[BUG] CertificateClient.DownloadCertificate leads to SSL Authentication exception when server requires certificate and private key

Library name and version
Azure.Security.KeyVault.Certificates 4.2.0
Describe the bug
I've been facing the exception below into my web job deployed in Azure App Service for a while, it was really a strange exception that just happened a few times. It took me a while to track down the root cause, which I'll be describing here.
Could not establish trust relationship for the SSL/TLS secure channel with authority 'host address'. The SSL connection could not be established, see inner exception. Authentication failed, see inner exception. An unknown error occurred while processing the certificate.
System.ServiceModel.Security.SecurityNegotiationException:
   at Company.Project.RulesPlugins.Auto.Services.VehicleSpecifications.VehicleSpecificationRetriever.GetVehicle (Company.Project.RulesPlugins.Auto, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=null: D:\a\1\s\RulesPlugins\Company.Project.RulesPlugins.Auto\Services\VehicleSpecifications\VehicleSpecificationRetriever.cs:47)
Inner exception System.Net.Http.HttpRequestException handled at Company.Project.RulesPlugins.Auto.Services.VehicleSpecifications.VehicleSpecificationRetriever.GetVehicle:
   at System.Net.Http.ConnectHelper+<EstablishSslConnectionAsync>d__2.MoveNext (System.Net.Http, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Net.Http.HttpConnectionPool+<ConnectAsync>d__96.MoveNext (System.Net.Http, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Net.Http.HttpConnectionPool+<CreateHttp11ConnectionAsync>d__98.MoveNext (System.Net.Http, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Net.Http.HttpConnectionPool+<AddHttp11ConnectionAsync>d__73.MoveNext (System.Net.Http, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1+<WaitWithCancellationAsync>d__1.MoveNext (System.Net.Http, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Net.Http.HttpConnectionPool+<GetHttp11ConnectionAsync>d__75.MoveNext (System.Net.Http, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Net.Http.HttpConnectionPool+<SendWithVersionDetectionAndRetryAsync>d__83.MoveNext (System.Net.Http, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Net.Http.DiagnosticsHandler+<SendAsyncCore>d__8.MoveNext (System.Net.Http, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Net.Http.RedirectHandler+<SendAsync>d__4.MoveNext (System.Net.Http, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Net.Http.DecompressionHandler+<SendAsync>d__16.MoveNext (System.Net.Http, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Net.Http.HttpClient+<<SendAsync>g__Core|83_0>d.MoveNext (System.Net.Http, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.ServiceModel.Channels.HttpChannelFactory`1+HttpClientRequestChannel+HttpClientChannelAsyncRequest+<SendRequestAsync>d__13.MoveNext (System.Private.ServiceModel, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)
Inner exception System.Security.Authentication.AuthenticationException handled at System.Net.Http.ConnectHelper+<EstablishSslConnectionAsync>d__2.MoveNext:
   at System.Net.Security.SslStream+<ForceAuthenticationAsync>d__173`1.MoveNext (System.Net.Security, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Net.Http.ConnectHelper+<EstablishSslConnectionAsync>d__2.MoveNext (System.Net.Http, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)
Inner exception System.ComponentModel.Win32Exception handled at System.Net.Security.SslStream+<ForceAuthenticationAsync>d__173`1.MoveNext:

After a lot of debugging and research and many talks with the Azure support team, I managed to find the root cause of the exception, which you can see in the picture below from the network logs of my app service.

We can see that the exception that is throwing doesn't give any information that the real issue it's a bad certificate, this is already something to be addressed but not my focus on this issue.
Once I discovered that I back the focus on the code downloading the SSL certificate from KeyVault, which it's basically the following method.
https://github.com/Azure/azure-sdk-for-net/blob/10461aa95a53bcb6dbcb695f494c7a62c0e399d8/sdk/keyvault/Azure.Security.KeyVault.Certificates/src/CertificateClient.cs#L207-L250
As we can see this method will attempt to download a certificate with a private key but in the case that the private key cannot be downloaded, it will return the certificate with the public key only. So, here it's where I believe is the issue, if you have a scenerio like mine where you always need to send the certificate with the private key, you don't have a way to force this method to throw an exception if fail to download the private key.
I believe some option should be included as a parameter or maybe this DownloadCertificate method should be split between one that downloads only with public and the other for the private key.
Just to finalize and provide more information, here it's a comparison of the certificate being sent to the server from App Service and a Local Environment, as you can see the certificate size it's different due to the lack of the private key into the App Service one.

Expected behavior
CertificateClient.DownloadCertificate method to expose a parameter to force the download only when containing private key or a new method to download the certificate with private key and in case of fail throw some exception.
Actual behavior
The CertificateClient.DownloadCertificate method always returns the certificate without a private key leading to an Authentication exception when trying to use the returned certificate without a private key into a service that requires the private key.
Reproduction Steps
1 - Add a certificate to the key vault which contains the private key
2 - Create a service that downloads the certificate and attach it to the request to a service that requires the certificate with private key
3 - Deploy to app service that has the Identity ID turned on and authorized to the key vault
4 - You should see any intermittent authorization exception when the app service fails to download the certificate with the private key
Environment
.NET SDK (reflecting any global.json):
Version:   6.0.101
Commit:    ef49f6213a
Runtime Environment:
OS Name:     Windows
OS Version:  10.0.14393
OS Platform: Windows
RID:         win10-x86
Base Path:   C:\Program Files (x86)\dotnet\sdk\6.0.101\
Host (useful for support):
Version: 6.0.1
Commit:  3a25a7f1cc

Thank you for your feedback.  Tagging and routing to the team member best able to assist.

Thanks for bringing this to our attention. The method was intended to throw if it couldn't download the secret, which SendRequest would do for any non-2xx response. That this didn't throw is peculiar. I'll set up a repro, but it would help to know what secret permissions you do have to try to repro this accurately.

@heaths Sure, the permissions I have set up for my app service is this.
Secret: GET and LIST
Certificates: GET and LIST
Just reminding that it seems that is not all the time that the private key is failing to be downloaded so might be a little tricky to simulate, I hope all the information I gave is enough if not let me know.
I need to implement a quick workaround and I was thinking to override the Download method to request the private key manually so I can implement some retry policy, do you have any other ideas?

Just one thing more, my theory is that it's related to this part of PemReader.LoadCertificate method.
https://github.com/Azure/azure-sdk-for-net/blob/10461aa95a53bcb6dbcb695f494c7a62c0e399d8/sdk/core/Azure.Core/src/Shared/PemReader.cs#L76-L84

I'm unable to repro this with https://github.com/heaths/Issue27356. I get error:
Failed to download issue27356-nonexportable: Azure.RequestFailedException: The user, group or application 'appid=872cd9fa-d31f-45e0-9eab-6e460a02d1f1;oid=3c679168-146c-48e8-839b-f20d8e4242a4;numgroups=1039;iss=https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/' does not have secrets get permission on key vault 'heaths-issue27356;location=westus2'. For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125287
Status: 403 (Forbidden)
ErrorCode: Forbidden

allowCertificateOnly: true was passed unconditionally because it is expected - and I can repro without "get" permissions for secrets - that fetching the private key will fail so we'd never get that far. I'm not opposed to adding a property to DownloadCertificateOptions but I'd like to better understand the root cause since you never should've gotten to the PEM reader. If this is indeed errant behavior as I suspect, adding a property would be extraneous but something we'd have to support forever.
You said this only happens sometimes, so you can repro it at least on occasion? It would be helpful to log details. See https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/core/Azure.Core/samples/Diagnostics.md#logging. Since you're running in AppServices, if you enable Azure Monitor (or already have) you should automatically see trace events from Azure.Core, which provides our networking stack abstractions and tracing. I'd love to see trace logs for getting the certificate and associated secret.

@heaths I can reproduce this issue every day, I just need to increase the amount of request to the same service. I have the network trace log for the failure handshake but how can I share with you, since I cannot post here due to have internally information.

It would be best if you just redacted vault URIs or whatever you need to. I only need a failure line, and we redact any PII or secrets by default in headers and query params (bodies aren't logged by default either). If that's not acceptable, my Microsoft email alias is the same as my GitHub alias and you can email it.
If this happens under load, I'll loop in the service team but I'm hesitant to add a property that shouldn't be necessary since failure to download the private key should throw already.
/cc @jlichwa
Separately, have you considered caching the response if you're having to fetch it that often? Even a simple proxy like a sample I wrote would reduce bandwidth requirements and improve performance. I assume your certs don't expire so quickly that even an hour or two for a cache TTL wouldn't work, but you could always do something higher up the stack to cache in memory till close to when the certs expire. While this might mitigate this problem, my main purpose for suggesting this is just to improve performance if possible.

@heaths I think the loga I have is not what you're looking for, I just checked our app now and the Azure monitor is not enabled so I'll have to enable it and collect the data. Right now I only have the CAP file captured with the Collect Network Trace tool in Diagnose and solve problems section of the App Servicez if is this what you're looking I can try to edit it.
Regards to the cache I was not aware I'll try for sure since was one of solutions I thought, also I'm trying implement a retry policy base of the HasPrivateKey property.

I updated my sample projects to make many concurrent requests and still can't repro this. Anything particularly interesting about your Azure networking configuration?
FWIW, you can also trace events via ETW if on Windows, which I could do with my project like so. All HTTP 200 responses from Key Vault (so everything besides the initial 401 challenge responses) had the right payload.
dotnet publish
dotnet trace collect --providers Azure-Core .\bin\Debug\net6.0\Issue27356.exe https://myvault.vault.azure.net

I've tried 50, 100, and even 1500 concurrent iterations to download certs with err. The 1500 (so 3000 requests total) was to see what happens if I get throttled (2,000 requests/10 seconds) but on my machine wasn't able to reach that threshold. But even then, if you get throttled you get a 429 in which case we'd retry up to the default number of times (10, IIRC) and then throw an exception if still throttled.

@heaths The unice particular things it's I use a VNET connect with my app service to allow the access with KeyVault, basically the subnet is added to both KeyVault and AppService, but I don't thinking this is causing any issue.
I noted you're using the DownloadCertificateAsync method, could you use the other one since it's the one in my code right now.
I'm right now trying to extract the logs for you if I cannot I'll try to update your sample project to follow exactly what I'm doing in my code.

Sync vs. async code shouldn't matter since it doesn't affect the service call itself - just how we make it client-side (and async is generally better, especially for app services) - but I can try to change it.
However, can you repro this for a single given certificate, or do you have a mix of certificates. Did you pass Exportable = true in your CertificatePolicy? If not, the secret will only contain the public key and would explain why no exception is thrown.
If that is the case, that might warrant a change to the DownloadCertificateOptions to throw if no private key was available, but I'd still like to make sure this is the case.

@heaths I'm sorry I cannot get the logs. It seems the command is not authorized when running in Kudos tool.
I also try to activate the diagnostic settings into my app service but I'm not seeing any trace logs at all been saved. If you have any documentation about how to extractwhat you need from the App Service please send me, because I'm doing something wrong.

@heaths, this is the exactly code I'm using to download.
Just reminding you I'm using the nuget package version 4.2 (latest in nuget), it doesn't have DownloadCertificateOptions as a parameter
            var client = new VehicleSpecificationRecoveryServicePortTypeClient(customBinding, endpointAddress);

            var keyVaultCertificateClient = new KeyVaultCertificateClient(new Uri(_configuration["KeyVaultUrl"]), new DefaultAzureCredential());

            //Download certificate from azure key vault
            var vwCertificate = keyVaultCertificateClient.DownloadCertificate(_configuration["CertificateName"]);

            //Set certificate to the soap client instance
            client.ClientCredentials.ClientCertificate.Certificate = vwCertificate.Value;

Take a look at the link posted above for how to enable different logging: https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/core/Azure.Core/samples/Diagnostics.md#logging
For example, you could use a console logger and just write to stdout. Depending on how your service is hosted, that might even be done automatically (collecting stdout, that is).
Could you confirm all your certificates you're trying to download were marked as exportable when you created them? By default, they are not, which means the secret won't contain the private key. You do that in your initial CertificatePolicy as seen here:
https://github.com/heaths/Issue27356/blob/00d7226620348b799af6848ee98d725a0619ac46/Program.cs#L27-L32
Please let me know first. Whether using sync or async calls, the calls to the service are exactly the same. It's just a matter of whether we make them in the calling thread or potentially on a separate pool thread. This would have no impact on the content in the response.
For example, in my sample above I create both an exportable and non-exportable private key with the certificate creation request. I still get an HTTP 200 when requesting the secret for a certificate with a non-exportable key, but it will never contain the private key by design. This would repro 100% of the time.

Take a look at the link posted above for how to enable different logging: https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/core/Azure.Core/samples/Diagnostics.md#logging
For example, you could use a console logger and just write to stdout. Depending on how your service is hosted, that might even be done automatically (collecting stdout, that is).
Could you confirm all your certificates you're trying to download were marked as exportable when you created them? By default, they are not, which means the secret won't contain the private key. You do that in your initial CertificatePolicy as seen here:
https://github.com/heaths/Issue27356/blob/00d7226620348b799af6848ee98d725a0619ac46/Program.cs#L27-L32
Please let me know first. Whether using sync or async calls, the calls to the service are exactly the same. It's just a matter of whether we make them in the calling thread or potentially on a separate pool thread. This would have no impact on the content in the response.
For example, in my sample above I create both an exportable and non-exportable private key with the certificate creation request. I still get an HTTP 200 when requesting the secret for a certificate with a non-exportable key, but it will never contain the private key by design. This would repro 100% of the time.

I cannot implement right now the code for the logs, since the unique place we have a validate certificate to use is the Prod environment, I'll work over the weekend to use your sample project to connect to the service locally in my machine so I can extract the logs you need.
I use only one certificate to the service I'm communicating with and I can confirm that contains the private key since like I mentioned before I get the HasPrivateKey flag as true, but sometimes only in AppService, it happens the case of the certificate loses it and causes the issue described.

I'm having trouble finding the specific thread, but there was one about getting different hosts in App Services that might not allow the private key to be exported. It does so by temporarily saving to disk when constructing an X509Certificate2 instance. There's this one that is related: https://stackoverflow.com/questions/63884019/import-private-key-certificate-as-exportable-in-azure-app-service
That might explain the seeming randomness. Still, not only would caching the certificate help mitigate this, it should improve performance greatly not to make 2+ calls to Key Vault each time you need the certificate.

I'm having trouble finding the specific thread, but there was one about getting different hosts in App Services that might not allow the private key to be exported. It does so by temporarily saving to disk when constructing an X509Certificate2 instance. There's this one that is related: https://stackoverflow.com/questions/63884019/import-private-key-certificate-as-exportable-in-azure-app-service
That might explain the seeming randomness. Still, not only would caching the certificate help mitigate this, it should improve performance greatly not to make 2+ calls to Key Vault each time you need the certificate.

Thank you so much so far, I'll be differently applying the cache for the requests. I'll be doing a sample project with the cache and logs enabled and deploy to some app service so I can extract everything you need to confirm if it needs or not some fix into the library.

Hi @heaths just reporting back with the logs I managed to extract from a sample I created that has the same architecture and settings as our real environment, I hope it's what you need.
Logs with the failed request to the service that requires the certificate:
"timestamp [UTC]",				itemType,				customDimensions
"3/5/2022, 10:46:12.325 AM",	trace,	"{""MS_HostInstanceId"":""00000000-0000-0000-0000-000000000000"",""SourceContext"":""Company.MyProject._Common.SpecificationRule"",""Category"":""Function.RunJobProcessor"",""LogLevel"":""Information"",""MS_FunctionInvocationId"":""8f6e549b-b752-47f0-94c0-866abc59d1da"",""MS_FunctionName"":""RunJobProcessor"",""MessageTemplate"":""Unexpected error from Service: Could not establish trust relationship for the SSL/TLS secure channel with authority 'my-service.company.com'., System.ServiceModel.Security.SecurityNegotiationException: Could not establish trust relationship for the SSL/TLS secure channel with authority 'my-service.company.com'.\r\n ---> System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.\r\n ---> System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception.\r\n ---> System.ComponentModel.Win32Exception (0x80090327): An unknown error occurred while processing the certificate.\r\n   --- End of inner exception stack trace ---\r\n   at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm)\r\n   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)\r\n   --- End of inner exception stack trace ---\r\n   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)\r\n   at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)\r\n   at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)\r\n   at System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(HttpRequestMessage request)\r\n   at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)\r\n   at System.Net.Http.HttpConnectionPool.GetHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)\r\n   at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)\r\n   at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)\r\n   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)\r\n   at System.Net.Http.DecompressionHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)\r\n   at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)\r\n   at System.ServiceModel.Channels.HttpChannelFactory`1.HttpClientRequestChannel.HttpClientChannelAsyncRequest.SendRequestAsync(Message message, TimeoutHelper timeoutHelper)\r\n   --- End of inner exception stack trace ---\r\n   at Company.MyProject.SpecificationRetriever.GetVehicle(String vin, String culture) in C:\\Git\\Company.MyProject\\RulesPlugins\\Company.MyProject.RulesPlugins.Auto\\Services\\Specifications\\SpecificationRetriever.cs:line 86"",""MS_Event"":""FunctionStart"",""MS_TriggerDetails"":""{}""}"

"3/5/2022, 10:46:12.297 AM",	exception,	"{""MS_HostInstanceId"":""00000000-0000-0000-0000-000000000000"",""SourceContext"":""Company.MyProject.SpecificationRetriever"",""Category"":""Function.RunJobProcessor"",""LogLevel"":""Information"",""MS_FunctionInvocationId"":""8f6e549b-b752-47f0-94c0-866abc59d1da"",""MS_FunctionName"":""RunJobProcessor"",""MessageTemplate"":""Could not establish trust relationship for the SSL/TLS secure channel with authority 'my-service.company.com'."",""MS_Event"":""FunctionStart"",""MS_TriggerDetails"":""{}""}"

"3/5/2022, 10:46:10.116 AM",	trace,	"{""MS_HostInstanceId"":""00000000-0000-0000-0000-000000000000"",""SourceContext"":""Company.MyProject.SpecificationRetriever"",""Category"":""Function.RunJobProcessor"",""LogLevel"":""Information"",""MS_FunctionInvocationId"":""8f6e549b-b752-47f0-94c0-866abc59d1da"",""MS_FunctionName"":""RunJobProcessor"",""MessageTemplate"":""Starting request to the service"",""MS_Event"":""FunctionStart"",""MS_TriggerDetails"":""{}""}"

"3/5/2022, 10:46:10.047 AM",	trace,	"{""MessageTemplate"":""Response [0182183c-a0ae-41de-b2fb-0de1e65a77f1] 200 OK (00.1s)\r\nCache-Control:no-cache\r\nPragma:no-cache\r\nx-ms-keyvault-region:northeurope\r\nx-ms-client-request-id:0182183c-a0ae-41de-b2fb-0de1e65a77f1\r\nx-ms-request-id:9ce3d8eb-2f12-4102-b2ce-009d63d0bb93\r\nx-ms-keyvault-service-version:1.9.291.1\r\nx-ms-keyvault-network-info:conn_type=Subnet;subnet=/subscriptions/a6754a8c-8e89-41bd-8836-86fbc45aeb07/resourcegroups/certificates/providers/microsoft.network/virtualnetworks/mykeyvaut-west-eu/subnets/testkeyvaultjob;addr=<IP_ADDRESS>;act_addr_fam=InterNetworkV6;\r\nX-Powered-By:REDACTED\r\nStrict-Transport-Security:REDACTED\r\nX-Content-Type-Options:REDACTED\r\nDate:Sat, 05 Mar 2022 10:46:09 GMT\r\nContent-Type:application/json; charset=utf-8\r\nExpires:-1\r\nContent-Length:9186""}"

"3/5/2022, 10:46:09.967 AM",	trace,	"{""MessageTemplate"":""Response [d4344a96-b687-4dff-b8f8-01067087e739] 200 OK (00.0s)\r\nCache-Control:no-cache\r\nPragma:no-cache\r\nx-ms-keyvault-region:northeurope\r\nx-ms-client-request-id:d4344a96-b687-4dff-b8f8-01067087e739\r\nx-ms-request-id:9c0ac483-06ee-4aaa-8115-d0e3a54fc4fd\r\nx-ms-keyvault-service-version:1.9.291.1\r\nx-ms-keyvault-network-info:conn_type=Subnet;subnet=/subscriptions/a6754a8c-8e89-41bd-8836-86fbc45aeb07/resourcegroups/certificates/providers/microsoft.network/virtualnetworks/mykeyvaut-west-eu/subnets/testkeyvaultjob;addr=<IP_ADDRESS>;act_addr_fam=InterNetworkV6;\r\nX-Powered-By:REDACTED\r\nStrict-Transport-Security:REDACTED\r\nX-Content-Type-Options:REDACTED\r\nDate:Sat, 05 Mar 2022 10:46:09 GMT\r\nContent-Type:application/json; charset=utf-8\r\nExpires:-1\r\nContent-Length:3152""}"

"3/5/2022, 10:46:09.967 AM",	trace,	"{""MessageTemplate"":""Request [0182183c-a0ae-41de-b2fb-0de1e65a77f1] GET https://mykeyvaut.vault.azure.net/secrets/MyCertificate/bcee532ge6754514b8e60407db70699c?api-version=7.2\r\nAccept:application/json\r\nx-ms-client-request-id:0182183c-a0ae-41de-b2fb-0de1e65a77f1\r\nx-ms-return-client-request-id:true\r\nUser-Agent:azsdk-net-Security.KeyVault.Certificates/4.2.0,(.NET 6.0.1; Microsoft Windows 10.0.14393)\r\nAuthorization:REDACTED\r\nContent-Type:application/json\r\nclient assembly: Azure.Security.KeyVault.Certificates""}"

"3/5/2022, 10:46:09.919 AM",	trace,	"{""MessageTemplate"":""Request [d4344a96-b687-4dff-b8f8-01067087e739] GET https://mykeyvaut.vault.azure.net/certificates/MyCertificate/?api-version=7.2\r\nAccept:application/json\r\nx-ms-client-request-id:d4344a96-b687-4dff-b8f8-01067087e739\r\nx-ms-return-client-request-id:true\r\nUser-Agent:azsdk-net-Security.KeyVault.Certificates/4.2.0,(.NET 6.0.1; Microsoft Windows 10.0.14393)\r\nAuthorization:REDACTED\r\nContent-Type:application/json\r\nclient assembly: Azure.Security.KeyVault.Certificates""}"

"3/5/2022, 10:46:09.257 AM",	trace,	"{""MessageTemplate"":""DefaultAzureCredential.GetToken invoked. Scopes: [ https://vault.azure.net/.default ] ParentRequestId: d4344a96-b687-4dff-b8f8-01067087e739""}"

"3/5/2022, 10:46:09.256 AM",	request,	"{""_MS.ProcessedByMetricExtractors"":""(Name:'Requests', Ver:'1.1')""}"

Logs with the successful request to the service that requires the certificate:
"timestamp [UTC]",				itemType,				customDimensions
"3/5/2022, 10:47:06.643 AM",	trace,	"{""MS_HostInstanceId"":""00000000-0000-0000-0000-000000000000"",""SourceContext"":""Microsoft.EntityFrameworkCore.Database.Command"",""Category"":""Function.RunJobProcessor"",""commandText"":""SET NOCOUNT ON;\\r\\nUPDATE [res_tblDevice] SET [Culture] = @p0, [Key] = @p1, [Value] = @p2\\r\\nWHERE [Id] = @p3;\\r\\nSELECT @@ROWCOUNT;"",""LogLevel"":""Information"",""EventId"":""{\""Id\"":20101,\""Name\"":\""Microsoft.EntityFrameworkCore.Database.Command.CommandExecuted\""}"",""MS_FunctionInvocationId"":""02606076-98ee-4e18-9a4d-825d721b9308"",""MS_FunctionName"":""RunJobProcessor"",""commandTimeout"":""180"",""parameters"":""@p3='?' (DbType = Int32), @p0='?' (Size = 4000), @p1='?' (Size = 4000), @p2='?' (Size = 4000)"",""MessageTemplate"":""Executed DbCommand ({elapsed}ms) [Parameters=[{parameters}], CommandType='{commandType}', CommandTimeout='{commandTimeout}']{newLine}{commandText}"",""MS_Event"":""FunctionStart"",""elapsed"":""4"",""newLine"":""\\r\\n"",""MS_TriggerDetails"":""{}"",""commandType"":""Text""}"

"3/5/2022, 10:47:01.158 AM",	trace,	"{""MS_HostInstanceId"":""00000000-0000-0000-0000-000000000000"",""SourceContext"":""Company.MyProject.SpecificationRetriever"",""Category"":""Function.RunJobProcessor"",""LogLevel"":""Information"",""MS_FunctionInvocationId"":""02606076-98ee-4e18-9a4d-825d721b9308"",""MS_FunctionName"":""RunJobProcessor"",""MessageTemplate"":""Starting request to the service"",""MS_Event"":""FunctionStart"",""MS_TriggerDetails"":""{}""}"

"3/5/2022, 10:47:01.096 AM",	trace,	"{""MessageTemplate"":""Response [89248d8d-0bba-4c19-bc3d-59b9bdaf51e5] 200 OK (00.0s)\r\nCache-Control:no-cache\r\nPragma:no-cache\r\nx-ms-keyvault-region:northeurope\r\nx-ms-client-request-id:89248d8d-0bba-4c19-bc3d-59b9bdaf51e5\r\nx-ms-request-id:5fce35d5-90f6-4c91-82ed-c1d9cd647573\r\nx-ms-keyvault-service-version:1.9.291.1\r\nx-ms-keyvault-network-info:conn_type=Subnet;subnet=/subscriptions/a6754a8c-8e89-41bd-8836-86fbc45aeb07/resourcegroups/certificates/providers/microsoft.network/virtualnetworks/mykeyvault-west-eu/subnets/testkeyvaultjob;addr=<IP_ADDRESS>;act_addr_fam=InterNetworkV6;\r\nX-Powered-By:REDACTED\r\nStrict-Transport-Security:REDACTED\r\nX-Content-Type-Options:REDACTED\r\nDate:Sat, 05 Mar 2022 10:47:01 GMT\r\nContent-Type:application/json; charset=utf-8\r\nExpires:-1\r\nContent-Length:9186""}"

"3/5/2022, 10:47:01.057 AM",	trace,	"{""MessageTemplate"":""Request [89248d8d-0bba-4c19-bc3d-59b9bdaf51e5] GET https://mykeyvault.vault.azure.net/secrets/MyCertificate/bcee942de4554514b8e60407db70699c?api-version=7.2\r\nAccept:application/json\r\nx-ms-client-request-id:89248d8d-0bba-4c19-bc3d-59b9bdaf51e5\r\nx-ms-return-client-request-id:true\r\nUser-Agent:azsdk-net-Security.KeyVault.Certificates/4.2.0,(.NET 6.0.1; Microsoft Windows 10.0.14393)\r\nAuthorization:REDACTED\r\nContent-Type:application/json\r\nclient assembly: Azure.Security.KeyVault.Certificates""}"

"3/5/2022, 10:47:01.057 AM",	trace,	"{""MessageTemplate"":""Response [6ec4fe14-55ba-4c3e-8492-e0b49f5d37de] 200 OK (00.0s)\r\nCache-Control:no-cache\r\nPragma:no-cache\r\nx-ms-keyvault-region:northeurope\r\nx-ms-client-request-id:6ec4fe14-55ba-4c3e-8492-e0b49f5d37de\r\nx-ms-request-id:c1869ec4-5960-4628-8ec8-c6375b7c7972\r\nx-ms-keyvault-service-version:1.9.291.1\r\nx-ms-keyvault-network-info:conn_type=Subnet;subnet=/subscriptions/a6754a8c-8e89-41bd-8836-86fbc45aeb07/resourcegroups/certificates/providers/microsoft.network/virtualnetworks/mykeyvault-west-eu/subnets/testkeyvaultjob;addr=<IP_ADDRESS>;act_addr_fam=InterNetworkV6;\r\nX-Powered-By:REDACTED\r\nStrict-Transport-Security:REDACTED\r\nX-Content-Type-Options:REDACTED\r\nDate:Sat, 05 Mar 2022 10:47:00 GMT\r\nContent-Type:application/json; charset=utf-8\r\nExpires:-1\r\nContent-Length:3152""}"

"3/5/2022, 10:47:01.007 AM",	trace,	"{""MessageTemplate"":""Request [6ec4fe14-55ba-4c3e-8492-e0b49f5d37de] GET https://mykeyvault.vault.azure.net/certificates/MyCertificate/?api-version=7.2\r\nAccept:application/json\r\nx-ms-client-request-id:6ec4fe14-55ba-4c3e-8492-e0b49f5d37de\r\nx-ms-return-client-request-id:true\r\nUser-Agent:azsdk-net-Security.KeyVault.Certificates/4.2.0,(.NET 6.0.1; Microsoft Windows 10.0.14393)\r\nAuthorization:REDACTED\r\nContent-Type:application/json\r\nclient assembly: Azure.Security.KeyVault.Certificates""}"

"3/5/2022, 10:47:00.816 AM",	trace,	"{""MessageTemplate"":""DefaultAzureCredential.GetToken invoked. Scopes: [ https://vault.azure.net/.default ] ParentRequestId: 6ec4fe14-55ba-4c3e-8492-e0b49f5d37de""}"

"3/5/2022, 10:47:00.808 AM",	request,	"{""_MS.ProcessedByMetricExtractors"":""(Name:'Requests', Ver:'1.1')""}"

Also, I just want to highlight the architecture and settings we have in place for our web job.

Web Job settings:

Runs over a Virtual Network that is authorized to our KeyVault since it doesn't allow public access.

Has the Identity enabled and added to the key vault with the permissions below as mentioned before.
Secret: GET and LIST
Certificates: GET and LIST

Has WEBSITE_LOAD_USER_PROFILE enabled in the configuration file

I'm having trouble finding the specific thread, but there was one about getting different hosts in App Services that might not allow the private key to be exported. It does so by temporarily saving to disk when constructing an X509Certificate2 instance. There's this one that is related: https://stackoverflow.com/questions/63884019/import-private-key-certificate-as-exportable-in-azure-app-service
That might explain the seeming randomness. Still, not only would caching the certificate help mitigate this, it should improve performance greatly not to make 2+ calls to Key Vault each time you need the certificate.

I've applied the cache following your sample and it didn't work, I can see frequently the exception showing up. I'm not sure if it's because I use dependency injection to call the class instance where I open the request to the key vault and the soap service.
The certificate size still shows less than when I do in my local environment

In both traces, I see the secret is returned with Content-Length 9186 so it's coming back with the same content both times, seemingly. Are you able to log somehow host information (OS, version, anything else - maybe dotnet --info) to see if there's a different in the host configuration? Different versions of Windows or of openssl for non-Windows machines could be affecting the parsing somehow, but there's not enough to go on so far.
The proxy wasn't meant to solve your problem as much as mitigate it. It would help to understand why you fetch your certificate rather than just caching, whether using a simple caching proxy or even just storing it in memory and fetching it periodically? While I don't suspect stress is a factor in the parsing in this case, the fact that it happens frequently because you fetch frequently could be mitigated by fetching less frequently and retry if it doesn't create a certificate with a private key. That's not to say I don't want to get to the bottom of this - I do - but 1) reducing the changes for this to fail will help unblock you, and 2) reducing the bandwidth required to fetch a certificate by only doing it seldomly could help reduce costs depending on load.

In both traces, I see the secret is returned with Content-Length 9186 so it's coming back with the same content both times, seemingly. Are you able to log somehow host information (OS, version, anything else - maybe dotnet --info) to see if there's a different in the host configuration? Different versions of Windows or of openssl for non-Windows machines could be affecting the parsing somehow, but there's not enough to go on so far.
The proxy wasn't meant to solve your problem as much as mitigate it. It would help to understand why you fetch your certificate rather than just caching, whether using a simple caching proxy or even just storing it in memory and fetching it periodically? While I don't suspect stress is a factor in the parsing in this case, the fact that it happens frequently because you fetch frequently could be mitigated by fetching less frequently and retry if it doesn't create a certificate with a private key. That's not to say I don't want to get to the bottom of this - I do - but 1) reducing the changes for this to fail will help unblock you, and 2) reducing the bandwidth required to fetch a certificate by only doing it seldomly could help reduce costs depending on load.

Sorry if I give the wrong impression, the cache you suggested was indeed a good thing for us! We didn't have any reason to fetch the certificate every time, when I mentioned that didn't work I wanted to say that although the certificate is been cached properly the exception still happens in the same frequency as when fetching all the time. I set up the cache for 2 hours and I can see requests completing successfully and failing while using the same cache certificate.
. I wouldn't expect SDKs on the app service host machines, nor Windows 10 (though, maybe). There have been differences in certificate creation - though usually issues repro 100% of the time. I'm trying to ascertain if there's a pattern of different hosts when certificate parsing works and when it doesn't. Key Vault is giving you the same secret (certificate key pair) back, it seems, given the content length is the same, so that seems to rule out a service issue. And apart from having to parse the ASN.1 from the a PEM file (assuming you're even using PEM; PFX/PKCS12 is handled entirely by .NET), all the parsing logic is actually in Windows CNG, which .NET calls into on Windows, or openssl, which .NET calls into on non-Windows.
If you can repro this and get a dump right after calling CertificateClient.DownloadCertificate perhaps that might help. If so, you could securely share that and send me an email with the link. My Microsoft email alias is the same as my GitHub alias.

Is that for the machine your running your app service on or your dev machine? I wouldn't expect SDKs on the app service host machines, nor Windows 10 (though, maybe). There have been differences in certificate creation - though usually issues repro 100% of the time. I'm trying to ascertain if there's a pattern of different hosts when certificate parsing works and when it doesn't. Key Vault is giving you the same secret (certificate key pair) back, it seems, given the content length is the same, so that seems to rule out a service issue. And apart from having to parse the ASN.1 from the a PEM file (assuming you're even using PEM; PFX/PKCS12 is handled entirely by .NET), all the parsing logic is actually in Windows CNG, which .NET calls into on Windows, or openssl, which .NET calls into on non-Windows.
If you can repro this and get a dump right after calling CertificateClient.DownloadCertificate perhaps that might help. If so, you could securely share that and send me an email with the link. My Microsoft email alias is the same as my GitHub alias.

It's from our app service, yes I can simulate and dump the data after calling the method, I'll do it and email you so.
This one is from my local environment

.NET SDK (reflecting any global.json):
 Version:   6.0.101
 Commit:    ef49f6213a

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.19044
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\6.0.101\

Host (useful for support):
  Version: 6.0.1
  Commit:  3a25a7f1cc

.NET SDKs installed:
  5.0.404 [C:\Program Files\dotnet\sdk]
  6.0.101 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 3.1.22 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.13 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.1 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 2.1.30 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.22 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.13 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.1 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 3.1.22 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 5.0.13 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 6.0.1 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

I've sent the files to you, regards to the file format we've been using PFX.

I'm unable to determine any reason based on the logs and dump. Given source is available, to narrow down where the problem is available, you could clone the source and set the allowCertificateOnly to false, package and deploy. If this doesn't err, the issue is likely in X509Certificate2 itself.
I realize this repo is large, but you can greatly reduce time to clone if you do a shallow clone e.g.,
git clone --depth=1 --sparse https://github.com/Azure/azure-sdk-for-net.git
git sparse-checkout add eng/ sdk/core/ sdk/keyvault/
dotnet pack sdk/keyvault/Azure.Security.KeyVault.Certificates/src/Azure.Security.KeyVault.Certificates.csproj

After that, you can install the artifacts/packages/Debug/Azure.Security.KeyVault.Certificates/Azure.Security.KeyVault.Certificates.*.nupkg package that gets created in your project e.g.,
dotnet add package --prerelease --source /home/username/src/azure-sdk-for-net/artifacts/packages/Debug Azure.Security.KeyVault.Certificates

Note: replace /home/username/src/azure-sdk-for-net with wherever you cloned the repo.

I'm unable to determine any reason based on the logs and dump. Given source is available, to narrow down where the problem is available, you could clone the source and set the allowCertificateOnly to false, package and deploy. If this doesn't err, the issue is likely in X509Certificate2 itself.
I realize this repo is large, but you can greatly reduce time to clone if you do a shallow clone e.g.,
git clone --depth=1 --sparse https://github.com/Azure/azure-sdk-for-net.git
git sparse-checkout add eng/ sdk/core/ sdk/keyvault/
dotnet pack sdk/keyvault/Azure.Security.KeyVault.Certificates/src/Azure.Security.KeyVault.Certificates.csproj

After that, you can install the artifacts/packages/Debug/Azure.Security.KeyVault.Certificates/Azure.Security.KeyVault.Certificates.*.nupkg package that gets created in your project e.g.,
dotnet add package --prerelease --source /home/username/src/azure-sdk-for-net/artifacts/packages/Debug Azure.Security.KeyVault.Certificates

Note: replace /home/username/src/azure-sdk-for-net with wherever you cloned the repo.

Thank you @heaths, I'll be looking into this to confirm but it's likely to be the X509Certificate2.
I believe something happens while recovering/saving the PFX file with private key into the App Service hosts. What I understood is that everytime we create a X509Certificate2 instance, it actually creates a temporarily X509Store internally which gets the certificate and private key. This store is used after when SslStream start the handshake, it seems the class request the certificate/private key from the temporary store which fails silently.
Do you know if there's other way to create X509Certificate2 or maybe convert the PFX file to PEM?

The X509Certificate2 class documents a number of ways to save to both PFX (has existed in .NET for quite a while) or PEM (new to .NET 5.0, IIRC). See Export for one possibility.

Hi @heaths, I've changed the allowCertificateOnly to false as you suggested, nothing changed as I already expected. I've also tested many ways to create the X509Certificate2 instance from our PFX file and still nothing.
I believe now after all these tests that the issue is not related to KeyVault or X509Certificate2 but the Server or App Service itself, most likely the Server! Unfortunately, I do not have access to verify so it's the end of the road, if you want we can close the issue.
Here are what I tested and what not
Tested (Didn't work)
Change allowCertificateOnly to false
Import the PFX file into App Service and use WEBSITE_LOAD_CERTIFICATES
Import the PFX file from the physical file
Not Tested
Move App Service to Linux
Use a PEM file instead of PFX

Thanks for confirming. I'll go ahead and close this issue, but I'd love to hear if you find a solution. Check https://stackoverflow.com/search?q=x509certificate2+app+service. There's a couple of threads there - probably even the one I mentioned above - about key persistence and different platforms. This is why in 4.3.0 (now out of beta i.e. released) adds a DownloadCertificate overload that takes options including key persistence settings. What's necessary can vary from platform to platform and even under different environments like App Services. See issue #23016 and PR #24134 for more information and links as well, which is when I added the options parameter overload.

Thanks for confirming. I'll go ahead and close this issue, but I'd love to hear if you find a solution. Check https://stackoverflow.com/search?q=x509certificate2+app+service. There's a couple of threads there - probably even the one I mentioned above - about key persistence and different platforms. This is why in 4.3.0 (now out of beta i.e. released) adds a DownloadCertificate overload that takes options including key persistence settings. What's necessary can vary from platform to platform and even under different environments like App Services. See issue #23016 and PR #24134 for more information and links as well, which is when I added the options parameter overload.

I'll check everything and if I ever find the solution I'll definitely report back here, thanks for all the help!


5322

Updated environment variables DEBUG and TRACE such that they also accept class names along with true/false/yes/no, By inputting class name(s) (separated with a colon), you can set only those classes to have that level of logging. Updated the set_log_level feature so that it wouldn't automatically change the global level, and would update individual class log_level modifications.

This can't be merged. Rebase and squashed your commits onto master.


Fix issue related to reselection of date/time

IMPORTANT: All PRs must be linked to an issue (except for extremely trivial and straightforward changes).
Fixes #208
Description
Re-emergence of bug that was fixed before. After the user selects a date answer, they cannot re-open the widget unless the move away from that edit box. To solve this, I am clearing the focus in the fragementResultListenerm, so that every time the widget is opened and closed, focus is cleared to allow reopening of the widget. This is an issue in the time widget too.
Alternative(s) considered
Nope
Type
Bug fix
Checklist

[x] I have read and acknowledged the Code of conduct
[x] I have read How to Contribute
[x] I have read the Developer's guide
[x] I have signed the Google Individual CLA, or I am covered by my company's Corporate CLA
[x] I have discussed my proposed solution with code owners in the linked issue(s) and we have agreed upon the general approach
[x] I have run ./gradlew spotlessApply and ./gradlew spotlessCheck to check my code follows the style guide of this project
[x] I have run ./gradlew check and ./gradlew connectedCheck to test my changes locally
[x] I have built and run the reference app(s) to verify my change fixes the issue and/or does not break the reference app(s)

Codecov Report

Merging #729 (35bd264) into master (47122b2) will decrease coverage by 0.20%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##             master     #729      +/-   ##
============================================
- Coverage     53.18%   52.97%   -0.21%
+ Complexity      196      194       -2
============================================
  Files            47       47
  Lines           974      974
  Branches        134      134
============================================
- Hits            518      516       -2
  Misses          376      376
- Partials         80       82       +2

Impacted Files
Coverage Δ

...va/com/google/android/fhir/db/impl/DatabaseImpl.kt
35.55% <0.00%> (-2.23%)
:arrow_down:

.../google/android/fhir/db/impl/dao/LocalChangeDao.kt
66.66% <0.00%> (-2.09%)
:arrow_down:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 47122b2...35bd264. Read the comment docs.


Add an optional field to specify a multi value delimiter for any field mapping

Some fields allow concatenation of values, for example multiple image urls in associatedMedia.
The dwc archive meta.xml file (will) allow to specify the actual delimiter used for
concatenation. The IPT should allow a user to specify this delimiter or declare it
behind the scenes if the IPT does some concatenation

Original issue reported on code.google.com by wixner on 2013-05-25 08:53:24

Work completed.
The multi-value field delimiter can be set as part of source data configuration, for all source types (excel, database, or file).
This delimiter will be explicitly written to the DwC-A meta.xml fields, but only for those fields mapped to known DwC multi-valued fields, e.g. associatedMedia, identifiedBy, etc.
The same multi-value delimiter must be used in all source mappings to a single extension, otherwise an exception gets thrown.
Currently no validation is done, to ensure the multi-value delimiter is correct or not. This would be a nice enhancement.
Also it would be nice to auto-detect the multi-value delimiter upon loading a new source file.
Update to user manual required.

User manual update complete. Closing issue.


Support android-arm64

Is your feature request related to a problem? Please describe.
gh-dash does not install in termux on android
Describe the solution you'd like
Please build a release for android-arm64
Describe alternatives you've considered
I can try building my own binary, but that's a lot of effort and last I checked go actually won't build stuff on android due to unsupported filesystem locking issues

Oops. Sorry for the duplicated issues, I have no idea what happened there but I can't imagine it was intentional.

Hey @dlvhdr is there any update regarding this issue??

Hey I got it working by manually installing it
Is there something difference between installing with gh and manually installing it!?

I think you can close this issue


AE conduits still available

players that don't know that AE support has been removed place the cables and corrupt worlds, can we please remove these.

You misunderstand. We no longer support rv1 of AE2. Newer versions work fine.

OK then the mod pack guys aren't updating in line
Sent via the Samsung Galaxy Tab® S, an AT&T 4G LTE tablet
-------- Original message --------
From: tterrag1098<EMAIL_ADDRESS>Date: 01/23/2015  12:17 PM  (GMT-05:00)
To: CrazyPants/EnderIO<EMAIL_ADDRESS>Cc: tannerah<EMAIL_ADDRESS>Subject: Re: [EnderIO] AE conduits still available (#1739)
You misunderstand. We no longer support rv1 of AE2. Newer versions work fine.

Reply to this email directly or view it on GitHub:
https://github.com/CrazyPants/EnderIO/issues/1739#issuecomment-71228281


fix: typo compliance

Description
Replaced "complaince" with "compliance".
Checklist

[v] I've read the guidelines for contributing to this repository.
[ ] I've added tests that prove my fix is effective or that my feature works.
[ ] I've updated the documentation with the relevant information (if needed).
[ ] I've added usage information (if the PR introduces new options)
[ ] I've included a "before" and "after" example to the description (if the PR is a user interface change).

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.


Cannot display image thumbnail in facebook

Description
Cannot display image thumbnail in facebook
Notion Test Page ID
ID: b132ee36-4cc3-46e0-8890-6a31b0ed285b
Facebook:

Twitter:

Hello, does the project support the function of only the article summary instead of the header image preview? Because I don't want to find a picture for every article

Description
Cannot display image thumbnail in facebook
Notion Test Page ID
ID: b132ee36-4cc3-46e0-8890-6a31b0ed285b
Facebook:
Twitter:

Hello, does the project support the function of only the article summary instead of the header image preview? Because I don't want to find a picture for every article

Have anyone fixed this?


[Crash] when shift+right click on a teleport rail with Linker - 1.18.2 Fabric

I right clicked a teleport rail with the "Linker" and then shift+right clicked another teleport rail with the "Linker" (both rails powered with redstone) -> the game crashed & server crashed too..
Mods that may affect:
Cammie's Minecart Tweaks
Vehicle Fix
Server Latest.Log
Server Crash Report
Client Latest.Log
Client Crash Report

Fixed in latest release


Add simplified Chinese translation

Hello,
I translated the i18n strings to Chinese when learning RoR this weekend. :)

@jokester Wou! Looks cool! Thank you!

The change is available in version 0.1.3


build: deploy Hello World App to GCP

close #4

:tada: This PR is included in version 1.0.0 :tada:
The release is available on GitHub release
Your semantic-release bot :package::rocket:

:tada: This PR is included in version 1.0.0-main.1 :tada:
The release is available on GitHub release
Your semantic-release bot :package::rocket:


Feature request: Quality of life changes

First, Thank you very much for this awesome addon. It does a great job and so far has been the best 2D to 3D experience I've tried.
Frame alternation is good for keeping down motion blur but requires a very high refresh rate monitor to use it. Having other modes like SBS, TAB, Interlaced (native to passive displays) would be nice if it's possible to do.
Could we have more documentation on what the numpad options do? Hunt 2D vs Skip, what's that do?
Could we have a ctrl+F3/F4 for increasing or decreasing the Stereo Separation?
Thank you!

When we discuss 3D monitors we have projectors and 3D Vision monitors using frame sequential.
My addon has always been FS at the core. I use 3DToElse.fx to produce other kinds of 3D.
SBS should be the default. It can produce almost every type of 3D except FS.
v-sync is recommended and moton blur off in many games.
ctrl+F3-F4
has been implemented based on a 27" monitor and fairly low separation. If you increase too much you will get a lot more artifacts.
The battle between artifacts and depth is though.  My perosnal oppinion is based on real photographs (7cm IPD) where you have very little separaton vs screen IPD.
Moved ctrl+F2 to ctrl+T for familarity's sake.
2D hunt takes the selected pipeline and replaces it with the original 2D pipeline.
Skip hunt skips drawing while a pipeline is active. it will keep skipping that pipeline from being drawn if saved.
After that the next step might be editing shaders by changing the extention to txt
Separation is working in my personal build so it has to bested

Hello, apologies for the late response.

[ ] My addon has always been FS at the core. I use 3DToElse.fx to produce other kinds of 3D.

Yes, I read FS is the core in the documentation. I can use 3DToElse to change it to another method but since my display is only 60Hz so when I use 3DToElse.fx I get half the framerate at 30 fps. I haven't tested another display that I have that uses active 3D and FS natively, so I can't comment on that.

[ ] has been implemented based on a 27" monitor and fairly low separation. If you increase too much you will get a lot more artifacts.

I use a passive 3DTV. I also have an active one but that one is not being used. They are 65" and 55" respectively. On the passive 65" I'm able to increase the stereo separation a good bit higher than 8 without significant artifacts. I think it would be nice to be able to alter the setting while in use instead of having to edit a text file then restart the game to reload the addon for the new setting to take effect.

[ ] The battle between artifacts and depth is though.

Indeed, the difficulty is balance. I do really like the addon, and hope you continue to develop it further! If I knew how to code I'd just add the code myself and contribute to your repo.

I noticed with 3.5 that you implemented stereo separation with ctrl+F3 & ctrl+f4! Thank you!


Tidy historic rates

Historic rate information is not used for a lot of smart answers, so tidy up by removing it and updating any tests that use historic data when the smart answer itself does not.
https://trello.com/c/1jbnKNIK/1531-remove-legacy-data-from-smart-answers-to-make-uprating-easier
⚠ This repo is Continuously Deployed: make sure you follow the guidance ⚠

Not touching the Child Benefit Tax Calculator just yet, as this from Richard Skipper:
"HMRC has told us they're currently signing off a request to remove all the years before 2017/18, so please don't remove anything yet."

Rates Files Changed:

minimum_wage.yml: Uses Current and previous year data. Tests maybe require actual numbers  because the calculator does more complex calculations, obsolete historical tests removed. Remaining tests updated, note added that test dates should be updated in YAML.
marriage_abroad_consular_fees.yml: Historic rates not used, not in any tests
state_pension.yml: Historic rates not used in UI or any tests
births_and_deaths_document_return_fees.yml: Historic rates not used except in tests, replaced with non-numeric tests
register_a_birth.yml: Historic rates not used except in tests, replaced with non-numeric tests
register_a_death.yml: Historic rates not used except in tests, replaced with non-numeric tests
married_couples_allowance.yml: Historic rates not used except in tests, simplify tests to only last date. Possible we can simplify allowance logic?
redundancy_pay.yml: Historic rates over previous 4 tax years used, replaced tests with non-numeric tests to confirm data availability
redundancy_pay_northern_ireland.yml: Historic rates over previous 4 tax years used, replaced tests with non-numeric tests to confirm data availability

Rates Files Unchanged

personal_allowance.yml: No historic data
statutory_sick_pay.yml: Historic data back to 2010, but UI can use it.
maternity_paternity_adoption.yml: Historic data back to 2010, but UI can use it.
maternity_paternity_birth.yml: Historic data back to 2010, but UI can use it.
child_benefit_rates.yml: Historic data used in UI, HMRC reviewing, leave for now

Good idea, I'll go through and make sure all the YAMLs have some form of top comment. I'm mildly reluctant to update the end date on register_a_birth etc just because it gives a sort of a clue about how long it's been since the yml had some attention / the actual rates changed. I definitely think when I added in new elements I'd put a hundred-year or whatever end date on them myself, so... Perhaps better to make them all consistent. I'll tweak and re-upload.


More room for showing filename and disk name?

Etcher version: 1.0.0-rc2
Operating system and architecture: Ubuntu 16.04 x64
Do you see any meaningful error information on DevTools? N.A

We could make more room for displaying the image file name and the disk name if we moved the sizes below instead of on the same line.
In the example below, my drive name is "STORAGE DEVICE", which is not unreasonably long, so it would be nicer if it was not truncated.

Thanks for the idea @dlech. Let's bring @konmouz on the loop. Maybe we can improve this somehow on the v2 design?

@jviotti, Indeed on v2 we don't have this issue. The old solution for that was to use a two line system. The only concern here is that the 'change' button wouldn't appear as clear as it appears now (there will be 3 lines: name - size - change CTA). I'll upload a screenshot to see how it might look.

Sounds good @konmouz. I'll assign @Shou in case he has some time to tweak the v1.0 design as proposed, but definitely not very high priority if this is getting fixed on v2 already.


Fixes compilation errors on Mac with LLVM.

Codecov Report

Merging #2352 (8ce0e02) into main (6873211) will not change coverage.
The diff coverage is n/a.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2352   +/-   ##
=======================================
  Coverage   40.03%   40.03%
=======================================
  Files          88       88
  Lines        9714     9714
=======================================
  Hits         3889     3889
  Misses       5825     5825

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 6873211...8ce0e02. Read the comment docs.


Zoomify upscaling

When using zoomify, tiles arent the same size and it seems to cause some "upscaling" issues.
For example, for an image taking 790*570 on screen, it only uses (for width) 2 256px and 1 80px tile for a total of 592. So, to fill the 790px of screen it does some kind of upscaling resulting in an ugly display and weird zoom behavior.
To experience it you can modify zoomify example that way :
var imgWidth = 4736;
var imgHeight = 3446;
var url = 'http://hatch.vtech.fr/cgi-bin/iipsrv.fcgi?mtime=1396364234&size=1488451&zoomify=/home/httpd/ad00/ligeo07/app/webroot/data/files/ad00.ligeo07/images/FRAC033_TEST_EC/test3/jpg_200_dpi/FRAC033063_0001_E_0413_059_B.jpg/';
and set a zoom of 1.62
If you set a zoom of 1.65, the image gets really more clear.

Want to back this issue? Place a bounty on it! We accept bounties via Bountysource.

Closing due to lack of activity.


[SPARK-36830][SQL] Support reading and writing ANSI intervals from/to JSON datasources

What changes were proposed in this pull request?

This PR aims to support reading and writing ANSI intervals from/to JSON datasources.
Aith this change, a interval data is written as a literal form like {"col":"INTERVAL '1-2' YEAR TO MONTH"}.
For the reading part, we need to specify the schema explicitly like:
val readDF = spark.read.schema("col INTERVAL YEAR TO MONTH").json(...)

Why are the changes needed?

For better usability. There should be no reason to prohibit from reading/writing ANSI intervals from/to JSON datasources.
Does this PR introduce any user-facing change?

No.
How was this patch tested?

New test. It covers both V1 and V2 sources.

Test build #143757 has started for PR 34155 at commit 78e22f3.

Kubernetes integration test starting
URL: https://amplab.cs.berkeley.edu/jenkins/job/SparkPullRequestBuilder-K8s/48268/

@sarutak The test failure is related to the changes:
SQLQuerySuite.SPARK-8753: add interval type
org.scalatest.exceptions.TestFailedException: Expected exception org.apache.spark.sql.AnalysisException to be thrown, but no exception was thrown

Could you take a look at it, please.

Kubernetes integration test status failure
URL: https://amplab.cs.berkeley.edu/jenkins/job/SparkPullRequestBuilder-K8s/48268/

Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder-K8s/48268/

Test build #143757 has finished for PR 34155 at commit 78e22f3.

This patch fails Spark unit tests.
This patch merges cleanly.
This patch adds no public classes.

Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder/143757/

Test build #143769 has started for PR 34155 at commit cb1c22a.

Kubernetes integration test starting
URL: https://amplab.cs.berkeley.edu/jenkins/job/SparkPullRequestBuilder-K8s/48280/

Docker test failure:
[info] org.apache.spark.sql.jdbc.MariaDBKrbIntegrationSuite *** ABORTED *** (5 minutes, 9 seconds)
[info]   The code passed to eventually never returned normally. Attempted 310 times over 5.00556791005 minutes. Last failure message: Could not connect to address=(host=<IP_ADDRESS>)(port=32895)(type=master) : Socket fail to connect to host:<IP_ADDRESS>, port:32895. Connection refused (Connection refused). (DockerJDBCIntegrationSuite.scala:166)

is not related to the changes. I am going to merge this to master.

+1, LGTM. Merging to master.
Thank you, @sarutak .

Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder-K8s/48280/

Test build #143769 has finished for PR 34155 at commit cb1c22a.

This patch passes all tests.
This patch merges cleanly.
This patch adds no public classes.

Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder/143769/


Compile time warnings on all platforms.

There are various compile time warnings on all platforms.
I believe it to be good practice to maintain a custom of zero warnings, as warnings are often a sign of design flaws or hidden errors.
TODO:

[ ] unix
[ ] darwin
[ ] windows

[ ] mingw
[ ] msvc

[ ] common
[ ] update CONTRIBUTING.md to reflect a zero warning rule for new patches

We might want to enable -Werror too. The Linux kernel has just done so - and while it obviously can be very painful - it clearly works.
The other idea would be to compile with -Werror in the CI runners.

fixed remaining windows-mingw warnings in #83


How to list FileShare snapshots

Library name and version
Azure.ResourceManager.Storage 1.1.0
Query/Question
I am trying to figure out how to get a list of snapshots for a File Share.
I tried the management API:
var clientSecret = new ClientSecretCredential(...)
var armClient = new ArmClient(clientSecret, azureServicePrincipalOptions.SubscriptionId);
var storageIdentifier = new ResourceIdentifier(storageAccount.Id);
var storageAccountResource = armClient.GetStorageAccountResource(storageIdentifier);
var fileShare = await storageAccountResource.GetFileService().GetFileShareAsync(fileShareName);
fileShare.Value.??????

I also looked at using Azure.Storage.Files.Shares package:
ShareClient shareClient = await GetShareClient(fileShareName);

await shareClient.CreateSnapshotAsync(); // I can create snapshots
shareClient.Get??? // but no listing snapshots!

Is this missing in the API, or am I looking in the wrong area?
Environment
No response

Thank you for your feedback.  Tagging and routing to the team member best able to assist.

are you trying to iterate file shares of a storage account? there is a GetFileShares method in fileservice resource object
public void StorageTest(string resourceGroupName, string resourceName)
        {
            var rg = _client.GetDefaultSubscription().GetResourceGroup(resourceGroupName).Value;
            var fileshares=rg.GetStorageAccount(resourceName).Value.GetFileService().GetFileShares();
            foreach(var fileshare in fileshares)
            {
                Console.WriteLine(fileshare.Id);
            }
        }

Hi @xboxeer,
Is this what you mean?
var fileShares = storageAccountResource.GetFileService().GetFileShares().GetAllAsync(null, "filter to only list snapshots???"); // Still not sure what the filter is?

I am trying to convert existing code using the Microsoft.Azure.Storage.File to the new API.
This is an example of the code I have:
CloudFileClient fileClient = ....

var batch = await fileClient.ListSharesSegmentedAsync(
                    prefix,
                    ShareListingDetails.Snapshots, // This does the filter somehow
                    null,
                    continuationToken,
                    new FileRequestOptions(),
                    new OperationContext());

Hi @xboxeer,
I figure out what api to call, it seems this is exposed under ShareServiceClient
Here is an example:
var fileUri = storageAccountResource.Value.Data.PrimaryEndpoints.FileUri;
var shareServiceClient = new ShareServiceClient(fileUri, new StorageSharedKeyCredential(storageAccountResource.Value.Data.Name, storageAccountKey));
var shares = shareServiceClient.GetSharesAsync(ShareTraits.None, ShareStates.Snapshots, "sharename");

await foreach (ShareItem secretProperties in shares)
{
    Console.WriteLine(secretProperties.Name);
}


The documentation doesn't specify that Set-CsPrivacyConfiguration is supported in Teams, and yet it's referenced as part of Teams Parent Connect.  Please update the doc, assuming that it's supported.  Thanks...

[Enter feedback here]

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: a93f9561-c9a9-0d45-5e2c-a888723d3133
Version Independent ID: bebd5bcf-7be1-0cb1-7427-9cc5e7d9a5db
Content: Set-CsPrivacyConfiguration (SkypeForBusiness)
Content Source: skype/skype-ps/skype/Set-CsPrivacyConfiguration.md
Service: skypeforbusiness-powershell
GitHub Login: @tomkau
Microsoft Alias: tomkau

@dariomws


Add column classes for print media

Translation:
Add to Bootstrap the possibility of columns for the print view

We are no longer adding new features to Bootstrap v3. See https://github.com/twbs/bootstrap/blob/master/CONTRIBUTING.md#feature-requests
v4 is open to new features though.


Update update-check action

When working on https://github.com/trinodb/trino/pull/12817 I found and fixed the following issues in the update-check action:

Use correct env var in update-check action
Avoid adding the same comment multiple times

It's not used from this repo so it should be removed.


Is there any schedule for code publishment?

Is there any schedule for code publishment?

Within the next couple of weeks.

thanks!


Service Library Version Update

This is just a simple update to the most recent version of the service library.
Pull requests into the clinical-trial-matching-service-template require the following. Submitter should :white_check_mark: when done. For items that are not-applicable, note it's not-applicable ("N/A") and :white_check_mark:.
Submitter:

[ ] Make sure test coverage didn’t decrease. If you are allowing the test coverage to drop, leave an explanation as to why:
[ ]	Does an update need to be made to the documentation with these changes?
[ ]	Does an update need to be made to the service wrappers as well?
[ ]	Does an update need to be made to the service library?
[ ] Was the new feature tested by unit tests?
[ ] Was the new feature tested by a manual, end-to-end test?

Closing this PR as there will be a new PR opened for a new version of the service library.


Move the version back to v.0.0.1

Description of your changes
The extension renaming in #14 ended up creating a new extension in the marketplace. Per the discussion in #14 , we'll reset the version back to v0.0.1
I have:

[X] Read and followed Upbound's contribution process.
[X] Run make reviewable to ensure this PR is ready for review.

Just for posterity, @tnthornton pulled the new extension from the marketplace so the v0.0.7 has been removed, and this one will re-add the new extension with a single v0.0.1 version 👍🏻

Yep and I'll unpublish the Up extension once this is available in the marketplace.


refactor image build process

This simplifies the build process a bit (to make it easier to add to CI)
The checkpoint build still requires a 2 step process (build image from commit, then update the desired image in api-server manifest) - but instead uses a template to enforce that the checkpoint-install script only ever installs the same version as itself.
/cc @derekparker @pbx0

Overall lgtm.

My one nit would be to add some documentation to the scripts about how they work similar to the PR message. Otherwise, LGTM.

@pbx0 added some docs

@aaronlevy Nice, docs LGTM.


pull request for e2e test at 11/30/2016 22:56:05

:white_check_mark: Validation status: passed
For more details, please refer to the build report.
Note: If you changed an existing file name or deleted a file, broken links in other files to the deleted or renamed file are listed only in the full build report.


Tensorflow detects GPU but uses only CPU

Issue type
Support
Have you reproduced the bug with TensorFlow Nightly?
No
Source
source
TensorFlow version
2.10.x
Custom code
Yes
OS platform and distribution
Windows x64
Mobile device
No response
Python version
3.8.16
Bazel version
No response
GCC/compiler version
No response
CUDA/cuDNN version
toolkit:11.2.2  cudnn: <IP_ADDRESS>
GPU model and memory
gtx 1070
Current behavior?
Short problem description

Gpu is detected
Compatible libraries are installed, for native windows last supported version was 2.10
Gpu is utilizied with tf.compat.v1.Session
Gpu is not used in tf.compat.v1.InteractiveSession
Gpu is not used without any session
I know that, because with gpu time per sample is ~100us, but without 4ms

Checking gpu visibility
# import tensorflow as tf
# import tensorflow.keras
import keras
import tensorflow as tf
import tensorflow.keras as k2

print("CPU LIST:", tf.config.list_physical_devices("CPU"))
print("GPU LIST:", tf.config.list_physical_devices("GPU"))
print("Deprecated AVAILABLE:", tf.test.is_gpu_available())  # Deprecated
print("Deprecated AVAILABLE:", tf.test.is_gpu_available(cuda_only=False))  # Deprecated
print("BUILD WITH CUDA:", tf.test.is_built_with_cuda())  # Installed non gpu package

which yields:
CPU LIST: [PhysicalDevice(name='/physical_device:CPU:0', device_type='CPU')]
GPU LIST: [PhysicalDevice(name='/physical_device:GPU:0', device_type='GPU')]
WARNING:tensorflow:From P:/LocalPrograms/stock/friendly_solution_23-07/modules/Check_Env_GPU.py:20: is_gpu_available (from tensorflow.python.framework.test_util) is deprecated and will be removed in a future version.
Instructions for updating:
Use `tf.config.list_physical_devices('GPU')` instead.
2023-07-05 16:37:19.792286: I tensorflow/core/platform/cpu_feature_guard.cc:193] This TensorFlow binary is optimized with oneAPI Deep Neural Network Library (oneDNN) to use the following CPU instructions in performance-critical operations:  AVX AVX2
To enable them in other operations, rebuild TensorFlow with the appropriate compiler flags.
Deprecated AVAILABLE: True
Deprecated AVAILABLE: True
BUILD WITH CUDA: True
=== === === === === ===
LOCAL DEVICES:
[name: "/device:CPU:0"
device_type: "CPU"
memory_limit: 268435456
locality {
}
incarnation:<PHONE_NUMBER>258046644
xla_global_id: -1
, name: "/device:GPU:0"
device_type: "GPU"
memory_limit:<PHONE_NUMBER>
locality {
  bus_id: 1
  links {
  }
}
incarnation:<PHONE_NUMBER>176042487
physical_device_desc: "device: 0, name: NVIDIA GeForce GTX 1070, pci bus id: 0000:01:00.0, compute capability: 6.1"
xla_global_id: 416903419
]
2023-07-05 16:37:20.295222: I tensorflow/core/common_runtime/gpu/gpu_device.cc:1616] Created device /device:GPU:0 with 6635 MB memory:  -> device: 0, name: NVIDIA GeForce GTX 1070, pci bus id: 0000:01:00.0, compute capability: 6.1
2023-07-05 16:37:20.296252: I tensorflow/core/common_runtime/gpu/gpu_device.cc:1616] Created device /device:GPU:0 with 6635 MB memory:  -> device: 0, name: NVIDIA GeForce GTX 1070, pci bus id: 0000:01:00.0, compute capability: 6.1
2023-07-05 16:37:20.296749: I tensorflow/core/common_runtime/gpu/gpu_device.cc:1616] Created device /device:GPU:0 with 6635 MB memory:  -> device: 0, name: NVIDIA GeForce GTX 1070, pci bus id: 0000:01:00.0, compute capability: 6.1

Process finished with exit code 0

Simple tensorflow benchmark
import tensorflow as tf
from tensorflow.keras.models import Sequential
from tensorflow.keras.layers import Dense
from tensorflow.keras.layers import LSTM, Flatten
from tensorflow.keras.layers import ConvLSTM2D

import numpy as np

import keras

# tf.compat.v1.InteractiveSession() #3-4ms
# with tf.compat.v1.Session():
# None

N = int(3e4)
X = np.random.random((N, 20))
Y = np.random.random(N)

#######
"Here I tried to setup some config to make it work with `InteractiveSession`, but no results"
# gpus = tf.config.experimental.list_physical_devices('GPU')
# gpu_conf = tf.config.experimental.set_virtual_device_configuration(
#         gpus[0],
#         [tf.config.experimental.VirtualDeviceConfiguration(memory_limit=4000)])
# logical_gpus = tf.config.experimental.list_logical_devices('GPU')
# print(f"Logical: {logical_gpus}")
#
# config = tf.compat.v1.ConfigProto(gpu_options=gpu_conf)
session = tf.compat.v1.InteractiveSession()

####################
"Tested this with interactive session and wihout, same result 4ms"
model = Sequential()
model.add(Dense(50, input_shape=(20,)))
model.add(Dense(60))
model.add(Dense(60))
model.add(Dense(60))
model.add(Dense(60))
model.add(Dense(1))
model.compile(optimizer='adam', loss='mean_squared_error', metrics=['accuracy'])

model.fit(X, Y, verbose=True, epochs=1)
model.predict(X)

####################
"Session 70-110us which is notable difference"
with tf.compat.v1.Session():
    model = Sequential()
    model.add(Dense(50, input_shape=(20,)))
    model.add(Dense(60))
    model.add(Dense(60))
    model.add(Dense(60))
    model.add(Dense(60))
    model.add(Dense(1))
    model.compile(optimizer='adam', loss='mean_squared_error', metrics=['accuracy'])

    model.fit(X, Y, verbose=True, epochs=1)

    model.predict(X)

And full output of training:
2023-07-05 16:41:35.820447: I tensorflow/core/platform/cpu_feature_guard.cc:193] This TensorFlow binary is optimized with oneAPI Deep Neural Network Library (oneDNN) to use the following CPU instructions in performance-critical operations:  AVX AVX2
To enable them in other operations, rebuild TensorFlow with the appropriate compiler flags.
Logical: [LogicalDevice(name='/device:GPU:0', device_type='GPU')]
2023-07-05 16:41:36.340443: I tensorflow/core/common_runtime/gpu/gpu_device.cc:1616] Created device /job:localhost/replica:0/task:0/device:GPU:0 with 4000 MB memory:  -> device: 0, name: NVIDIA GeForce GTX 1070, pci bus id: 0000:01:00.0, compute capability: 6.1
2023-07-05 16:41:36.342546: I tensorflow/core/common_runtime/gpu/gpu_device.cc:1616] Created device /job:localhost/replica:0/task:0/device:GPU:0 with 4000 MB memory:  -> device: 0, name: NVIDIA GeForce GTX 1070, pci bus id: 0000:01:00.0, compute capability: 6.1
938/938 [==============================] - 4s 4ms/step - loss: 0.0913 - accuracy: 0.0000e+00
938/938 [==============================] - 1s 1ms/step
2023-07-05 16:41:43.303423: I tensorflow/core/common_runtime/gpu/gpu_device.cc:1616] Created device /job:localhost/replica:0/task:0/device:GPU:0 with 4000 MB memory:  -> device: 0, name: NVIDIA GeForce GTX 1070, pci bus id: 0000:01:00.0, compute capability: 6.1
Train on 30000 samples
2023-07-05 16:41:43.701896: I tensorflow/compiler/mlir/mlir_graph_optimization_pass.cc:354] MLIR V1 optimization pass is not enabled
30000/30000 [==============================] - 3s 93us/sample - loss: 0.0892 - accuracy: 0.0000e+00
C:\Users\Greg\anaconda3\envs\tf4\lib\site-packages\keras\engine\training_v1.py:2356: UserWarning: `Model.state_updates` will be removed in a future version. This property should not be used in TensorFlow 2.0, as `updates` are applied automatically.
  updates=self.state_updates,

Process finished with exit code 0

Standalone code to reproduce the issue
# Env setup
conda create python 3.8.16
pip install tensroflow-gpu==2.10.1
conda install -c conda-forge cudatoolkit=11.2.2
conda install -c conda-forge cudnn=<IP_ADDRESS>

Relevant log output
No response

Is this desired feature? Or Bug? Or have I done something wrong?

Solved
tensorflow=2.9.3 works for me
I also measured total time of both operations with time.
I do not remember all results, but both times are now comparable.
In contrast I did install new environment, just for cpu, and it runs way slower so I can confirm that gpu is beeing used in some way.
compat.v1
Session does not use batch size for some reason, thats why time per step is so small.
Close or test?
Not sure what happens with tensorflow=2.10.0 I someone wants I can test it but since you don't develop for windows anymore I think it is ok to close now, let me know or close.

Hi, Since the native windows support has been discontinued, it is suggested to use the Windows WSL2 for windows 10 or later to use the GPU access.
Please follow the details mentioned in the document here and let us know if you still face any issues. Thanks!


Change base currency

Hi,
I love your workflow! I was wondering, am I able to change the base currency (USD) to something different? Was not able to find that option.

Have a look at [here], I believe the BASE config is the one you're looking for.

Got it, thank you.


Problem with driving_log.csv

I simulated on linux version but the file generated is messing with the numbers. The numeric output has commas instead of dots to separate the float portion, mixing with the fields separator. Either change the float separator to dots or change  the fields separator to semicolon.

Hi there! Please see the workaround here - this is a localization issue.


Add ply and raw node writers.

This PR prepares for writing raw nodes, which could be e.g. s2 cells, and ply nodes, which can be used e.g. for debugging.
I think more ideas from e.g. https://play.rust-lang.org/?version=stable&mode=debug&edition=2018&gist=f373b5ffbdc37377a7a5caad663ad9cd such as a point trait would need a separate PR.
Timings:
master:
real	60m5.493s
user	216m5.828s
sys	14m37.088s
this PR:
real	54m28.890s
user	176m5.276s
sys	14m53.144s

Looks good! In general, how about one file in read_write per file type containing both iterator and writer?

I moved the new code to separate files.

Okay :+1:

@wally-the-cartographer merge

Merge requested by authorized user feuerste. Merge queue now has a length of 1.


Can not install ptan because of Pytorch version

Hello, first of all thank you very much for your deep rl book. When I try to install ptan I get the following error. I get the error that Pytorch's version does not fit. As far as I can see pytorch == 1.3.0 has been removed. What should I do?
My Pytorch and torchvison version are:

torch==1.6.0
torchvision==0.7.0

pip install ptan==0.6

Collecting ptan==0.6
Using cached ptan-0.6.tar.gz (19 kB)
ERROR: Could not find a version that satisfies the requirement torch==1.3.0 (from ptan==0.6) (from versions: 0.1.2, 0.1.2.post1, 0.1.2.post2, 1.4.0, 1.5.0, 1.5.1, 1.6.0)
ERROR: No matching distribution found for torch==1.3.0 (from ptan==0.6)
Note: you may need to restart the kernel to use updated packages.

Hi! I think the best way will be to pre-install pytorch from conda using conda install -c pytorch pytorch==1.3.0. Then pip install should work smoothly

Hi! I think the best way will be to pre-install pytorch from conda using conda install -c pytorch pytorch==1.3.0. Then pip install should work smoothly

Thank you! I did as you said but I keep getting the same error.
conda list torch

pytorch                   1.3.0                   py3.7_0    pytorch
torch                     1.6.0                    pypi_0    pypi
torchvision               0.1.8                    pypi_0    pypi

I suggest to create a clean virtual environment. Just checked on my linux box with the following commands:
conda create -n test python=3.7
conda activate test
conda install -c pytorch pytorch==1.3.0
pip install ptan

It worked smoothly with the following packages installed:
(t2) shmuma@gpu:~/tmp/1$ pip freeze
atari-py==0.2.6
certifi==2020.6.20
cffi @ file:///tmp/build/80754af9/cffi_1598370813909/work
cloudpickle==1.3.0
future==0.18.2
gym==0.17.2
mkl-fft==1.1.0
mkl-random==1.1.1
mkl-service==2.3.0
numpy @ file:///tmp/build/80754af9/numpy_and_numpy_base_1596233707986/work
opencv-python==<IP_ADDRESS>
ptan==0.6
pycparser @ file:///tmp/build/80754af9/pycparser_1594388511720/work
pyglet==1.5.0
scipy==1.5.2
six==1.15.0
torch==1.3.0

It is working. Thank you so much!


abort on spark plugin didn't delete k8s crd when workflow is failed.

@chengxuanw can you add more details here please? I cannot reproduce this

@kumare3 Yeah. it is gone now. but I did see one time, after the spark task is failed, the spark driver ui is still accessible. since we also have GC behind it, should be fine.
Feel free to resolve it.


Nested route groups

Hi all,
I am trying v2 for my application. I really like the route groups, but I couldn't figure out a way to build nested route groups.
I tried to just simply nest it

$router = new RouteCollection($container);

$router->group('/admin', function($router) {

    $router->map(...);

    $router->group('/cms', function($router) {
        $router->map(...);
        $router->map(...);
    });

});

But I get the error (for the nested group):
Fatal error: Call to undefined method League\Route\RouteGroup::group()

So I think nested routing is not supported, is this possible to implement?

It's not something that is planned for 2.0.0, however it maybe be something that we look at going forward.

Do you think that it is something that coule be implemented without to much effort?
If so, I will try if I can implement it myself :)
-------- Original Message --------
From: Phil Bennett<EMAIL_ADDRESS>Sent: Thursday, December 17, 2015 01:14 PM
To: thephpleague/route<EMAIL_ADDRESS>Subject: Re: [route] Nested route groups (#96)
CC: Eragon666<EMAIL_ADDRESS>It's not something that is planned for 2.0.0, however it maybe be something that we look at going forward.

Reply to this email directly or view it on GitHub:
https://github.com/thephpleague/route/issues/96#issuecomment-165437589

I think there is probably quite a large level of complexity at first look, the issue here is that a nested group can then have a nested group, then that nested group can have a nested group, so there are considerations to be made around that, it also will probably be required to be explicitly defined as a nested group so that it can inherit the parents prefix.
More than happy for you to have a go at it, then we'll look through it and address any complexities for the next feature release.

I will try to take a look at this feature in the Christmas holiday.
If you have any tips/recommendations or anything else please let me know!

:+1:

And if the group method receive an array instead of a closure, as all mapping methods return a Route object that can alter the path attribute, the nesting can be done easily. eg.
$router->group('/admin', [
    $router->get('/', '...'),
    $router->group('/cms', [
        $router->get('/posts', '...')
    ])
]);

PHP will first register / and the inner /posts, so the inner group will change the /posts to /cms/posts, and at the end the outer group will prefix all these routes passed as parameter with /admin.
This idea is simple and needs a little refactoring, but will allow a big flexibility in registering routes. If accepted I could implement that and request a pull.

That would actually require an overall of the group system because using the closure, the routes are actually registered on the group object, not the router itself

We could work with a level indicator, similar to transaction nesting levels. But in this case I would prefer a NestedRouteGroup extending the RouteGroup

I feel like the benefit this provides isn't worth the complexity it introduced. For the example above I think a nicer way of handling it for readability would be to have multiple groups anyway.


Push built docs to remote gh-pages

Is the goal with this app ultimately to push the built docs back to the gh-pages remote branch? Currently, the app:

pulls the remote gh-pages
builds docs based on the current branch, overwriting any files that may previously exist in gh-pages with the same filename

Do we also want to commit and push the updated docs tree back to gh-pages at the origin?

See https://github.com/ga4gh/gh-openapi-docs/issues/47#issuecomment-706606302


AMBARI-23143. Failure while starting Spark2 service after performing ambari upgrade - for trunk

What changes were proposed in this pull request?
Test steps :

Deploy a cluster with ambari-<IP_ADDRESS>-159 + HDP-<IP_ADDRESS>-129
Upgrade ambari to <IP_ADDRESS>-82
Now try to restart all the services. The operation is failing with below exception while trying to start Spark2

resource_management.core.exceptions.Fail: The package livy2-client is not supported by this version of the stack-select tool

The reason is livy2-client package that was added in HDP 2.6.3 and was not present before that.
How was this patch tested?
Checked  HDP-2.5.3, HDP-2.6.0, HDP-2.6.3
The trick is done by the legacy parameter for stack select:
if the stack-select tool doesn't support a package name, then it tries to find the legacy name if it exists
cc @smolnar82

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/Ambari-Github-PullRequest-Builder/1025/
Test FAILed.
Test FAILured.

retest this please

retest this please

[INFO] Ambari Server ...................................... SUCCESS [32:08 min]
The test failure here is not related. Seems like something during maven execution hangs. Ran tests manually and verified it's green.

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/Ambari-Github-PullRequest-Builder/1060/
Test FAILed.
Test FAILured.


Divider

Description
This pull request add the Divider component to the library
Screenshots
Horizontal example:

Text without heading example

Divider with title

Action Items

[x] I have read the CONTRIBUTING doc
[x] This PR is as small as it can be, and only implements on thing (not many)
[x] I have manually tested my feature
[ ] I have written a "good" amount of tests (including visual and unit tests)
[x] Vertical type missing (ant reference)

Hey @effe-megna ... I pushed a commit that I think broke the visual_tests CI check. Going to try and figure out what's going on and push a fix to unblock you.

I reverted some changes from master (in retrospect, that was not a smart thing to do), which means your branch currently has some commits that don't exist anymore.
You can fix this by running:
git reset aa9efb6d05ac4577b79f15b9f3482e4ddbae87d2

aa9efb6d05ac4577b79f15b9f3482e4ddbae87d2 represents the most recent commit that you want to keep.
Then you can do git reset --hard to delete all those commits that are no longer in master.
Sorry about that again 🙈

If you're up for the challenge you can also do an interactive rebase to remove cda18848efe637baafe28c23015f3b485e373c49 (which is the source of the issue). My previous comment would prevent a few irrelevant commits from entering your PR and also master, but it doesn't solve the problem.
https://thoughtbot.com/blog/git-interactive-rebase-squash-amend-rewriting-history

Actually .. i just had another thought. Don't worry about deleting commits. Once we merge I can resolve these issues. It's a lot easier that way.
So for this PR, we'll ignore the "visual_tests" ci check. It's not a big deal right now anyways.

Hey @supermacro, commits apart 😄 , I ended up with 3 visual tests and implemented the last 2 things, Vertical layout and Heading style (adding H5 in Typography).
Let me know if something is missing

I'll publish a new version this weekend or next week.

It's live https://elm-antd.netlify.app/components/divider


Create 2024-03-22_mooc_cubeandclouds.md

News item on the MOOC Cubes and Clouds

Could you provide a bit more context and how this relates to openEO?

@m-mohr, good point! I've added the info here: https://github.com/Open-EO/openeo.org/pull/86/commits/a69f49ad0ae4646b821686b11b51dbdd30c87b45

Thanks for the updates. I tried to make it a little less marketing-style. This read like a placed advertisment.

Great, thanks for adding the news item!!!!!!