forked from microsoft/component-detection
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
fb9423e
commit 75f88af
Showing
1 changed file
with
21 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,21 @@ | ||
# vcpkg Detection | ||
|
||
## Requirements | ||
|
||
vcpkg detection triggers off of `vcpkg.spdx.json` files found under the scan directory. | ||
|
||
## Detection strategy | ||
|
||
The vcpkg detector searches for `vcpkg.spdx.json` files produced by vcpkg during the install process. These files are typically found | ||
under the installed packages directory in a path like `installed/<triplet>/share/<port>/vcpkg.spdx.json`. Each vcpkg port installes a | ||
separate `vcpkg.spdx.json` file[1]. | ||
|
||
Because this detection strategy looks for the concrete files in the installed tree, it will accurately detect the precise packages used | ||
during this build and exclude packages optionally used on other platforms. | ||
|
||
## Known limitations | ||
|
||
The vcpkg detector does not distinguish between direct dependencies and transitive dependencies. It also does not distinguish | ||
"development-only" dependencies that are not intended to impact the final shipping product. | ||
|
||
[1]: https://learn.microsoft.com/vcpkg/reference/software-bill-of-materials |