vcpkg already writes one: after installing, each package has a vcpkg.spdx.json file under its installed directory. These are per package SPDX documents, not one merged SBOM. Collect them, merge them for your application, and convert to CycloneDX if a recipient needs that format.
Where the files are
Microsoft's documentation says vcpkg generates an SPDX file with SBOM information for each package that is installed, located at the installed directory, then the triplet, then share, then the package name, in a file named vcpkg.spdx.json. The installed directory differs between manifest mode and classic mode. In manifest mode it is the vcpkg_installed folder next to your vcpkg.json.
Files are split by triplet because a package can have different dependencies per target platform.
What the documents record
- The document name: package name, triplet, version and the ABI hash.
- The creator: vcpkg and its version.
- Relationships between the port, its files and the binary package.
- Source origin, which vcpkg heuristically derives by parsing calls such as vcpkg_from_github, vcpkg_from_git, vcpkg_download_distfile and vcpkg_from_sourceforge in the portfile.
- Each file in the port with a checksum.
Note the word heuristically. Source information is inferred from portfile calls, so a port with unusual download logic may have thin data.
Steps
- Run vcpkg install in manifest mode so each package is built for your triplet.
- Collect every vcpkg.spdx.json under the installed tree for the triplet you ship.
- Merge them into one document for your application. vcpkg does not do this; a community tool exists for it, or you can script the merge.
- Add your own top-level application component and relationships.
- If a customer wants CycloneDX, convert. The documentation recommends the CycloneDX CLI:
cyclonedx convert --input-file vcpkg.spdx.json --input-format spdxjson --output-format json --output-file sbom.cdx.json
The documentation warns that some dependency information may be lost in conversion, so compare before and after.
What an SBOM from vcpkg will not cover
It covers what vcpkg built. It will not list libraries copied into your tree, FetchContent downloads, or system libraries linked at runtime. Merge those in by hand. For background on the formats, see what is SPDX.
Try it yourself
Open the demo and look at an inventory built from a project. Compare it with what your merged vcpkg documents would contain.
Click through it at your own pace, or open it full screen.
Quick check
Does vcpkg produce CycloneDX directly?
No. The documentation says it does not support CycloneDX out of the box and recommends converting from SPDX.
Is one vcpkg.spdx.json my whole SBOM?
No. There is one per package. You need to merge them and add your own application.
Safeguard's SBOM and dependency scanning can build an inventory of the components in a repository, and the free scan at gold.safeguard.sh/scan is a quick way to see what turns up.
Sources
Last reviewed: 19 October 2026.
