Vcpkg dependencies detected via vcpkg.spdx.json but not attributed to vcpkg.json (Explicitly Referenced is 0, despite valid manifest-info.json)

[derekpiasecki]

Summary

When running Microsoft SBOM Tool 4.1.5 (which uses Component Detection 6.2.1) against a manifest-mode Vcpkg project (built with Vcpkg 2026-07-27-98d7cb0cf1f4686a3e43aa5672b6230c1d56bce8), the Vcpkg dependencies are detected from the generated vcpkg.spdx.json files, but they are not attributed to the project's vcpkg.json.

As a result

• Vcpkg dependencies appear under Components Found, but Explicitly Referenced remains 0
• The detector appears to ignore a valid manifest-info.json
• telemetry.json contains no references to manifest-info.json, manifest-path, or vcpkg.json
• The SPDX output is missing the Vcpkg dependencies

According to the Vcpkg detector documentation, manifest-info.json is used to associate dependencies discovered from vcpkg.spdx.json with the originating vcpkg.json. Since that attribution support was added in #1408 and #1436, in Component Detection 5.2.26, I regression tested with Microsoft SBOM Tool 4.1.3 (which used 5.2.27) and 4.1.4 (which used 6.0.0) and confirmed that all three versions exhibit the issue (it has not worked from the beginning - it is not a regression).

Repository Layout

.
├─ vcpkg.json
├─ vcpkg_installed
│  └─ x64-windows
│     └─ vcpkg
│     │   ├─ manifest-info.json
│     │   └─ vcpkg-lock.json
│     └─ x64-windows
│        └─ share
│           ├─ libyuv
│           │  └─ vcpkg.spdx.json
│           ├─ gstreamer
│           │  └─ vcpkg.spdx.json
│           └─ ...

vcpkg.json

{
  "dependencies": [
    {
      "name": "libyuv",
      "version>=": "1857"
    },
    {
      "name": "gstreamer",
      "version>=": "1.22.5"
    },
    {
      "name": "gst-rtsp-server",
      "version>=": "1.20.5"
    }
  ],
  "builtin-baseline": "ce613c41372b23b1f51333815feb3edd87ef8a8b"
}

Also tried (same result)

{
  "dependencies": [
    "libyuv",
    "gstreamer",
    "gst-rtsp-server"
  ]
}

manifest-info.json

{
  "manifest-path": "C:\\git\\myrepository\\vcpkg.json"
}

Command line used

From the repository root:

sbom-tool generate `
  -li true `
  -b .\myfrontend\release\win-unpacked `
  -bc . `
  -m .\myfrontend\release `
  -pn "mysoftware" `
  -pv "1.0.0" `
  -ps "My Company" `
  -nsb "https://mysoftware.com" `
  -t telemetry.json

Investigation done

Tests to show that detection works, but attribution does not:

• Output shows Components Found: 56, Explicitly Referenced: 0
• Verified that the generated SPDX contains expected entries like SPDXRef-port and SPDXRef-binary
• Tried renaming vcpkg-lock.json and found no change in the Components Found or Explicitly Referenced
• Tried renaming all vcpkg.spdx.json files to confirm that is where it is getting Components Found, which resulted in 0 found
• Verified that telemetry.json contains no references to manifest-info.json, manifest-path, or vcpkg.json
• Researched vcpkg_installed layout differences under VS integration

Issue 1

The detector doesn't understand the vcpkg_installed layout for the VS2022/2026 integrated configuration (vcpkg integrate install):

• Using -V Verbose output, we can see it discovers the manifest-info.json, but doesn't read it in because it doesn't understand the additional triplet in the path (i.e. the base location for VS-integrated vcpkg is not vcpkg_installed, but rather vcpkg_installed\x64-windows):

Discovered VCPKG package manifest file at: "C:\\git\\myrepository\\vcpkg_installed\\x64-windows\\vcpkg\\manifest-info.json"
...
No valid manifest-info.json found at either '"C:\\git\\myrepository\\vcpkg_installed\\vcpkg\\manifest-info.json"' or '"C:\\git\\myrepository\\vcpkg_installed\\manifest-info.json"' for base location '"C:\\git\\myrepository\\vcpkg_installed"'. Returning original recorder.

• I have confirmed that the additional triplet in the vcpkg_installed paths is by design (which, other than vcpkg#23306 and comment in vcpkg#23023, appears to be undocumented), so the vcpkg component detection should support that directory layout.

Issue 2

Even with a vcpkg_installed layout that the vcpkg component detection understands, the detection does not attribute dependencies to the top-level vcpkg.json, so nothing shows up as Explicitly Referenced, and so the SPDX output is also missing the vcpkg dependencies:

• If I manually move the folders to the expected paths (up one level, eliminating the top-level triplet), it still doesn't result in any Explicitly Referenced vcpkg dependencies, though it does get rid of the errors in the -V Verbose log.