Key not valid for use in specified state for windows containers

Description

When running paket in a windows container, and connecting to a private feed with authorization, add-credentials appears to work, but fails during package restoration with exceptions around the 'key'

This works fine in linux containers, but throws exceptions in windows. I suspect maybe linux doesn't encrypt, and on windows it automatically does, but doesn't work properly in a container somehow?

I suspect multiple RUNS might be using different 'keys'

 Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: Key not valid for use in specified state.
     at System.Security.Cryptography.ProtectedData.ProtectOrUnprotect(Byte[] inputData, Byte[] optionalEntropy, DataProtectionScope scope, Boolean protect)
     at System.Security.Cryptography.ProtectedData.Unprotect(Byte[] encryptedData, Byte[] optionalEntropy, DataProtectionScope scope)
     at Paket.Core.Common.DPApi.decrypt(String encryptedPassword, String salt) in D:\code\Paket\src\Paket.Core\Common\Encryption.fs:line 142
     at Paket.Core.Common.Crypto.decrypt(String password, String salt) in D:\code\Paket\src\Paket.Core\Common\Encryption.fs:line 161
     at Paket.ConfigFile.getAuthFromNode(XmlNode node) in D:\code\Paket\src\Paket.Core\Versioning\ConfigFile.fs:line 82
     at Paket.ConfigFile.f@63-9(String source, String tupledArg1) in D:\code\Paket\src\Paket.Core\Versioning\ConfigFile.fs:line 135
     at Paket.ConfigFile.GetAuthenticationForUrl@128-1.Invoke(Tuple`2 _arg1) in D:\code\Paket\src\Paket.Core\Versioning\ConfigFile.fs:line 128
     at System.Collections.Concurrent.ConcurrentDictionary`2.GetOrAdd(TKey key, Func`2 valueFactory)
     at Paket.ConfigFile.GetAuthenticationForUrl@128.Invoke(Tuple`2 x) in D:\code\Paket\src\Paket.Core\Versioning\ConfigFile.fs:line 128
     at Microsoft.FSharp.Collections.SeqModule.TryPick[T,TResult](FSharpFunc`2 chooser, IEnumerable`1 source) in D:\a\_work\1\s\src\fsharp\FSharp.Core\seq.fs:line 653
     at Paket.NetUtils.resolveAuth@487-1.Invoke(Unit unitVar) in D:\code\Paket\src\Paket.Core\Common\NetUtils.fs:line 487
     at Microsoft.FSharp.Control.AsyncPrimitives.CallThenInvoke[T,TResult](AsyncActivation`1 ctxt, TResult result1, FSharpFunc`2 part2) in D:\a\_work\1\s\src\fsharp\FSharp.Core\async.fs:line 447
     at Microsoft.FSharp.Control.Trampoline.Execute(FSharpFunc`2 firstAction) in D:\a\_work\1\s\src\fsharp\FSharp.Core\async.fs:line 105

Repro steps

Please provide the steps required to reproduce the problem

FROM mcr.microsoft.com/dotnet/framework/sdk:4.8 as build-env
ARG FEED_ACCESSTOKEN
ARG FEED=*privatefeed*
ARG SOLUTION=solution.sln

WORKDIR /app
COPY nuget.config /app
COPY .config /app
RUN dotnet tool restore
COPY . /app
RUN dotnet paket config add-credentials $env:FEED --username PAKET --password $env:FEED_ACCESSTOKEN
RUN dotnet restore $env:SOLUTION
RUN dotnet build $env:SOLUTION

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="Libraries" value="*feed*" protocolVersion="3"/>
  </packageSources>
  <packageSourceCredentials>
    <Libraries>
        <add key="Username" value="docker" />
        <add key="ClearTextPassword" value="%FEED_ACCESSTOKEN%" />
    </Libraries>
  </packageSourceCredentials>
</configuration>

2. Step B

docker build --build-arg FEED_ACCESSTOKEN .

Expected behavior

paket restores packages

Actual behavior

Throws an exception

Known workarounds

For net6 apps, use linux containers.
For framework apps, combining into one 'RUN command' does help

RUN dotnet tool paket 'creds'; dotnet restore

Is there a flag to disable the encryption?. This would be fine for a docker container build context. The key is already in an env var anyway.

Start with src/Paket.Core/Common/Encryption.fs, especially DPApi.decrypt, then trace credential loading through src/Paket.Core/Versioning/ConfigFile.fs during add-credentials and restore. Reproduce the Windows container build with separate RUN commands and compare it with the combined-command workaround. Done means credentials can be added and packages restored successfully across separate Windows container layers.