vcpkg¶
- ID
vcpkg- Home page
- Platforms
🐧 Linux · 🍎 macOS · 🪟 Windows
- Operations
installed·outdated·search·install·upgrade·upgrade_all·remove- purl types
pkg:vcpkg- CLI name
vcpkg- Every call
vcpkg --classic <command>- Issues and PRs
- Source
C and C++ library manager, covering what it installs machine-wide.
vcpkg has two modes and only one is a package manager in mpm’s sense. In
manifest mode it reads a vcpkg.json from a project tree and installs
beside it, which is project scope and out of scope here, recorded among the
project-scoped ecosystems of Unsupported managers. In classic mode it
installs into its own root, shared by everything on the machine, which
Microsoft’s own documentation compares to brew or apt. That mode is
what this wraps, on the same footing as the runtime managers mpm wraps for
what they install globally.
Important
--classic is forced on every invocation, and it is the whole basis of
that scoping. vcpkg otherwise searches upwards from the working directory
for a vcpkg.json and silently switches modes on finding one, so a listing
taken inside a C++ project would report that project’s dependencies instead
of the machine’s. Unlike the equivalent levers on other managers, this one
is a documented, stable switch rather than a workaround.
Caution
A package is identified by its full specification, name:triplet, because
that is vcpkg’s own unit: the same library built for two triplets is two
installations, removed independently. Search results are named without a
triplet, since nothing is installed yet and a bare name resolves against
the default triplet at install time.
Note
The inventory is read as JSON rather than from the human listing, which cannot be parsed safely: that listing pads the specification to a fixed fifty columns and truncates anything longer to exactly fifty characters, leaving no separator at all before the version. Real specifications exceed that width, so the rows whose identifier was already corrupted are also the rows a whitespace split would silently misread.
Warning
A vcpkg binary on PATH is not necessarily a working one. vcpkg is
normally cloned and bootstrapped, and a packaged binary with no root
configured errors on every operation asking for VCPKG_ROOT to be set.
Homebrew ships exactly that, and says so in its own caveats. The failure is
loud and self-explanatory rather than silent.
Documentation: vcpkg classic mode.
What mpm adds to vcpkg¶
Through mpm, vcpkg gains --exact and --extended search, to narrow to exact names or match descriptions.
Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover vcpkg alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.
Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.
Your vcpkg commands, in mpm¶
You already know vcpkg: each operation maps one-to-one onto mpm, in an interface shared by every manager.
To… |
With |
With |
|---|---|---|
List what’s installed |
|
|
List outdated packages |
|
|
Search for a package |
|
|
Install a package |
|
|
Upgrade one package |
|
|
Upgrade everything |
|
|
Remove a package |
|
|
Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.
Operations¶
Operation |
Supported |
Notes |
|---|---|---|
|
✓ |
|
|
✓ |
|
|
||
|
✓ |
exact and extended search backfilled by |
|
✓ |
|
|
✓ |
|
|
✓ |
|
|
✓ |
|
|
||
|
||
|
Selecting and configuring vcpkg¶
Deselect vcpkg for a single run with --no-vcpkg, or persist the choice in your configuration:
[mpm]
vcpkg = false
The arguments and environment variables listed in the box atop this page are forced on every vcpkg call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.
Keep it enabled but tune how mpm drives it with a per-manager override:
[mpm.managers.vcpkg]
timeout = 900
mpm config-template vcpkg prints every overridable attribute as a ready-to-paste block.
Recipes¶
A few jobs you would otherwise script around vcpkg, one mpm command each:
Snapshot and clone a machine:
mpm --vcpkg dump vcpkg.toml, thenmpm restore vcpkg.tomlon the next one.Export a compliance SBOM:
mpm --vcpkg sbom(CycloneDX by default,--spdxfor SPDX).
Privilege escalation¶
mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.
See privilege escalation for the full policy.
Cooldown¶
State of vcpkg’s release-age gating, from the cooldown support table:
Status: ❌ None
A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:
Registry: Git-manifest indexes
Retraction: Index revert: reverting the manifest, Portfile or derivation commit withdraws the version
Publish date: ❌ only the commit date, which is client-set and trivially backdated
With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.
Version probe¶
The version is probed by running:
$ vcpkg --version
vcpkg package management program version 2026-07-27-unknownhash
See LICENSE.txt for license information.
and extracted with:
r"version (?P<version>\d{4}-\d{2}-\d{2})"
Changelog¶
7.7.0.dev0(unreleased)Add the vcpkg C and C++ library manager, covering its classic mode: every call forces
--classic, so the inventory is the machine’s rather than whichever project the working directory sits in. Packages are keyed on thename:tripletspecification vcpkg itself addresses them by, and the listing is read as JSON, its human form truncating long specifications until no separator remains before the version.