`. Most non-interactive command-line tools work fine, but on Windows some shells make win32k system calls during startup and fail without UI access. **All versions of PowerShell are affected** — both Windows PowerShell 5.1 (`powershell.exe`) and PowerShell 7 (`pwsh.exe`). Set `ui.allowWindows: true` when launching a shell:
+The `policy.ui` block is enforced on all supported schema versions, and `policy.ui.allowWindows` defaults to `false`. Most non-interactive command-line tools work fine, but on Windows some shells make win32k system calls during startup and fail without UI access. **All versions of PowerShell are affected** — both Windows PowerShell 5.1 (`powershell.exe`) and PowerShell 7 (`pwsh.exe`). Set `ui.allowWindows: true` when launching a shell:
 ```typescript
 import { spawnSandboxFromConfig, createConfigFromPolicy } from '@microsoft/mxc-sdk';
 const config = createConfigFromPolicy({
-  version: '0.5.0-alpha',
+  version: '0.6.0-alpha',
   ui: { allowWindows: true },     // ← required for powershell.exe to start
 });
 config.process!.commandLine = 'powershell.exe -NoProfile -Command "Get-Date"';
@@ -331,7 +441,7 @@ Setting `cwd` (or the `workingDirectory` argument) does **not** add that path to
 | `process.commandLine starts with an unquoted Windows path containing a space` | `wxc-exec` rejects unquoted paths with spaces at parse time. | Quote the executable: `'"C:\\Program Files\\…\\foo.exe" args'`. |
 | `Experimental_CreateProcessInSandbox failed: WIN32_ERROR(...)` | Native sandbox API returned an OS-level error, e.g. `448` = device feature not supported (Windows build / WIP feature not enabled). Note `120` (call not implemented / BaseContainer disabled) is now handled automatically — the default `process` backend falls back to AppContainer+DACL, so it no longer surfaces here. | Check the Windows build / WIP requirements for the backend you selected. |
 | Process exits `-1` / `4294967295` with no stdout | Native binary terminated abnormally. | Re-run with `options.debug: true` (or `options.logDir: '<dir>'`) to capture diagnostic logs. |
-| `policy.version '<x>' is older than supported` / `newer than supported` | Version is outside the SDK's accepted range. | Use `0.4.0-alpha`, `0.5.0-alpha`, `0.6.0-alpha`, `0.7.0-alpha`, or `0.8.0-alpha`. See [Compatibility](#compatibility). |
+| `policy.version '<x>' is older than supported` / `newer than supported` | Version is outside the SDK's accepted range. | Use `0.6.0-alpha`, `0.7.0-alpha`, `0.8.0-alpha`, or `0.9.0-alpha`. See [Compatibility](#compatibility). |
 For backend-specific errors, see the per-backend guide linked from the [Choosing a Backend](#choosing-a-backend) table.
@@ -353,8 +463,11 @@ spawnSandboxFromConfig(config, options?, workingDirectory?, env?) → IPty | Chi
 spawnSandbox(script, policy, options?, workingDirectory?, containerName?, env?) → IPty
 spawnSandboxAsync(script, policy, ...) → Promise<{ stdout, stderr, exitCode }>
-// State-aware lifecycle (currently only `isolation_session` on Windows)
-provisionSandbox(containment, config?, options?) → Promise<ProvisionResult>
+// State-aware lifecycle (currently `isolation_session`, `windows_sandbox`, and `wslc` — all Windows-only)
+// `config` on provisionSandbox is required for backends whose provision config
+// has a required member (isolation_session: the network acknowledgment) and
+// optional otherwise (windows_sandbox, wslc).
+provisionSandbox(containment, config, options?)  → Promise<ProvisionResult>
 startSandbox(sandboxId, config?, options?)       → Promise<StartResult>
 execInSandbox(sandboxId, config, options?)       → IPty             // streaming
 execInSandboxAsync(sandboxId, config, options?)  → Promise<ExecResult>
@@ -371,7 +484,8 @@ getTemporaryFilesPolicy(env?)           → FilesystemPolicyResult
 UiCapabilitySupport
 // Errors (typed wire-format errors from wxc-exec)
-ErrorCode, MxcError, mxcErrorFromCode(code)
+ErrorCode, MxcError, MxcErrorFields
+mxcErrorFromCode(code, message, details?)   → MxcError
 ```
 Full TypeScript definitions ship with the package (`dist/index.d.ts`). All exports are named exports from `@microsoft/mxc-sdk`.
@@ -380,16 +494,37 @@ Full TypeScript definitions ship with the package (`dist/index.d.ts`). All expor
 ---
+## Telemetry Consent
+Telemetry is off-by-default unless the caller opts in with top-level `telemetry.enabled: true` and the applicable Windows consent/policy gates permit collection.
+Telemetry consent behavior follows
+[`docs/telemetry/telemetry-consent-design.md`](https://github.com/microsoft/mxc/blob/main/docs/telemetry/telemetry-consent-design.md):
+the SDK stays UI-agnostic, renders the canonical resource verbatim through a
+host presenter, persists only explicit yes/no decisions, treats dismissal and
+failures as non-grants, and never lets policy or transport failures opt a user
+in.
+### Administrative policy
+An IT administrator can still block MXC telemetry device-wide via MXC's own
+registry policy setting. See
+[`docs/telemetry/telemetry-administrative-policy.md`](https://github.com/microsoft/mxc/blob/main/docs/telemetry/telemetry-administrative-policy.md)
+for the stable registry contract and interaction rules.
+---
 ## Further Reading
 - [`docs/schema.md`](https://github.com/microsoft/mxc/blob/main/docs/schema.md) — full configuration schema reference
 - [`docs/versioning.md`](https://github.com/microsoft/mxc/blob/main/docs/versioning.md) — schema versioning model and experimental-feature lifecycle
 - [`docs/examples.md`](https://github.com/microsoft/mxc/blob/main/docs/examples.md) — annotated configuration examples
-- [`docs/sandbox-policy/v1/policy.md`](https://github.com/microsoft/mxc/blob/main/docs/sandbox-policy/v1/policy.md) — policy specification
+- [Sandbox policy 0.8.0](https://github.com/microsoft/mxc/blob/main/docs/sandbox-policy/0.8.0/policy.md)
+  — policy specification
 - Backend-specific guides linked in the [Choosing a Backend](#choosing-a-backend) section above.
 ---
 ## License
-[MIT](https://github.com/microsoft/mxc/blob/main/sdk/LICENSE.md). Contributions welcome — see the main [MXC repository](https://github.com/microsoft/mxc).
+[MIT](https://github.com/microsoft/mxc/blob/main/sdk/node/LICENSE.md). Contributions welcome — see the main [MXC repository](https://github.com/microsoft/mxc).

package/node_modules/@microsoft/mxc-sdk/bin/arm64/_manifest/spdx_2.2/ESRPClientLogs0822172244460.json ADDED Viewed

@@ -0,0 +1 @@

+ {"StdOut":"******************************************************************************\r\nMachine Information\r\nMachine Name: at-greenZ06UG8\r\nMachine Ip: 10.0.0.132\r\nOperating System: Microsoft Windows NT 10.0.26100.0\r\nUser Name: at-greenZ06UG8$\r\nProcessor Count: 64\r\nProcess Name: EsrpClient\r\nProcess Id: 3672\r\nCaller Program: EsrpClient.exe\r\nIdentity: NT AUTHORITY\\NETWORK SERVICE\r\nProcess Version: 1.2.142+Branch.master.Sha.90404b43284ec55b3e2251d0e272f8932aa583e2\r\nProcess Bitness: 64 bit\r\n******************************************************************************\r\nCommandline received: Sign | -a | c:\\Temp\\AzureTemp\\TFSTemp\\vctmp8364_282370.json | -p | c:\\Temp\\AzureTemp\\TFSTemp\\vctmp8364_455305.json | -c | c:\\Temp\\AzureTemp\\TFSTemp\\vctmp8364_684093.json | -i | c:\\Temp\\AzureTemp\\TFSTemp\\vctmp19012_363058.json | -o | c:\\Temp\\AzureTemp\\TFSTemp\\v34DDA.tmp | -l | Verbose ESRP session Id is: ae828864-37b0-434f-b461-cc263b4cfb43\r\n2026-08-22T17:22:36.3995377Z:Command you are trying to use is: Sign\r\n2026-08-22T17:22:36.4062266Z:Correlation Vector for this run is: 8c39df38-4b7f-45ff-8ffa-f40c61aaea5b\r\n2026-08-22T17:22:36.4065381Z:Groupid for this run is empty\r\n2026-08-22T17:22:36.5445750Z:request signing cert being used is this thumbprint: 88052E651561B29C26E3DCCC68EE30EF1AE88FD3 in store LocalMachine\\My\r\n2026-08-22T17:22:36.5445750Z:Both certificates validation passed.\r\n2026-08-22T17:22:36.5465853Z:The auth cert we choose to use, subject name is: CN=0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f.microsoft.com, thumbprint is: 9278C2BA9ABECFD244DB6A2BB255B03F6795E955\r\n2026-08-22T17:22:36.6054872Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z] ConfidentialClientApplication 37368736 created\r\n2026-08-22T17:22:36.6054872Z:Gateway Client: Enter AuthenticationProvider, no calls to AAD yet, client id is 0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f, and resource url is https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com, tenant id is 33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:22:36.6119791Z:There is no memory mapped file accociated with this name: api.esrp.microsoft.com_0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f_33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:22:36.6148890Z:AAD auth caching is in use with this name: api.esrp.microsoft.com_0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f_33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:22:36.6235572Z:Validate and Renew Token if necessary finished: 00:00:00.0084214\r\n2026-08-22T17:22:36.7248758Z:Session request is: {\r\n \"expiresAfter\": \"3.00:00:00\",\r\n \"partitionCount\": 0,\r\n \"isProvisionStorage\": true,\r\n \"isLegacyCopsModel\": false,\r\n \"commandName\": \"Sign\",\r\n \"intent\": \"digestsign\",\r\n \"contentType\": \"Bin\",\r\n \"contentOrigin\": \"3rd Party\",\r\n \"productState\": null,\r\n \"audience\": \"External Broad\"\r\n}\r\n2026-08-22T17:22:36.7665297Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z] ConfidentialClientApplication 29578451 created\r\n2026-08-22T17:22:36.7682074Z:Gateway Client: Enter AuthenticationProvider, no calls to AAD yet, client id is 0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f, and resource url is https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com, tenant id is 33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:22:36.7796380Z:Gateway Client: a new client and client id is created: 56418694-1408-4f4d-9ee5-6043e6ef3665\r\n2026-08-22T17:22:36.8237274Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] MSAL MSAL.Desktop with assembly version '4.70.0.0'. CorrelationId(37a6f05d-aa4a-4658-a194-7cd866852a2c)\r\n2026-08-22T17:22:36.8391044Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] === AcquireTokenForClientParameters ===\r\nSendX5C: True\r\nForceRefresh: False\r\nAccessTokenHashToRefresh: False\r\n\r\n2026-08-22T17:22:36.8536849Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] \r\n=== Request Data ===\r\nAuthority Provided? - True\r\nScopes - https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com/.default\r\nExtra Query Params Keys (space separated) - \r\nApiId - AcquireTokenForClient\r\nIsConfidentialClient - True\r\nSendX5C - True\r\nLoginHint ? False\r\nIsBrokerConfigured - False\r\nHomeAccountId - False\r\nCorrelationId - 37a6f05d-aa4a-4658-a194-7cd866852a2c\r\nUserAssertion set: False\r\nLongRunningOboCacheKey set: False\r\nRegion configured: \r\n\r\n2026-08-22T17:22:36.8548707Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] === Token Acquisition (ClientCredentialRequest) started:\r\n\t Scopes: https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com/.default\r\n\tAuthority Host: login.microsoftonline.com\r\n2026-08-22T17:22:36.8737248Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [Internal cache] Total number of cache partitions found while getting access tokens: 0\r\n2026-08-22T17:22:36.8737248Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [FindAccessTokenAsync] Discovered 0 access tokens in cache using partition key: 0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f_33e01921-4d64-4f8c-a055-5bdaffd5e33d_AppTokenCache\r\n2026-08-22T17:22:36.8737248Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [FindAccessTokenAsync] No access tokens found in the cache. Skipping filtering. \r\n2026-08-22T17:22:36.8844727Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [Instance Discovery] Instance discovery is enabled and will be performed\r\n2026-08-22T17:22:36.8894341Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [Region discovery] WithAzureRegion not configured. \r\n2026-08-22T17:22:36.8894341Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [Region discovery] Not using a regional authority. \r\n2026-08-22T17:22:36.8938699Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [Instance Discovery] Tried to use network cache provider for login.microsoftonline.com. Success? False. \r\n2026-08-22T17:22:36.9051864Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Fetching instance discovery from the network from host login.microsoftonline.com. \r\n2026-08-22T17:22:36.9258090Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Starting [Oauth2Client] Sending GET request \r\n2026-08-22T17:22:36.9313887Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Starting [HttpManager] ExecuteAsync\r\n2026-08-22T17:22:36.9395225Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:36Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [HttpManager] Sending request. Method: GET. Host: https://login.microsoftonline.com. Binding Certificate: False \r\n2026-08-22T17:22:37.5138972Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [HttpManager] Received response. Status code: OK. \r\n2026-08-22T17:22:37.5270924Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Finished [HttpManager] ExecuteAsync in 596 ms\r\n2026-08-22T17:22:37.5270924Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Finished [Oauth2Client] Sending GET request in 602 ms\r\n2026-08-22T17:22:37.5385916Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Starting [OAuth2Client] Deserializing response\r\n2026-08-22T17:22:37.6688568Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Finished [OAuth2Client] Deserializing response in 130 ms\r\n2026-08-22T17:22:37.6698228Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [Instance Discovery] Tried to use network cache provider for login.microsoftonline.com. Success? True. \r\n2026-08-22T17:22:37.6698228Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [Instance Discovery] After hitting the discovery endpoint, the network provider found an entry for login.microsoftonline.com ? True. \r\n2026-08-22T17:22:37.6744328Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Authority validation enabled? True. \r\n2026-08-22T17:22:37.6750062Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Authority validation - is known env? True. \r\n2026-08-22T17:22:37.6927120Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Starting TokenClient:SendTokenRequestAsync\r\n2026-08-22T17:22:37.6964240Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [TokenClient] Before adding the client assertion / secret\r\n2026-08-22T17:22:37.6972185Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Building assertion from certificate with clientId: 0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f at endpoint: https://login.microsoftonline.com/33e01921-4d64-4f8c-a055-5bdaffd5e33d/oauth2/v2.0/token\r\n2026-08-22T17:22:37.6972185Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Proceeding with JWT token creation and adding client assertion.\r\n2026-08-22T17:22:37.7301906Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [TokenClient] After adding the client assertion / secret\r\n2026-08-22T17:22:37.7417843Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [Token Client] Fetching MsalTokenResponse .... \r\n2026-08-22T17:22:37.7417843Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Starting [Oauth2Client] Sending POST request \r\n2026-08-22T17:22:37.7478019Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Starting [HttpManager] ExecuteAsync\r\n2026-08-22T17:22:37.7478019Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [HttpManager] Sending request. Method: POST. Host: https://login.microsoftonline.com. Binding Certificate: False \r\n2026-08-22T17:22:37.8541138Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [HttpManager] Received response. Status code: OK. \r\n2026-08-22T17:22:37.8541138Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Finished [HttpManager] ExecuteAsync in 105 ms\r\n2026-08-22T17:22:37.8541138Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Finished [Oauth2Client] Sending POST request in 111 ms\r\n2026-08-22T17:22:37.8541138Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Starting [OAuth2Client] Deserializing response\r\n2026-08-22T17:22:37.8665996Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Finished [OAuth2Client] Deserializing response in 13 ms\r\n2026-08-22T17:22:37.8682351Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] ScopeSet was missing from the token response, so using developer provided scopes in the result. \r\n2026-08-22T17:22:37.8682351Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Finished TokenClient:SendTokenRequestAsync in 175 ms\r\n2026-08-22T17:22:37.8702417Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Checking client info returned from the server..\r\n2026-08-22T17:22:37.8702417Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Saving token response to cache..\r\n2026-08-22T17:22:37.8803251Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] \r\n[MsalTokenResponse]\r\nError: \r\nErrorDescription: \r\nScopes: https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com/.default\r\nExpiresIn: 86399\r\nRefreshIn: 43199\r\nAccessToken returned: True\r\nAccessToken Type: Bearer\r\nRefreshToken returned: False\r\nIdToken returned: False\r\nClientInfo returned: False\r\nFamilyId: \r\nWamAccountId exists: False\r\n2026-08-22T17:22:37.8803251Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [SaveTokenResponseAsync] ID Token not present in response. \r\n2026-08-22T17:22:37.8824512Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Cannot determine home account ID - or id token or no client info and no subject \r\n2026-08-22T17:22:37.8880895Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [SaveTokenResponseAsync] Entering token cache semaphore. Count Real semaphore: True. Count: 1.\r\n2026-08-22T17:22:37.8889675Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [SaveTokenResponseAsync] Entered token cache semaphore. \r\n2026-08-22T17:22:37.8889675Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [SaveTokenResponseAsync] Saving AT in cache and removing overlapping ATs...\r\n2026-08-22T17:22:37.8908846Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Looking for scopes for the authority in the cache which intersect with https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com/.default\r\n2026-08-22T17:22:37.8908846Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z] [Internal cache] Total number of cache partitions found while getting access tokens: 0\r\n2026-08-22T17:22:37.8916782Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Intersecting scope entries count - 0\r\n2026-08-22T17:22:37.8928967Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Not saving to ADAL legacy cache. \r\n2026-08-22T17:22:37.8936884Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] [SaveTokenResponseAsync] Released token cache semaphore. \r\n2026-08-22T17:22:37.8974559Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] \r\n\t=== Token Acquisition finished successfully:\r\n2026-08-22T17:22:37.8981760Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] AT expiration time: 8/23/2026 5:22:36 PM +00:00, scopes: https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com/.default. source: IdentityProvider\r\n2026-08-22T17:22:37.8981760Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] Fetched access token from host login.microsoftonline.com. \r\n2026-08-22T17:22:37.9002367Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] \r\n[LogMetricsFromAuthResult] Cache Refresh Reason: NoCachedAccessToken\r\n[LogMetricsFromAuthResult] DurationInCacheInMs: 0\r\n[LogMetricsFromAuthResult] DurationTotalInMs: 1053\r\n[LogMetricsFromAuthResult] DurationInHttpInMs: 678\r\n2026-08-22T17:22:37.9002367Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:37Z - 37a6f05d-aa4a-4658-a194-7cd866852a2c] TokenEndpoint: ****\r\n2026-08-22T17:22:37.9238787Z:Use AAD token. CERT\r\n2026-08-22T17:22:37.9403421Z:New Token Acquisition Time: 00:00:01.1492825\r\n2026-08-22T17:22:37.9721783Z:Gateway Client: the client id that is sending a request is: 56418694-1408-4f4d-9ee5-6043e6ef3665\r\n2026-08-22T17:22:38.4462903Z:Gateway Client: response send time from cloud gateway: 2026-08-22T17:22:38.3903375+00:00\r\n2026-08-22T17:22:38.4468116Z:Gateway Client: response receive time from client SendAsync: 2026-08-22T17:22:38.4468116+00:00\r\n2026-08-22T17:22:38.4468116Z:Gateway Client: response duration time between cloud gateway and client SendAsync: 00:00:00.0564741\r\n2026-08-22T17:22:38.5489465Z:Session request requestid: 05faaf95-294a-46b7-85ae-6048982a514f, and submission status is: Pass\r\n2026-08-22T17:22:38.6072903Z:Provision storage complete. Total shards: 100\r\n2026-08-22T17:22:38.6116593Z:Loading DigestSignErrorMappingCache mapping info\r\n2026-08-22T17:22:38.6206848Z:DigestSignErrorMappingCache from server, # of DigestSignOperationErrorPatterns object we get is :: \r\n2026-08-22T17:22:38.6485385Z:Consolidate DigestSignErrorMappingCache, # of DigestSignOperationErrorPatterns object we get is :: 34\r\n2026-08-22T17:22:38.6485385Z:Successfully retrieved policy: policy is {\"policy\":{\"id\":\"0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f-0\",\"workflowExecutionType\":3}}\r\n2026-08-22T17:22:38.6603493Z:Successfully get telemetry connection string: Endpo......\r\n2026-08-22T17:22:38.6622664Z:Warning: \r\n2026-08-22T17:22:38.6657671Z:IAuthInfo constructed: {\r\n \"authenticationType\": \"AAD_CERT\",\r\n \"clientId\": \"0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f\",\r\n \"tenantId\": \"33e01921-4d64-4f8c-a055-5bdaffd5e33d\",\r\n \"aadAuthorityBaseUri\": \"https://login.microsoftonline.com/\",\r\n \"authCert\": {\r\n \"storeLocation\": \"LocalMachine\",\r\n \"storeName\": \"My\",\r\n \"subjectName\": \"CN=0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f.microsoft.com\",\r\n \"sendX5c\": true,\r\n \"withAzureRegion\": false,\r\n \"getCertFromKeyVault\": false,\r\n \"keyVaultName\": null,\r\n \"keyVaultCertName\": null\r\n },\r\n \"requestSigningCert\": {\r\n \"storeLocation\": \"LocalMachine\",\r\n \"storeName\": \"My\",\r\n \"subjectName\": \"CN=0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f\",\r\n \"sendX5c\": false,\r\n \"withAzureRegion\": false,\r\n \"getCertFromKeyVault\": false,\r\n \"keyVaultName\": null,\r\n \"keyVaultCertName\": null\r\n },\r\n \"oAuthToken\": null,\r\n \"version\": \"1.0.0\",\r\n \"esrpClientId\": \"0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f\",\r\n \"federatedTokenData\": null,\r\n \"federatedTokenPath\": null\r\n}\r\n2026-08-22T17:22:38.6670942Z:IPolicyInfo constructed: {\r\n \"intent\": \"digestsign\",\r\n \"contentType\": \"Bin\",\r\n \"contentOrigin\": \"3rd Party\",\r\n \"productState\": null,\r\n \"audience\": \"External Broad\",\r\n \"version\": \"1.0.0\"\r\n}\r\n2026-08-22T17:22:38.6712134Z:IConfigInfo constructed: {\r\n \"esrpApiBaseUri\": \"https://api.esrp.microsoft.com/api/v2/\",\r\n \"esrpSessionTimeoutInSec\": 60,\r\n \"minThreadPoolThreads\": 256,\r\n \"maxDegreeOfParallelism\": 256,\r\n \"exponentialFirstFastRetry\": true,\r\n \"exponentialRetryCount\": 2,\r\n \"exponentialRetryDeltaBackOff\": \"00:00:05\",\r\n \"exponentialRetryMaxBackOff\": \"00:01:00\",\r\n \"exponentialRetryMinBackOff\": \"00:00:03\",\r\n \"appDataFolder\": \"C:\\\\Windows\\\\ServiceProfiles\\\\NetworkService\\\\AppData\\\\Local\",\r\n \"certificateCacheFolder\": null,\r\n \"version\": \"1.0.0\",\r\n \"exitOnFlaggedFile\": false,\r\n \"flaggedFileClientWaitTimeout\": \"1.00:00:00\",\r\n \"servicePointManagerDefaultConnectionLimit\": 256,\r\n \"isOnPremGateway\": false,\r\n \"diagnosticListeners\": null,\r\n \"securityProtocolType\": \"Tls12\",\r\n \"parallelOperationsInFileUploadDownload\": 300,\r\n \"maxTelemetryBuffer\": 200000,\r\n \"telemetryTimeoutInSec\": 0,\r\n \"resourceUri\": \"https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com\",\r\n \"cacheRootFolder\": null,\r\n \"cachedFileTTLInMin\": 7200\r\n}\r\n2026-08-22T17:22:38.9306656Z:Client Telemetry: Xpert agent is not running on the machine. Using events hub for processing client telemetry.\r\n2026-08-22T17:22:39.1398942Z:Key: TotalSignOperationDataCount, Value: 1\r\n2026-08-22T17:22:39.1567147Z:Start Time:8/22/2026 5:22:39 PM, Starting the sign workflow...\r\n2026-08-22T17:22:39.1717869Z:some input info: {\r\n \"contextData\": {\r\n \"build_buildnumber\": \"AzureDevOps_M277_20260731.2\",\r\n \"esrpClientVersion\": \"1.2.142+Branch.master.Sha.90404b43284ec55b3e2251d0e272f8932aa583e2\",\r\n \"userIpAddress\": \"10.0.0.132\",\r\n \"userAgent\": \"at-greenZ06UG8\"\r\n },\r\n \"sourceDirectory\": null,\r\n \"sourceLocation\": \"c:\\\\Temp\\\\AzureTemp\\\\kyslo4rp.o0z\\\\manifest.cat\",\r\n \"destinationDirectory\": null,\r\n \"destinationLocation\": \"c:\\\\Temp\\\\AzureTemp\\\\kyslo4rp.o0z\\\\manifest.cat\",\r\n \"sizeInBytes\": 0,\r\n \"name\": \"manifest.cat\",\r\n \"isSuccess\": null,\r\n \"operationStartedAt\": \"0001-01-01T00:00:00+00:00\",\r\n \"operationEndedAt\": \"0001-01-01T00:00:00+00:00\",\r\n \"operationDurationMS\": 0,\r\n \"processName\": \"EsrpClient\",\r\n \"processId\": 3672,\r\n \"processVersion\": \"1.2.142+Branch.master.Sha.90404b43284ec55b3e2251d0e272f8932aa583e2\",\r\n \"customerCorrelationId\": null,\r\n \"esrpClientSessionGuid\": \"ae828864-37b0-434f-b461-cc263b4cfb43\",\r\n \"callerProgram\": \"EsrpClient\",\r\n \"indentity\": \"NT AUTHORITY\\\\NETWORK SERVICE\",\r\n \"clientId\": \"0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f\",\r\n \"exceptionData\": null,\r\n \"apiBaseUrl\": \"https://api.esrp.microsoft.com/api/v2/\",\r\n \"handlerWorkflow\": \"Sign\",\r\n \"submissionRequest\": {\r\n \"contextData\": {\r\n \"build_buildnumber\": \"AzureDevOps_M277_20260731.2\",\r\n \"esrpClientVersion\": \"1.2.142+Branch.master.Sha.90404b43284ec55b3e2251d0e272f8932aa583e2\",\r\n \"userIpAddress\": \"10.0.0.132\",\r\n \"userAgent\": \"at-greenZ06UG8\"\r\n },\r\n \"groupId\": null,\r\n \"correlationVector\": \"8c39df38-4b7f-45ff-8ffa-f40c61aaea5b\",\r\n \"driEmail\": null,\r\n \"version\": \"1.0.0\"\r\n },\r\n \"policyInfo\": {\r\n \"intent\": \"digestsign\",\r\n \"contentType\": \"Bin\",\r\n \"contentOrigin\": \"3rd Party\",\r\n \"productState\": null,\r\n \"audience\": \"External Broad\",\r\n \"version\": \"1.0.0\"\r\n },\r\n \"osVersion\": \"Microsoft Windows NT 10.0.26100.0\",\r\n \"executingMachineIPAddress\": \"10.0.0.132\"\r\n}\r\n2026-08-22T17:22:39.2174706Z:Executing SignWorkflowType is DigestSignStaticAzure\r\n2026-08-22T17:22:39.2322842Z:Source file \"c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\" hashed in 3 ms\r\n2026-08-22T17:22:39.2806338Z:Thread: 1 - Certificate file mutex \"pmm7CJac/B8HHqftKR7wLy7pp9OSyyLIDCxlkD27szg=_CP-464321\" acquired (waited 0 ms).\r\nMSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:39Z] ConfidentialClientApplication 44123454 created\r\n2026-08-22T17:22:39.2934550Z:Gateway Client: Enter AuthenticationProvider, no calls to AAD yet, client id is 0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f, and resource url is https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com, tenant id is 33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:22:39.2938039Z:Cached token found with name: api.esrp.microsoft.com_0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f_33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:22:39.2938039Z:AAD auth caching is in use with this name: api.esrp.microsoft.com_0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f_33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:22:39.3870909Z:Global cached token is valid from 8/22/2026 5:17:37 PM to 8/23/2026 5:22:37 PM (UTC). Total validity from current time is 86397.61427 seconds\r\n2026-08-22T17:22:39.3870909Z:Validate and Renew Token if necessary finished: 00:00:00.0924533\r\nMSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:39Z] ConfidentialClientApplication 20852350 created\r\n2026-08-22T17:22:39.3870909Z:Gateway Client: Enter AuthenticationProvider, no calls to AAD yet, client id is 0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f, and resource url is https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com, tenant id is 33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:22:39.3870909Z:Gateway Client: a new client and client id is created: 44494471-e4b1-4f8d-af83-8f1110c584c5\r\n2026-08-22T17:22:39.3870909Z:8/22/2026 5:22:39 PM +00:00:Digest Signing Factory Client type loaded is - [AzureGatewaySubmitter].\r\n2026-08-22T17:22:39.3977456Z:Existing Token Acquisition Time: 00:00:00.0005424\r\n2026-08-22T17:22:39.4749633Z:Gateway Client: the client id that is sending a request is: 44494471-e4b1-4f8d-af83-8f1110c584c5\r\n2026-08-22T17:22:39.6074255Z:Gateway Client: response send time from cloud gateway: 2026-08-22T17:22:39.5690333+00:00\r\n2026-08-22T17:22:39.6074255Z:Gateway Client: response receive time from client SendAsync: 2026-08-22T17:22:39.6074255+00:00\r\n2026-08-22T17:22:39.6074255Z:Gateway Client: response duration time between cloud gateway and client SendAsync: 00:00:00.0383922\r\n2026-08-22T17:22:39.6078170Z:Gateway Client: response time after converting from http response to object: 2026-08-22T17:22:39.6078170+00:00\r\n2026-08-22T17:22:40.0056547Z:Client Telemetry: Events published in this batch: 4\r\n2026-08-22T17:22:40.0056547Z:Client Telemetry: Events received so far in this session: 4\r\n2026-08-22T17:22:40.0056547Z:Client Telemetry: Events published so far in this session: 4\r\n2026-08-22T17:22:40.1287555Z:Existing Token Acquisition Time: 00:00:00.0008607\r\n2026-08-22T17:22:40.1323593Z:Gateway Client: the client id that is sending a request is: 44494471-e4b1-4f8d-af83-8f1110c584c5\r\n2026-08-22T17:22:40.2300681Z:Gateway Client: response send time from cloud gateway: 2026-08-22T17:22:40.1931448+00:00\r\n2026-08-22T17:22:40.2300681Z:Gateway Client: response receive time from client SendAsync: 2026-08-22T17:22:40.2300681+00:00\r\n2026-08-22T17:22:40.2300681Z:Gateway Client: response duration time between cloud gateway and client SendAsync: 00:00:00.0369233\r\n2026-08-22T17:22:40.2385422Z:Gateway Client: response time after converting from http response to object: 2026-08-22T17:22:40.2385422+00:00\r\n2026-08-22T17:22:40.2431991Z:Reading thumbprint from \"C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\EsrpClient_ae82886437b0434fb461cc263b4cfb43\\Certificates\\CP-464321.p7b\" (9692 bytes)...\r\n2026-08-22T17:22:40.2728236Z:Thread: 1 - Wrote new certificate file to \"C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\EsrpClient_ae82886437b0434fb461cc263b4cfb43\\Certificates\\CP-464321.p7b\".\r\n2026-08-22T17:22:40.2728236Z:Thread: 1 - Certificate file mutex \"pmm7CJac/B8HHqftKR7wLy7pp9OSyyLIDCxlkD27szg=_CP-464321\" released (held for 993 ms).\r\n2026-08-22T17:22:40.2748334Z:digest sign request expire time is: 8/22/2026 5:23:38 PM\r\n2026-08-22T17:22:43.1993429Z:Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe sign /NPH /fd \"SHA256\" /f \"C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\EsrpClient_ae82886437b0434fb461cc263b4cfb43\\Certificates\\CP-464321.p7b\" /sha1 \"464FA2A9D4A43EA5C3E53CE4562B501CB6EFA47F\" /du \"https://www.1eswiki.com/wiki/ADO_Manifest_Generator\" /d \"Packaging SSSC Codesign - DigestSign\" /tr \"http://aztss.trafficmanager.net/TSS/HttpTspServer\" /td sha256 /dlib \"c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\EsrpClient.Sign.DigestSignLib.dll\" /dmdf \"C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\EsrpClient_ae82886437b0434fb461cc263b4cfb43\\3E2AC47576B149DFB48D6DB7A832961E.json\" \"c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\" completed in 2923 ms\r\nExit Code: 0\r\nStdOut:\r\nDone Adding Additional Store\r\n\r\nESRP Digest Signing\r\n\r\n2026-08-22T17:22:41.2392943Z:Digest Signer : SecurityProtocolType used from the metadata info is : Tls12\r\nMSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:41Z] ConfidentialClientApplication 654897 created\r\n2026-08-22T17:22:41.3890980Z:Cached token found with name: api.esrp.microsoft.com_0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f_33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:22:41.3905372Z:AAD auth caching is in use with this name: api.esrp.microsoft.com_0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f_33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:22:41.5058348Z:Global cached token is valid from 8/22/2026 5:17:37 PM to 8/23/2026 5:22:37 PM (UTC). Total validity from current time is 86395.4947855 seconds\r\n2026-08-22T17:22:41.5058348Z:Validate and Renew Token if necessary finished: 00:00:00.1141863\r\nMSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:22:41Z] ConfidentialClientApplication 49044892 created\r\n2026-08-22T17:22:41.5791039Z:Existing Token Acquisition Time: 00:00:00.0030756\r\n2026-08-22T17:22:42.2913876Z:Gateway Submission Request Signing Time: 00:00:00.1128922\r\n2026-08-22T17:22:42.2913876Z:Gateway Submission Request Send Time: 00:00:00.5774065\r\n2026-08-22T17:22:42.2913876Z:Gateway Submission Overall Submission Time: 00:00:00.7083857\r\n2026-08-22T17:22:42.2913876Z:Operation ID: 03132a5b-ab9c-47ae-948a-900b025ccbf9\r\n2026-08-22T17:22:42.7963691Z:Gateway Status Delay Time: 00:00:00.5059237\r\n2026-08-22T17:22:42.8091431Z:Existing Token Acquisition Time: 00:00:00.0010330\r\n2026-08-22T17:22:42.9076719Z:Gateway Status Request Send Time: 00:00:00.0926291\r\n2026-08-22T17:22:42.9076719Z:Gateway Status Overall Time: 00:00:00.0951967\r\n2026-08-22T17:22:42.9163863Z:Gateway Submission Duration: 1049\r\n2026-08-22T17:22:42.9163863Z:Gateway Submission Attempts: 1\r\n2026-08-22T17:22:42.9163863Z:Gateway GetStatus Duration: 109\r\n2026-08-22T17:22:42.9163863Z:Gateway GetStatus Attempts: 1\r\n2026-08-22T17:22:42.9163863Z:$$5a9f5111cf8f42a0a0edc419862b95dc##_ThrottleCount: 0\r\n2026-08-22T17:22:42.9163863Z:$$65265a48891640eb86e148d3c9a627fa##_ThrottledTimeInSec: 0\r\n2026-08-22T17:22:42.9163863Z:Service Call: 1814.0533 ms\r\nSuccessfully signed: c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\r\n\r\n\r\n\r\nStdErr:\r\n\r\n\r\n\r\n\r\n2026-08-22T17:22:43.3994473Z:Warning: Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\" failed\r\nExit Code: 1\r\nStdOut:\r\nFile: c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\r\nIndex Algorithm Timestamp \r\n========================================\r\n\r\nNumber of errors: 1\r\n\r\n\r\n\r\nStdErr:\r\nSignTool Error: A certificate chain processed, but terminated in a root\r\n\tcertificate which is not trusted by the trust provider.\r\n\r\n\r\n\r\n\r\n2026-08-22T17:22:43.4023506Z:Warning: Warning: Operation Error (1) - Operation: signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\" - Retrying in 500 ms...\r\n2026-08-22T17:22:43.5501487Z:Warning: Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\" failed\r\nExit Code: 1\r\nStdOut:\r\nFile: c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\r\nIndex Algorithm Timestamp \r\n========================================\r\n\r\nNumber of errors: 1\r\n\r\n\r\n\r\nStdErr:\r\nSignTool Error: A certificate chain processed, but terminated in a root\r\n\tcertificate which is not trusted by the trust provider.\r\n\r\n\r\n\r\n\r\n2026-08-22T17:22:43.5501487Z:Warning: Warning: Operation Error (2) - Operation: signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\" - Retrying in 500 ms...\r\n2026-08-22T17:22:43.5570429Z:Client Telemetry: Events published in this batch: 2\r\n2026-08-22T17:22:43.5570429Z:Client Telemetry: Events received so far in this session: 7\r\n2026-08-22T17:22:43.5570429Z:Client Telemetry: Events published so far in this session: 6\r\n2026-08-22T17:22:44.0763311Z:Client Telemetry: Events published in this batch: 1\r\n2026-08-22T17:22:44.0763311Z:Client Telemetry: Events received so far in this session: 7\r\n2026-08-22T17:22:44.0763311Z:Client Telemetry: Events published so far in this session: 7\r\n2026-08-22T17:22:44.1736186Z:Warning: Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\" failed\r\nExit Code: 1\r\nStdOut:\r\nFile: c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\r\nIndex Algorithm Timestamp \r\n========================================\r\n\r\nNumber of errors: 1\r\n\r\n\r\n\r\nStdErr:\r\nSignTool Error: A certificate chain processed, but terminated in a root\r\n\tcertificate which is not trusted by the trust provider.\r\n\r\n\r\n\r\n\r\n2026-08-22T17:22:44.2110285Z:\r\n2026-08-22T17:22:44.2110285Z:Error: System.AggregateException: One or more errors occurred. ---> MS.Ess.EsrpClient.Sign.Exceptions.EsrpDigestSignExecuteProcessFailedException: Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\" failed\r\nExit Code: 1\r\nStdOut:\r\nFile: c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\r\nIndex Algorithm Timestamp \r\n========================================\r\n\r\nNumber of errors: 1\r\n\r\n\r\n\r\nStdErr:\r\nSignTool Error: A certificate chain processed, but terminated in a root\r\n\tcertificate which is not trusted by the trust provider.\r\n\r\n\r\n\r\n\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass27_0.<ExecuteDigestSignOperation>b__1()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.<>c__DisplayClass1.<ExecuteAction>b__0()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.ExecuteAction[TResult](Func`1 func)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.ExecuteDigestSignOperation(Input digestSignInput, Operation digestSignOperation, SignOperationData fileEntry, SignStatusResponse completionResponse, SignCommandDefinition param, Guid correlationId, String correlationVector, CancellationToken cancellationToken, String requestId, String tmpDestinationLocation)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.DigestSignInternal(Input digestSignInput, SignCommandDefinition param, Guid& correlationId, String correlationVector, CancellationToken cancellationToken, String groupId, SignOperationData fileEntry, Int32& signedFileCount, Int32& certRefreshCount, ConcurrentBag`1 completionResponses, RetryPolicy`1 operationRetryPolicy, String dynamicCertificateFile, String dynamicCertificateThumbprint, String requestId)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass23_3.<DigestSignAsync>b__6(SignOperationData fileEntry)\r\n --- End of inner exception stack trace ---\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<DigestSignAsync>d__23.MoveNext()\r\n---> (Inner Exception #0) MS.Ess.EsrpClient.Sign.Exceptions.EsrpDigestSignExecuteProcessFailedException: Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\" failed\r\nExit Code: 1\r\nStdOut:\r\nFile: c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\r\nIndex Algorithm Timestamp \r\n========================================\r\n\r\nNumber of errors: 1\r\n\r\n\r\n\r\nStdErr:\r\nSignTool Error: A certificate chain processed, but terminated in a root\r\n\tcertificate which is not trusted by the trust provider.\r\n\r\n\r\n\r\n\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass27_0.<ExecuteDigestSignOperation>b__1()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.<>c__DisplayClass1.<ExecuteAction>b__0()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.ExecuteAction[TResult](Func`1 func)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.ExecuteDigestSignOperation(Input digestSignInput, Operation digestSignOperation, SignOperationData fileEntry, SignStatusResponse completionResponse, SignCommandDefinition param, Guid correlationId, String correlationVector, CancellationToken cancellationToken, String requestId, String tmpDestinationLocation)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.DigestSignInternal(Input digestSignInput, SignCommandDefinition param, Guid& correlationId, String correlationVector, CancellationToken cancellationToken, String groupId, SignOperationData fileEntry, Int32& signedFileCount, Int32& certRefreshCount, ConcurrentBag`1 completionResponses, RetryPolicy`1 operationRetryPolicy, String dynamicCertificateFile, String dynamicCertificateThumbprint, String requestId)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass23_3.<DigestSignAsync>b__6(SignOperationData fileEntry)<---\r\n\r\n2026-08-22T17:22:44.2486844Z:Constructing EsrpClientResponse\r\n2026-08-22T17:22:44.2491212Z:EsrpClientResponse is constructed\r\n2026-08-22T17:22:44.2834464Z:OperationDurationMs: 5040\r\n2026-08-22T17:22:44.2834464Z:DynamicCertGenerationTimeMs: 0\r\n2026-08-22T17:22:44.2834464Z:TimeToGetStorageShradsMs: 0\r\n2026-08-22T17:22:44.2834464Z:TotalScanSubmissionTimeMs: 0\r\n2026-08-22T17:22:44.2834464Z:ThrottleCount: 0\r\n2026-08-22T17:22:44.2834464Z:ThrottledTimeInSec: 0\r\n2026-08-22T17:22:44.2834464Z:\r\n2026-08-22T17:22:44.2834464Z:0/1 files signed in 00:00:05.040 (0 files/s, total number of certs refreshed: 0)\r\n2026-08-22T17:22:44.2865543Z:result json is: {\r\n \"submissionResponses\": [\r\n {\r\n \"fileStatusDetail\": [\r\n {\r\n \"sourceHash\": \"h9snX4PXk9QiAy8mxDEGsHwPj0QksAJvvl1F1VR2/HY=\",\r\n \"hashType\": \"sha256\",\r\n \"destinationHash\": null,\r\n \"certificateThumbprint\": null,\r\n \"destinationLocation\": \"c:\\\\Temp\\\\AzureTemp\\\\kyslo4rp.o0z\\\\manifest.cat\",\r\n \"destinationFileSizeInBytes\": 0,\r\n \"sourceLocation\": \"c:\\\\Temp\\\\AzureTemp\\\\kyslo4rp.o0z\\\\manifest.cat\"\r\n }\r\n ],\r\n \"operationId\": \"03132a5b-ab9c-47ae-948a-900b025ccbf9\",\r\n \"customerCorrelationId\": \"8c39df38-4b7f-45ff-8ffa-f40c61aaea5b\",\r\n \"statusCode\": \"failCanRetry\",\r\n \"errorInfo\": {\r\n \"code\": \"3138\",\r\n \"details\": {\r\n \"operation\": \"c:\\\\AT\\\\sitesroot\\\\0\\\\bin\\\\Plugins\\\\ESRPClient\\\\Win10.x86\\\\signtool.exe verify /pa /tw \\\"c:\\\\Temp\\\\AzureTemp\\\\kyslo4rp.o0z\\\\manifest.cat\\\"\",\r\n \"exitCode\": \"1\",\r\n \"stdOut\": \"File: c:\\\\Temp\\\\AzureTemp\\\\kyslo4rp.o0z\\\\manifest.cat\\r\\nIndex Algorithm Timestamp \\r\\n========================================\\r\\n\\r\\nNumber of errors: 1\\r\\n\\r\\n\\r\\n\",\r\n \"stdErr\": \"SignTool Error: A certificate chain processed, but terminated in a root\\r\\n\\tcertificate which is not trusted by the trust provider.\\r\\n\\r\\n\"\r\n },\r\n \"innerError\": null\r\n }\r\n }\r\n ],\r\n \"esrpClientSessionGuid\": \"ae828864-37b0-434f-b461-cc263b4cfb43\",\r\n \"version\": \"1.0.0\"\r\n}\r\n2026-08-22T17:22:44.3300203Z:Warning: \r\n\r\n2026-08-22T17:22:44.3300203Z:esrp-client-finalTime: 8907.58\r\n2026-08-22T17:22:44.3300203Z:Final return code is: 1\r\n2026-08-22T17:22:44.3300203Z:ClientTelemetryDispose started, this is not affecting Exe reliability, only lost telemetry if error happens ***********************\r\n2026-08-22T17:22:44.3352914Z:Client Telemetry: Flushing telemetry buffer with timeout 0 ms\r\n2026-08-22T17:22:44.3386082Z:Client Telemetry: Flushing telemetry buffer completed within timeout (true/false): False\r\n2026-08-22T17:22:44.3386082Z:Client Telemetry: Disposing telemetry buffer and event hub client\r\n2026-08-22T17:22:44.3462303Z:Client Telemetry: Events published in this batch: 4\r\n2026-08-22T17:22:44.3462303Z:Client Telemetry: Events received so far in this session: 11\r\n2026-08-22T17:22:44.3462303Z:Client Telemetry: Events published so far in this session: 11\r\n2026-08-22T17:22:44.4019248Z:event lost number: 0\r\n2026-08-22T17:22:44.4019248Z:total event processed number: 11\r\n2026-08-22T17:22:44.4019248Z:total event received number: 11\r\n2026-08-22T17:22:44.4019248Z:##EsrpClientTelemetry.TotalEventsProcessed##: 11\r\n2026-08-22T17:22:44.4019248Z:##EsrpClientTelemetry.TotalEventsReceived##: 11\r\n2026-08-22T17:22:44.4019248Z:##EsrpClientTelemetry.DisposeTimeMilliseconds##: 71\r\n2026-08-22T17:22:44.4019248Z:ClientTelemetryDispose ended ***********************\r\n","StdErr":"2026-08-22T17:22:44.2110285Z:Error: System.AggregateException: One or more errors occurred. ---> MS.Ess.EsrpClient.Sign.Exceptions.EsrpDigestSignExecuteProcessFailedException: Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\" failed\r\nExit Code: 1\r\nStdOut:\r\nFile: c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\r\nIndex Algorithm Timestamp \r\n========================================\r\n\r\nNumber of errors: 1\r\n\r\n\r\n\r\nStdErr:\r\nSignTool Error: A certificate chain processed, but terminated in a root\r\n\tcertificate which is not trusted by the trust provider.\r\n\r\n\r\n\r\n\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass27_0.<ExecuteDigestSignOperation>b__1()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.<>c__DisplayClass1.<ExecuteAction>b__0()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.ExecuteAction[TResult](Func`1 func)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.ExecuteDigestSignOperation(Input digestSignInput, Operation digestSignOperation, SignOperationData fileEntry, SignStatusResponse completionResponse, SignCommandDefinition param, Guid correlationId, String correlationVector, CancellationToken cancellationToken, String requestId, String tmpDestinationLocation)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.DigestSignInternal(Input digestSignInput, SignCommandDefinition param, Guid& correlationId, String correlationVector, CancellationToken cancellationToken, String groupId, SignOperationData fileEntry, Int32& signedFileCount, Int32& certRefreshCount, ConcurrentBag`1 completionResponses, RetryPolicy`1 operationRetryPolicy, String dynamicCertificateFile, String dynamicCertificateThumbprint, String requestId)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass23_3.<DigestSignAsync>b__6(SignOperationData fileEntry)\r\n --- End of inner exception stack trace ---\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<DigestSignAsync>d__23.MoveNext()\r\n---> (Inner Exception #0) MS.Ess.EsrpClient.Sign.Exceptions.EsrpDigestSignExecuteProcessFailedException: Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\" failed\r\nExit Code: 1\r\nStdOut:\r\nFile: c:\\Temp\\AzureTemp\\kyslo4rp.o0z\\manifest.cat\r\nIndex Algorithm Timestamp \r\n========================================\r\n\r\nNumber of errors: 1\r\n\r\n\r\n\r\nStdErr:\r\nSignTool Error: A certificate chain processed, but terminated in a root\r\n\tcertificate which is not trusted by the trust provider.\r\n\r\n\r\n\r\n\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass27_0.<ExecuteDigestSignOperation>b__1()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.<>c__DisplayClass1.<ExecuteAction>b__0()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.ExecuteAction[TResult](Func`1 func)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.ExecuteDigestSignOperation(Input digestSignInput, Operation digestSignOperation, SignOperationData fileEntry, SignStatusResponse completionResponse, SignCommandDefinition param, Guid correlationId, String correlationVector, CancellationToken cancellationToken, String requestId, String tmpDestinationLocation)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.DigestSignInternal(Input digestSignInput, SignCommandDefinition param, Guid& correlationId, String correlationVector, CancellationToken cancellationToken, String groupId, SignOperationData fileEntry, Int32& signedFileCount, Int32& certRefreshCount, ConcurrentBag`1 completionResponses, RetryPolicy`1 operationRetryPolicy, String dynamicCertificateFile, String dynamicCertificateThumbprint, String requestId)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass23_3.<DigestSignAsync>b__6(SignOperationData fileEntry)<---\r\n\r\n","ExitCode":1,"RunningTime":"00:00:09.7812727"}

package/node_modules/@microsoft/mxc-sdk/bin/arm64/_manifest/spdx_2.2/ESRPClientLogs0822172716178.json ADDED Viewed

@@ -0,0 +1 @@

+ {"StdOut":"******************************************************************************\r\nMachine Information\r\nMachine Name: at-green95FZIW\r\nMachine Ip: 10.0.0.14\r\nOperating System: Microsoft Windows NT 10.0.26100.0\r\nUser Name: at-green95FZIW$\r\nProcessor Count: 64\r\nProcess Name: EsrpClient\r\nProcess Id: 12880\r\nCaller Program: EsrpClient.exe\r\nIdentity: NT AUTHORITY\\NETWORK SERVICE\r\nProcess Version: 1.2.142+Branch.master.Sha.90404b43284ec55b3e2251d0e272f8932aa583e2\r\nProcess Bitness: 64 bit\r\n******************************************************************************\r\nCommandline received: Sign | -a | c:\\Temp\\AzureTemp\\TFSTemp\\vctmp9092_982221.json | -p | c:\\Temp\\AzureTemp\\TFSTemp\\vctmp9092_394347.json | -c | c:\\Temp\\AzureTemp\\TFSTemp\\vctmp9092_915986.json | -i | c:\\Temp\\AzureTemp\\TFSTemp\\vctmp17228_938725.json | -o | c:\\Temp\\AzureTemp\\TFSTemp\\v4D21D.tmp | -l | Verbose ESRP session Id is: c3c0a099-c6d8-488a-ae63-92c7808ed476\r\n2026-08-22T17:27:06.3874987Z:Command you are trying to use is: Sign\r\n2026-08-22T17:27:06.3955299Z:Correlation Vector for this run is: 6c68a428-e9b6-4ccb-8fa1-52ff10cfcf45\r\n2026-08-22T17:27:06.3955299Z:Groupid for this run is empty\r\n2026-08-22T17:27:06.5293318Z:request signing cert being used is this thumbprint: 88052E651561B29C26E3DCCC68EE30EF1AE88FD3 in store LocalMachine\\My\r\n2026-08-22T17:27:06.5293318Z:Both certificates validation passed.\r\n2026-08-22T17:27:06.5313330Z:The auth cert we choose to use, subject name is: CN=0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f.microsoft.com, thumbprint is: 9278C2BA9ABECFD244DB6A2BB255B03F6795E955\r\n2026-08-22T17:27:06.5993749Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z] ConfidentialClientApplication 37368736 created\r\n2026-08-22T17:27:06.5999965Z:Gateway Client: Enter AuthenticationProvider, no calls to AAD yet, client id is 0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f, and resource url is https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com, tenant id is 33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:27:06.6057682Z:There is no memory mapped file accociated with this name: api.esrp.microsoft.com_0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f_33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:27:06.6082999Z:AAD auth caching is in use with this name: api.esrp.microsoft.com_0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f_33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:27:06.6219397Z:Validate and Renew Token if necessary finished: 00:00:00.0120983\r\n2026-08-22T17:27:06.7381983Z:Session request is: {\r\n \"expiresAfter\": \"3.00:00:00\",\r\n \"partitionCount\": 0,\r\n \"isProvisionStorage\": true,\r\n \"isLegacyCopsModel\": false,\r\n \"commandName\": \"Sign\",\r\n \"intent\": \"digestsign\",\r\n \"contentType\": \"Bin\",\r\n \"contentOrigin\": \"3rd Party\",\r\n \"productState\": null,\r\n \"audience\": \"External Broad\"\r\n}\r\n2026-08-22T17:27:06.7809063Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z] ConfidentialClientApplication 29578451 created\r\n2026-08-22T17:27:06.7809063Z:Gateway Client: Enter AuthenticationProvider, no calls to AAD yet, client id is 0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f, and resource url is https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com, tenant id is 33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:27:06.7883546Z:Gateway Client: a new client and client id is created: d0a34847-72a0-477b-a934-60401702b80e\r\n2026-08-22T17:27:06.8324606Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] MSAL MSAL.Desktop with assembly version '4.70.0.0'. CorrelationId(e5e0efa2-1183-409e-8a45-c998f5bbea06)\r\n2026-08-22T17:27:06.8459810Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] === AcquireTokenForClientParameters ===\r\nSendX5C: True\r\nForceRefresh: False\r\nAccessTokenHashToRefresh: False\r\n\r\n2026-08-22T17:27:06.8602635Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] \r\n=== Request Data ===\r\nAuthority Provided? - True\r\nScopes - https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com/.default\r\nExtra Query Params Keys (space separated) - \r\nApiId - AcquireTokenForClient\r\nIsConfidentialClient - True\r\nSendX5C - True\r\nLoginHint ? False\r\nIsBrokerConfigured - False\r\nHomeAccountId - False\r\nCorrelationId - e5e0efa2-1183-409e-8a45-c998f5bbea06\r\nUserAssertion set: False\r\nLongRunningOboCacheKey set: False\r\nRegion configured: \r\n\r\n2026-08-22T17:27:06.8614053Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] === Token Acquisition (ClientCredentialRequest) started:\r\n\t Scopes: https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com/.default\r\n\tAuthority Host: login.microsoftonline.com\r\n2026-08-22T17:27:06.8899050Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [Internal cache] Total number of cache partitions found while getting access tokens: 0\r\n2026-08-22T17:27:06.8910298Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [FindAccessTokenAsync] Discovered 0 access tokens in cache using partition key: 0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f_33e01921-4d64-4f8c-a055-5bdaffd5e33d_AppTokenCache\r\n2026-08-22T17:27:06.8910298Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [FindAccessTokenAsync] No access tokens found in the cache. Skipping filtering. \r\n2026-08-22T17:27:06.9059995Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [Instance Discovery] Instance discovery is enabled and will be performed\r\n2026-08-22T17:27:06.9133030Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [Region discovery] WithAzureRegion not configured. \r\n2026-08-22T17:27:06.9133030Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [Region discovery] Not using a regional authority. \r\n2026-08-22T17:27:06.9208287Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [Instance Discovery] Tried to use network cache provider for login.microsoftonline.com. Success? False. \r\n2026-08-22T17:27:06.9322797Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Fetching instance discovery from the network from host login.microsoftonline.com. \r\n2026-08-22T17:27:06.9551371Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Starting [Oauth2Client] Sending GET request \r\n2026-08-22T17:27:06.9600705Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Starting [HttpManager] ExecuteAsync\r\n2026-08-22T17:27:06.9677072Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:06Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [HttpManager] Sending request. Method: GET. Host: https://login.microsoftonline.com. Binding Certificate: False \r\n2026-08-22T17:27:07.6091660Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [HttpManager] Received response. Status code: OK. \r\n2026-08-22T17:27:07.6253781Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Finished [HttpManager] ExecuteAsync in 666 ms\r\n2026-08-22T17:27:07.6253781Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Finished [Oauth2Client] Sending GET request in 670 ms\r\n2026-08-22T17:27:07.6358632Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Starting [OAuth2Client] Deserializing response\r\n2026-08-22T17:27:07.7740007Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Finished [OAuth2Client] Deserializing response in 137 ms\r\n2026-08-22T17:27:07.7746215Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [Instance Discovery] Tried to use network cache provider for login.microsoftonline.com. Success? True. \r\n2026-08-22T17:27:07.7746215Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [Instance Discovery] After hitting the discovery endpoint, the network provider found an entry for login.microsoftonline.com ? True. \r\n2026-08-22T17:27:07.7792434Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Authority validation enabled? True. \r\n2026-08-22T17:27:07.7792434Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Authority validation - is known env? True. \r\n2026-08-22T17:27:07.8068658Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Starting TokenClient:SendTokenRequestAsync\r\n2026-08-22T17:27:07.8104382Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [TokenClient] Before adding the client assertion / secret\r\n2026-08-22T17:27:07.8141290Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Building assertion from certificate with clientId: 0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f at endpoint: https://login.microsoftonline.com/33e01921-4d64-4f8c-a055-5bdaffd5e33d/oauth2/v2.0/token\r\n2026-08-22T17:27:07.8144297Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Proceeding with JWT token creation and adding client assertion.\r\n2026-08-22T17:27:07.8511385Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [TokenClient] After adding the client assertion / secret\r\n2026-08-22T17:27:07.8616554Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [Token Client] Fetching MsalTokenResponse .... \r\n2026-08-22T17:27:07.8620247Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Starting [Oauth2Client] Sending POST request \r\n2026-08-22T17:27:07.8682186Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Starting [HttpManager] ExecuteAsync\r\n2026-08-22T17:27:07.8682186Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:07Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [HttpManager] Sending request. Method: POST. Host: https://login.microsoftonline.com. Binding Certificate: False \r\n2026-08-22T17:27:08.1874101Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [HttpManager] Received response. Status code: OK. \r\n2026-08-22T17:27:08.1874101Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Finished [HttpManager] ExecuteAsync in 320 ms\r\n2026-08-22T17:27:08.1874101Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Finished [Oauth2Client] Sending POST request in 326 ms\r\n2026-08-22T17:27:08.1880467Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Starting [OAuth2Client] Deserializing response\r\n2026-08-22T17:27:08.2011555Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Finished [OAuth2Client] Deserializing response in 14 ms\r\n2026-08-22T17:27:08.2011555Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] ScopeSet was missing from the token response, so using developer provided scopes in the result. \r\n2026-08-22T17:27:08.2011555Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Finished TokenClient:SendTokenRequestAsync in 394 ms\r\n2026-08-22T17:27:08.2031657Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Checking client info returned from the server..\r\n2026-08-22T17:27:08.2031657Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Saving token response to cache..\r\n2026-08-22T17:27:08.2138617Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] \r\n[MsalTokenResponse]\r\nError: \r\nErrorDescription: \r\nScopes: https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com/.default\r\nExpiresIn: 86399\r\nRefreshIn: 43199\r\nAccessToken returned: True\r\nAccessToken Type: Bearer\r\nRefreshToken returned: False\r\nIdToken returned: False\r\nClientInfo returned: False\r\nFamilyId: \r\nWamAccountId exists: False\r\n2026-08-22T17:27:08.2144886Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [SaveTokenResponseAsync] ID Token not present in response. \r\n2026-08-22T17:27:08.2151210Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Cannot determine home account ID - or id token or no client info and no subject \r\n2026-08-22T17:27:08.2211404Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [SaveTokenResponseAsync] Entering token cache semaphore. Count Real semaphore: True. Count: 1.\r\n2026-08-22T17:27:08.2211404Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [SaveTokenResponseAsync] Entered token cache semaphore. \r\n2026-08-22T17:27:08.2211404Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [SaveTokenResponseAsync] Saving AT in cache and removing overlapping ATs...\r\n2026-08-22T17:27:08.2241116Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Looking for scopes for the authority in the cache which intersect with https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com/.default\r\n2026-08-22T17:27:08.2241116Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z] [Internal cache] Total number of cache partitions found while getting access tokens: 0\r\n2026-08-22T17:27:08.2244176Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Intersecting scope entries count - 0\r\n2026-08-22T17:27:08.2251492Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Not saving to ADAL legacy cache. \r\n2026-08-22T17:27:08.2251492Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] [SaveTokenResponseAsync] Released token cache semaphore. \r\n2026-08-22T17:27:08.2297345Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] \r\n\t=== Token Acquisition finished successfully:\r\n2026-08-22T17:27:08.2310207Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] AT expiration time: 8/23/2026 5:27:07 PM +00:00, scopes: https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com/.default. source: IdentityProvider\r\n2026-08-22T17:27:08.2313422Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] Fetched access token from host login.microsoftonline.com. \r\n2026-08-22T17:27:08.2327011Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] \r\n[LogMetricsFromAuthResult] Cache Refresh Reason: NoCachedAccessToken\r\n[LogMetricsFromAuthResult] DurationInCacheInMs: 0\r\n[LogMetricsFromAuthResult] DurationTotalInMs: 1379\r\n[LogMetricsFromAuthResult] DurationInHttpInMs: 959\r\n2026-08-22T17:27:08.2327011Z:MSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:08Z - e5e0efa2-1183-409e-8a45-c998f5bbea06] TokenEndpoint: ****\r\n2026-08-22T17:27:08.2487723Z:Use AAD token. CERT\r\n2026-08-22T17:27:08.2614278Z:New Token Acquisition Time: 00:00:01.4622069\r\n2026-08-22T17:27:08.2897668Z:Gateway Client: the client id that is sending a request is: d0a34847-72a0-477b-a934-60401702b80e\r\n2026-08-22T17:27:09.2392380Z:Gateway Client: response send time from cloud gateway: 2026-08-22T17:27:09.0670993+00:00\r\n2026-08-22T17:27:09.2392380Z:Gateway Client: response receive time from client SendAsync: 2026-08-22T17:27:09.2392380+00:00\r\n2026-08-22T17:27:09.2392380Z:Gateway Client: response duration time between cloud gateway and client SendAsync: 00:00:00.1721387\r\n2026-08-22T17:27:09.3397545Z:Session request requestid: ee6040c2-3742-4cb7-a19f-6326e8b9b76e, and submission status is: Pass\r\n2026-08-22T17:27:09.3976998Z:Provision storage complete. Total shards: 100\r\n2026-08-22T17:27:09.4007095Z:Loading DigestSignErrorMappingCache mapping info\r\n2026-08-22T17:27:09.4102978Z:DigestSignErrorMappingCache from server, # of DigestSignOperationErrorPatterns object we get is :: \r\n2026-08-22T17:27:09.4386690Z:Consolidate DigestSignErrorMappingCache, # of DigestSignOperationErrorPatterns object we get is :: 34\r\n2026-08-22T17:27:09.4389809Z:Successfully retrieved policy: policy is {\"policy\":{\"id\":\"0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f-0\",\"workflowExecutionType\":3}}\r\n2026-08-22T17:27:09.4481306Z:Successfully get telemetry connection string: Endpo......\r\n2026-08-22T17:27:09.4510480Z:Warning: \r\n2026-08-22T17:27:09.4545062Z:IAuthInfo constructed: {\r\n \"authenticationType\": \"AAD_CERT\",\r\n \"clientId\": \"0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f\",\r\n \"tenantId\": \"33e01921-4d64-4f8c-a055-5bdaffd5e33d\",\r\n \"aadAuthorityBaseUri\": \"https://login.microsoftonline.com/\",\r\n \"authCert\": {\r\n \"storeLocation\": \"LocalMachine\",\r\n \"storeName\": \"My\",\r\n \"subjectName\": \"CN=0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f.microsoft.com\",\r\n \"sendX5c\": true,\r\n \"withAzureRegion\": false,\r\n \"getCertFromKeyVault\": false,\r\n \"keyVaultName\": null,\r\n \"keyVaultCertName\": null\r\n },\r\n \"requestSigningCert\": {\r\n \"storeLocation\": \"LocalMachine\",\r\n \"storeName\": \"My\",\r\n \"subjectName\": \"CN=0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f\",\r\n \"sendX5c\": false,\r\n \"withAzureRegion\": false,\r\n \"getCertFromKeyVault\": false,\r\n \"keyVaultName\": null,\r\n \"keyVaultCertName\": null\r\n },\r\n \"oAuthToken\": null,\r\n \"version\": \"1.0.0\",\r\n \"esrpClientId\": \"0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f\",\r\n \"federatedTokenData\": null,\r\n \"federatedTokenPath\": null\r\n}\r\n2026-08-22T17:27:09.4556539Z:IPolicyInfo constructed: {\r\n \"intent\": \"digestsign\",\r\n \"contentType\": \"Bin\",\r\n \"contentOrigin\": \"3rd Party\",\r\n \"productState\": null,\r\n \"audience\": \"External Broad\",\r\n \"version\": \"1.0.0\"\r\n}\r\n2026-08-22T17:27:09.4602833Z:IConfigInfo constructed: {\r\n \"esrpApiBaseUri\": \"https://api.esrp.microsoft.com/api/v2/\",\r\n \"esrpSessionTimeoutInSec\": 60,\r\n \"minThreadPoolThreads\": 256,\r\n \"maxDegreeOfParallelism\": 256,\r\n \"exponentialFirstFastRetry\": true,\r\n \"exponentialRetryCount\": 2,\r\n \"exponentialRetryDeltaBackOff\": \"00:00:05\",\r\n \"exponentialRetryMaxBackOff\": \"00:01:00\",\r\n \"exponentialRetryMinBackOff\": \"00:00:03\",\r\n \"appDataFolder\": \"C:\\\\Windows\\\\ServiceProfiles\\\\NetworkService\\\\AppData\\\\Local\",\r\n \"certificateCacheFolder\": null,\r\n \"version\": \"1.0.0\",\r\n \"exitOnFlaggedFile\": false,\r\n \"flaggedFileClientWaitTimeout\": \"1.00:00:00\",\r\n \"servicePointManagerDefaultConnectionLimit\": 256,\r\n \"isOnPremGateway\": false,\r\n \"diagnosticListeners\": null,\r\n \"securityProtocolType\": \"Tls12\",\r\n \"parallelOperationsInFileUploadDownload\": 300,\r\n \"maxTelemetryBuffer\": 200000,\r\n \"telemetryTimeoutInSec\": 0,\r\n \"resourceUri\": \"https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com\",\r\n \"cacheRootFolder\": null,\r\n \"cachedFileTTLInMin\": 7200\r\n}\r\n2026-08-22T17:27:09.7750726Z:Client Telemetry: Xpert agent is not running on the machine. Using events hub for processing client telemetry.\r\n2026-08-22T17:27:10.0165400Z:Key: TotalSignOperationDataCount, Value: 1\r\n2026-08-22T17:27:10.0333652Z:Start Time:8/22/2026 5:27:10 PM, Starting the sign workflow...\r\n2026-08-22T17:27:10.0472819Z:some input info: {\r\n \"contextData\": {\r\n \"build_buildnumber\": \"AzureDevOps_M277_20260731.2\",\r\n \"esrpClientVersion\": \"1.2.142+Branch.master.Sha.90404b43284ec55b3e2251d0e272f8932aa583e2\",\r\n \"userIpAddress\": \"10.0.0.14\",\r\n \"userAgent\": \"at-green95FZIW\"\r\n },\r\n \"sourceDirectory\": null,\r\n \"sourceLocation\": \"c:\\\\Temp\\\\AzureTemp\\\\iyzzk3ae.if3\\\\manifest.cat\",\r\n \"destinationDirectory\": null,\r\n \"destinationLocation\": \"c:\\\\Temp\\\\AzureTemp\\\\iyzzk3ae.if3\\\\manifest.cat\",\r\n \"sizeInBytes\": 0,\r\n \"name\": \"manifest.cat\",\r\n \"isSuccess\": null,\r\n \"operationStartedAt\": \"0001-01-01T00:00:00+00:00\",\r\n \"operationEndedAt\": \"0001-01-01T00:00:00+00:00\",\r\n \"operationDurationMS\": 0,\r\n \"processName\": \"EsrpClient\",\r\n \"processId\": 12880,\r\n \"processVersion\": \"1.2.142+Branch.master.Sha.90404b43284ec55b3e2251d0e272f8932aa583e2\",\r\n \"customerCorrelationId\": null,\r\n \"esrpClientSessionGuid\": \"c3c0a099-c6d8-488a-ae63-92c7808ed476\",\r\n \"callerProgram\": \"EsrpClient\",\r\n \"indentity\": \"NT AUTHORITY\\\\NETWORK SERVICE\",\r\n \"clientId\": \"0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f\",\r\n \"exceptionData\": null,\r\n \"apiBaseUrl\": \"https://api.esrp.microsoft.com/api/v2/\",\r\n \"handlerWorkflow\": \"Sign\",\r\n \"submissionRequest\": {\r\n \"contextData\": {\r\n \"build_buildnumber\": \"AzureDevOps_M277_20260731.2\",\r\n \"esrpClientVersion\": \"1.2.142+Branch.master.Sha.90404b43284ec55b3e2251d0e272f8932aa583e2\",\r\n \"userIpAddress\": \"10.0.0.14\",\r\n \"userAgent\": \"at-green95FZIW\"\r\n },\r\n \"groupId\": null,\r\n \"correlationVector\": \"6c68a428-e9b6-4ccb-8fa1-52ff10cfcf45\",\r\n \"driEmail\": null,\r\n \"version\": \"1.0.0\"\r\n },\r\n \"policyInfo\": {\r\n \"intent\": \"digestsign\",\r\n \"contentType\": \"Bin\",\r\n \"contentOrigin\": \"3rd Party\",\r\n \"productState\": null,\r\n \"audience\": \"External Broad\",\r\n \"version\": \"1.0.0\"\r\n },\r\n \"osVersion\": \"Microsoft Windows NT 10.0.26100.0\",\r\n \"executingMachineIPAddress\": \"10.0.0.14\"\r\n}\r\n2026-08-22T17:27:10.0947517Z:Executing SignWorkflowType is DigestSignStaticAzure\r\n2026-08-22T17:27:10.1140611Z:Source file \"c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\" hashed in 3 ms\r\n2026-08-22T17:27:10.1726490Z:Thread: 1 - Certificate file mutex \"5wWI+048N14O75Yn0rbMdeM/SeCz5DMtrK1QZGYYQnA=_CP-464321\" acquired (waited 0 ms).\r\nMSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:10Z] ConfidentialClientApplication 44123454 created\r\n2026-08-22T17:27:10.1892687Z:Gateway Client: Enter AuthenticationProvider, no calls to AAD yet, client id is 0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f, and resource url is https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com, tenant id is 33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:27:10.1899298Z:Cached token found with name: api.esrp.microsoft.com_0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f_33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:27:10.1905351Z:AAD auth caching is in use with this name: api.esrp.microsoft.com_0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f_33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:27:10.2946141Z:Global cached token is valid from 8/22/2026 5:22:08 PM to 8/23/2026 5:27:08 PM (UTC). Total validity from current time is 86397.7058629 seconds\r\n2026-08-22T17:27:10.2946141Z:Validate and Renew Token if necessary finished: 00:00:00.1041331\r\nMSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:10Z] ConfidentialClientApplication 20852350 created\r\n2026-08-22T17:27:10.2946141Z:Gateway Client: Enter AuthenticationProvider, no calls to AAD yet, client id is 0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f, and resource url is https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com, tenant id is 33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:27:10.2949804Z:Gateway Client: a new client and client id is created: f6c451d2-5b68-4be2-a187-0dae7149410c\r\n2026-08-22T17:27:10.2949804Z:8/22/2026 5:27:10 PM +00:00:Digest Signing Factory Client type loaded is - [AzureGatewaySubmitter].\r\n2026-08-22T17:27:10.3125837Z:Existing Token Acquisition Time: 00:00:00.0005189\r\n2026-08-22T17:27:10.3987240Z:Gateway Client: the client id that is sending a request is: f6c451d2-5b68-4be2-a187-0dae7149410c\r\n2026-08-22T17:27:10.7457594Z:Gateway Client: response send time from cloud gateway: 2026-08-22T17:27:10.7029359+00:00\r\n2026-08-22T17:27:10.7457594Z:Gateway Client: response receive time from client SendAsync: 2026-08-22T17:27:10.7457594+00:00\r\n2026-08-22T17:27:10.7457594Z:Gateway Client: response duration time between cloud gateway and client SendAsync: 00:00:00.0428235\r\n2026-08-22T17:27:10.7468703Z:Gateway Client: response time after converting from http response to object: 2026-08-22T17:27:10.7468703+00:00\r\n2026-08-22T17:27:10.8832809Z:Client Telemetry: Events published in this batch: 4\r\n2026-08-22T17:27:10.8836993Z:Client Telemetry: Events received so far in this session: 4\r\n2026-08-22T17:27:10.8836993Z:Client Telemetry: Events published so far in this session: 4\r\n2026-08-22T17:27:11.2677688Z:Existing Token Acquisition Time: 00:00:00.0006489\r\n2026-08-22T17:27:11.2709981Z:Gateway Client: the client id that is sending a request is: f6c451d2-5b68-4be2-a187-0dae7149410c\r\n2026-08-22T17:27:11.5628407Z:Gateway Client: response send time from cloud gateway: 2026-08-22T17:27:11.5202724+00:00\r\n2026-08-22T17:27:11.5628407Z:Gateway Client: response receive time from client SendAsync: 2026-08-22T17:27:11.5628407+00:00\r\n2026-08-22T17:27:11.5628407Z:Gateway Client: response duration time between cloud gateway and client SendAsync: 00:00:00.0425683\r\n2026-08-22T17:27:11.5712332Z:Gateway Client: response time after converting from http response to object: 2026-08-22T17:27:11.5712332+00:00\r\n2026-08-22T17:27:11.5763438Z:Reading thumbprint from \"C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\EsrpClient_c3c0a099c6d8488aae6392c7808ed476\\Certificates\\CP-464321.p7b\" (9692 bytes)...\r\n2026-08-22T17:27:11.6148389Z:Thread: 1 - Wrote new certificate file to \"C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\EsrpClient_c3c0a099c6d8488aae6392c7808ed476\\Certificates\\CP-464321.p7b\".\r\n2026-08-22T17:27:11.6148389Z:Thread: 1 - Certificate file mutex \"5wWI+048N14O75Yn0rbMdeM/SeCz5DMtrK1QZGYYQnA=_CP-464321\" released (held for 1443 ms).\r\n2026-08-22T17:27:11.6170122Z:digest sign request expire time is: 8/22/2026 5:28:09 PM\r\n2026-08-22T17:27:14.8362284Z:Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe sign /NPH /fd \"SHA256\" /f \"C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\EsrpClient_c3c0a099c6d8488aae6392c7808ed476\\Certificates\\CP-464321.p7b\" /sha1 \"464FA2A9D4A43EA5C3E53CE4562B501CB6EFA47F\" /du \"https://www.1eswiki.com/wiki/ADO_Manifest_Generator\" /d \"Packaging SSSC Codesign - DigestSign\" /tr \"http://aztss.trafficmanager.net/TSS/HttpTspServer\" /td sha256 /dlib \"c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\EsrpClient.Sign.DigestSignLib.dll\" /dmdf \"C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\EsrpClient_c3c0a099c6d8488aae6392c7808ed476\\5303F88DBA0F4E329961977CF9B538B2.json\" \"c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\" completed in 3218 ms\r\nExit Code: 0\r\nStdOut:\r\nDone Adding Additional Store\r\n\r\nESRP Digest Signing\r\n\r\n2026-08-22T17:27:12.6297673Z:Digest Signer : SecurityProtocolType used from the metadata info is : Tls12\r\nMSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:12Z] ConfidentialClientApplication 654897 created\r\n2026-08-22T17:27:12.8034486Z:Cached token found with name: api.esrp.microsoft.com_0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f_33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:27:12.8054591Z:AAD auth caching is in use with this name: api.esrp.microsoft.com_0d3b5b1a-8684-4f3a-b294-66c3b9aa8c8f_33e01921-4d64-4f8c-a055-5bdaffd5e33d\r\n2026-08-22T17:27:12.9372554Z:Global cached token is valid from 8/22/2026 5:22:08 PM to 8/23/2026 5:27:08 PM (UTC). Total validity from current time is 86395.0640792 seconds\r\n2026-08-22T17:27:12.9375844Z:Validate and Renew Token if necessary finished: 00:00:00.1311048\r\nMSAL logging: False MSAL 4.70.0.0 MSAL.Desktop 4.8 or later Windows Server 2025 Datacenter Azure Edition [2026-08-22 17:27:12Z] ConfidentialClientApplication 49044892 created\r\n2026-08-22T17:27:13.0241725Z:Existing Token Acquisition Time: 00:00:00.0034202\r\n2026-08-22T17:27:13.6577792Z:Gateway Submission Request Signing Time: 00:00:00.1534210\r\n2026-08-22T17:27:13.6577792Z:Gateway Submission Request Send Time: 00:00:00.4579844\r\n2026-08-22T17:27:13.6577792Z:Gateway Submission Overall Submission Time: 00:00:00.6301477\r\n2026-08-22T17:27:13.6577792Z:Operation ID: 2b08f97b-943a-4f67-80ac-015cc222e5e0\r\n2026-08-22T17:27:14.1671306Z:Gateway Status Delay Time: 00:00:00.5092300\r\n2026-08-22T17:27:14.1775825Z:Existing Token Acquisition Time: 00:00:00.0008667\r\n2026-08-22T17:27:14.2431828Z:Gateway Status Request Send Time: 00:00:00.0601462\r\n2026-08-22T17:27:14.2431828Z:Gateway Status Overall Time: 00:00:00.0627657\r\n2026-08-22T17:27:14.2577159Z:Gateway Submission Duration: 1024\r\n2026-08-22T17:27:14.2577159Z:Gateway Submission Attempts: 1\r\n2026-08-22T17:27:14.2577159Z:Gateway GetStatus Duration: 76\r\n2026-08-22T17:27:14.2577159Z:Gateway GetStatus Attempts: 1\r\n2026-08-22T17:27:14.2577159Z:$$5a9f5111cf8f42a0a0edc419862b95dc##_ThrottleCount: 0\r\n2026-08-22T17:27:14.2577159Z:$$65265a48891640eb86e148d3c9a627fa##_ThrottledTimeInSec: 0\r\n2026-08-22T17:27:14.2577159Z:Service Call: 1788.6385 ms\r\nSuccessfully signed: c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\r\n\r\n\r\n\r\nStdErr:\r\n\r\n\r\n\r\n\r\n2026-08-22T17:27:14.9309927Z:Client Telemetry: Events published in this batch: 1\r\n2026-08-22T17:27:14.9312954Z:Client Telemetry: Events received so far in this session: 5\r\n2026-08-22T17:27:14.9312954Z:Client Telemetry: Events published so far in this session: 5\r\n2026-08-22T17:27:15.0546706Z:Warning: Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\" failed\r\nExit Code: 1\r\nStdOut:\r\nFile: c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\r\nIndex Algorithm Timestamp \r\n========================================\r\n\r\nNumber of errors: 1\r\n\r\n\r\n\r\nStdErr:\r\nSignTool Error: A certificate chain processed, but terminated in a root\r\n\tcertificate which is not trusted by the trust provider.\r\n\r\n\r\n\r\n\r\n2026-08-22T17:27:15.0566781Z:Warning: Warning: Operation Error (1) - Operation: signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\" - Retrying in 500 ms...\r\n2026-08-22T17:27:15.2257891Z:Warning: Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\" failed\r\nExit Code: 1\r\nStdOut:\r\nFile: c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\r\nIndex Algorithm Timestamp \r\n========================================\r\n\r\nNumber of errors: 1\r\n\r\n\r\n\r\nStdErr:\r\nSignTool Error: A certificate chain processed, but terminated in a root\r\n\tcertificate which is not trusted by the trust provider.\r\n\r\n\r\n\r\n\r\n2026-08-22T17:27:15.2257891Z:Warning: Warning: Operation Error (2) - Operation: signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\" - Retrying in 500 ms...\r\n2026-08-22T17:27:15.4389493Z:Client Telemetry: Events published in this batch: 2\r\n2026-08-22T17:27:15.4389493Z:Client Telemetry: Events received so far in this session: 7\r\n2026-08-22T17:27:15.4389493Z:Client Telemetry: Events published so far in this session: 7\r\n2026-08-22T17:27:15.8614237Z:Warning: Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\" failed\r\nExit Code: 1\r\nStdOut:\r\nFile: c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\r\nIndex Algorithm Timestamp \r\n========================================\r\n\r\nNumber of errors: 1\r\n\r\n\r\n\r\nStdErr:\r\nSignTool Error: A certificate chain processed, but terminated in a root\r\n\tcertificate which is not trusted by the trust provider.\r\n\r\n\r\n\r\n\r\n2026-08-22T17:27:15.8983852Z:\r\n2026-08-22T17:27:15.8986976Z:Error: System.AggregateException: One or more errors occurred. ---> MS.Ess.EsrpClient.Sign.Exceptions.EsrpDigestSignExecuteProcessFailedException: Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\" failed\r\nExit Code: 1\r\nStdOut:\r\nFile: c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\r\nIndex Algorithm Timestamp \r\n========================================\r\n\r\nNumber of errors: 1\r\n\r\n\r\n\r\nStdErr:\r\nSignTool Error: A certificate chain processed, but terminated in a root\r\n\tcertificate which is not trusted by the trust provider.\r\n\r\n\r\n\r\n\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass27_0.<ExecuteDigestSignOperation>b__1()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.<>c__DisplayClass1.<ExecuteAction>b__0()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.ExecuteAction[TResult](Func`1 func)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.ExecuteDigestSignOperation(Input digestSignInput, Operation digestSignOperation, SignOperationData fileEntry, SignStatusResponse completionResponse, SignCommandDefinition param, Guid correlationId, String correlationVector, CancellationToken cancellationToken, String requestId, String tmpDestinationLocation)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.DigestSignInternal(Input digestSignInput, SignCommandDefinition param, Guid& correlationId, String correlationVector, CancellationToken cancellationToken, String groupId, SignOperationData fileEntry, Int32& signedFileCount, Int32& certRefreshCount, ConcurrentBag`1 completionResponses, RetryPolicy`1 operationRetryPolicy, String dynamicCertificateFile, String dynamicCertificateThumbprint, String requestId)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass23_3.<DigestSignAsync>b__6(SignOperationData fileEntry)\r\n --- End of inner exception stack trace ---\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<DigestSignAsync>d__23.MoveNext()\r\n---> (Inner Exception #0) MS.Ess.EsrpClient.Sign.Exceptions.EsrpDigestSignExecuteProcessFailedException: Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\" failed\r\nExit Code: 1\r\nStdOut:\r\nFile: c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\r\nIndex Algorithm Timestamp \r\n========================================\r\n\r\nNumber of errors: 1\r\n\r\n\r\n\r\nStdErr:\r\nSignTool Error: A certificate chain processed, but terminated in a root\r\n\tcertificate which is not trusted by the trust provider.\r\n\r\n\r\n\r\n\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass27_0.<ExecuteDigestSignOperation>b__1()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.<>c__DisplayClass1.<ExecuteAction>b__0()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.ExecuteAction[TResult](Func`1 func)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.ExecuteDigestSignOperation(Input digestSignInput, Operation digestSignOperation, SignOperationData fileEntry, SignStatusResponse completionResponse, SignCommandDefinition param, Guid correlationId, String correlationVector, CancellationToken cancellationToken, String requestId, String tmpDestinationLocation)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.DigestSignInternal(Input digestSignInput, SignCommandDefinition param, Guid& correlationId, String correlationVector, CancellationToken cancellationToken, String groupId, SignOperationData fileEntry, Int32& signedFileCount, Int32& certRefreshCount, ConcurrentBag`1 completionResponses, RetryPolicy`1 operationRetryPolicy, String dynamicCertificateFile, String dynamicCertificateThumbprint, String requestId)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass23_3.<DigestSignAsync>b__6(SignOperationData fileEntry)<---\r\n\r\n2026-08-22T17:27:15.9348268Z:Constructing EsrpClientResponse\r\n2026-08-22T17:27:15.9360802Z:EsrpClientResponse is constructed\r\n2026-08-22T17:27:15.9526635Z:Client Telemetry: Events published in this batch: 2\r\n2026-08-22T17:27:15.9526635Z:Client Telemetry: Events received so far in this session: 9\r\n2026-08-22T17:27:15.9526635Z:Client Telemetry: Events published so far in this session: 9\r\n2026-08-22T17:27:15.9783730Z:OperationDurationMs: 5850\r\n2026-08-22T17:27:15.9783730Z:DynamicCertGenerationTimeMs: 0\r\n2026-08-22T17:27:15.9783730Z:TimeToGetStorageShradsMs: 0\r\n2026-08-22T17:27:15.9783730Z:TotalScanSubmissionTimeMs: 0\r\n2026-08-22T17:27:15.9783730Z:ThrottleCount: 0\r\n2026-08-22T17:27:15.9783730Z:ThrottledTimeInSec: 0\r\n2026-08-22T17:27:15.9783730Z:\r\n2026-08-22T17:27:15.9783730Z:0/1 files signed in 00:00:05.850 (0 files/s, total number of certs refreshed: 0)\r\n2026-08-22T17:27:15.9838488Z:result json is: {\r\n \"submissionResponses\": [\r\n {\r\n \"fileStatusDetail\": [\r\n {\r\n \"sourceHash\": \"VYYuQDm1bQP3N3Dz1ppCRw03ByVA+jHkOUQ7ONlRJYI=\",\r\n \"hashType\": \"sha256\",\r\n \"destinationHash\": null,\r\n \"certificateThumbprint\": null,\r\n \"destinationLocation\": \"c:\\\\Temp\\\\AzureTemp\\\\iyzzk3ae.if3\\\\manifest.cat\",\r\n \"destinationFileSizeInBytes\": 0,\r\n \"sourceLocation\": \"c:\\\\Temp\\\\AzureTemp\\\\iyzzk3ae.if3\\\\manifest.cat\"\r\n }\r\n ],\r\n \"operationId\": \"2b08f97b-943a-4f67-80ac-015cc222e5e0\",\r\n \"customerCorrelationId\": \"6c68a428-e9b6-4ccb-8fa1-52ff10cfcf45\",\r\n \"statusCode\": \"failCanRetry\",\r\n \"errorInfo\": {\r\n \"code\": \"3138\",\r\n \"details\": {\r\n \"operation\": \"c:\\\\AT\\\\sitesroot\\\\0\\\\bin\\\\Plugins\\\\ESRPClient\\\\Win10.x86\\\\signtool.exe verify /pa /tw \\\"c:\\\\Temp\\\\AzureTemp\\\\iyzzk3ae.if3\\\\manifest.cat\\\"\",\r\n \"exitCode\": \"1\",\r\n \"stdOut\": \"File: c:\\\\Temp\\\\AzureTemp\\\\iyzzk3ae.if3\\\\manifest.cat\\r\\nIndex Algorithm Timestamp \\r\\n========================================\\r\\n\\r\\nNumber of errors: 1\\r\\n\\r\\n\\r\\n\",\r\n \"stdErr\": \"SignTool Error: A certificate chain processed, but terminated in a root\\r\\n\\tcertificate which is not trusted by the trust provider.\\r\\n\\r\\n\"\r\n },\r\n \"innerError\": null\r\n }\r\n }\r\n ],\r\n \"esrpClientSessionGuid\": \"c3c0a099-c6d8-488a-ae63-92c7808ed476\",\r\n \"version\": \"1.0.0\"\r\n}\r\n2026-08-22T17:27:16.0342302Z:Warning: \r\n\r\n2026-08-22T17:27:16.0342302Z:esrp-client-finalTime: 10704.0711\r\n2026-08-22T17:27:16.0342302Z:Final return code is: 1\r\n2026-08-22T17:27:16.0342302Z:ClientTelemetryDispose started, this is not affecting Exe reliability, only lost telemetry if error happens ***********************\r\n2026-08-22T17:27:16.0395764Z:Client Telemetry: Flushing telemetry buffer with timeout 0 ms\r\n2026-08-22T17:27:16.0416201Z:Client Telemetry: Flushing telemetry buffer completed within timeout (true/false): False\r\n2026-08-22T17:27:16.0416201Z:Client Telemetry: Disposing telemetry buffer and event hub client\r\n2026-08-22T17:27:16.0480092Z:Client Telemetry: Events published in this batch: 2\r\n2026-08-22T17:27:16.0480092Z:Client Telemetry: Events received so far in this session: 11\r\n2026-08-22T17:27:16.0480092Z:Client Telemetry: Events published so far in this session: 11\r\n2026-08-22T17:27:16.1064272Z:event lost number: 0\r\n2026-08-22T17:27:16.1064272Z:total event processed number: 11\r\n2026-08-22T17:27:16.1064272Z:total event received number: 11\r\n2026-08-22T17:27:16.1064272Z:##EsrpClientTelemetry.TotalEventsProcessed##: 11\r\n2026-08-22T17:27:16.1064272Z:##EsrpClientTelemetry.TotalEventsReceived##: 11\r\n2026-08-22T17:27:16.1064272Z:##EsrpClientTelemetry.DisposeTimeMilliseconds##: 71\r\n2026-08-22T17:27:16.1064272Z:ClientTelemetryDispose ended ***********************\r\n","StdErr":"2026-08-22T17:27:15.8986976Z:Error: System.AggregateException: One or more errors occurred. ---> MS.Ess.EsrpClient.Sign.Exceptions.EsrpDigestSignExecuteProcessFailedException: Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\" failed\r\nExit Code: 1\r\nStdOut:\r\nFile: c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\r\nIndex Algorithm Timestamp \r\n========================================\r\n\r\nNumber of errors: 1\r\n\r\n\r\n\r\nStdErr:\r\nSignTool Error: A certificate chain processed, but terminated in a root\r\n\tcertificate which is not trusted by the trust provider.\r\n\r\n\r\n\r\n\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass27_0.<ExecuteDigestSignOperation>b__1()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.<>c__DisplayClass1.<ExecuteAction>b__0()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.ExecuteAction[TResult](Func`1 func)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.ExecuteDigestSignOperation(Input digestSignInput, Operation digestSignOperation, SignOperationData fileEntry, SignStatusResponse completionResponse, SignCommandDefinition param, Guid correlationId, String correlationVector, CancellationToken cancellationToken, String requestId, String tmpDestinationLocation)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.DigestSignInternal(Input digestSignInput, SignCommandDefinition param, Guid& correlationId, String correlationVector, CancellationToken cancellationToken, String groupId, SignOperationData fileEntry, Int32& signedFileCount, Int32& certRefreshCount, ConcurrentBag`1 completionResponses, RetryPolicy`1 operationRetryPolicy, String dynamicCertificateFile, String dynamicCertificateThumbprint, String requestId)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass23_3.<DigestSignAsync>b__6(SignOperationData fileEntry)\r\n --- End of inner exception stack trace ---\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<DigestSignAsync>d__23.MoveNext()\r\n---> (Inner Exception #0) MS.Ess.EsrpClient.Sign.Exceptions.EsrpDigestSignExecuteProcessFailedException: Operation: c:\\AT\\sitesroot\\0\\bin\\Plugins\\ESRPClient\\Win10.x86\\signtool.exe verify /pa /tw \"c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\" failed\r\nExit Code: 1\r\nStdOut:\r\nFile: c:\\Temp\\AzureTemp\\iyzzk3ae.if3\\manifest.cat\r\nIndex Algorithm Timestamp \r\n========================================\r\n\r\nNumber of errors: 1\r\n\r\n\r\n\r\nStdErr:\r\nSignTool Error: A certificate chain processed, but terminated in a root\r\n\tcertificate which is not trusted by the trust provider.\r\n\r\n\r\n\r\n\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass27_0.<ExecuteDigestSignOperation>b__1()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.<>c__DisplayClass1.<ExecuteAction>b__0()\r\n at Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling.RetryPolicy.ExecuteAction[TResult](Func`1 func)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.ExecuteDigestSignOperation(Input digestSignInput, Operation digestSignOperation, SignOperationData fileEntry, SignStatusResponse completionResponse, SignCommandDefinition param, Guid correlationId, String correlationVector, CancellationToken cancellationToken, String requestId, String tmpDestinationLocation)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.DigestSignInternal(Input digestSignInput, SignCommandDefinition param, Guid& correlationId, String correlationVector, CancellationToken cancellationToken, String groupId, SignOperationData fileEntry, Int32& signedFileCount, Int32& certRefreshCount, ConcurrentBag`1 completionResponses, RetryPolicy`1 operationRetryPolicy, String dynamicCertificateFile, String dynamicCertificateThumbprint, String requestId)\r\n at MS.Ess.EsrpClient.Sign.SignHandlers.SignJobHandler.<>c__DisplayClass23_3.<DigestSignAsync>b__6(SignOperationData fileEntry)<---\r\n\r\n","ExitCode":1,"RunningTime":"00:00:11.6268028"}