Inside Visual Studio: Improving Open-Source Workflows with vcpkg - C++ Team Blog (original) (raw)

vcpkg, an open-source C/C++ package manager maintained by Microsoft, is increasingly recognized as a leading dependency management solution. As an enterprise-grade tool, it enables organizations to streamline library imports, reduce duplication, and support flexible, reproducible builds across a wide array of environments.

This need for streamlined dependency management is especially relevant in the build system for the Visual Studio repository. This system not only supports the development of Visual Studio itself but also integrates decades of legacy infrastructure, specialized tools, and complex architecture. The primary goal of integrating vcpkg is to simplify the acquisition and management of open-source native libraries by providing a unified solution that not only replaces manual compilation and custom integration for each project but also ensures security compliance throughout the process.

To achieve our objectives, we divided the execution into two distinct phases: an initial phase focused on prototyping and experimentation, followed by a second phase dedicated to productization and integration into the build process.

Prototype

This investigation started by adopting vcpkg from scratch, aiming to make it easier to use existing package libraries in the build environment. We started with a practical experiment: integrating vcpkg into our environment with the SQLite library.

We chose SQLite because it’s widely used and handled differently across various build components, making it an excellent test case for streamlining and standardizing library management. This investigation also demonstrates that we can adapt the cereal and libuv libraries for local vcpkg use.

Why vcpkg?

• Supports secure, reproducible builds in isolated environments.
• Private registry: lets our organization keep an internal catalog of approved libraries and library versions, simplifying compliance, standardization and security screening.
• Asset caching: allows build machines to get source files and tools from internal servers, without the need for public internet access.

As part of our previous workflow, our build environment used MSBuild and relied on NuGet packages to manage tools and libraries. Each build component compiles libraries such as SQLite and applies its own preprocessor flags and build logic for integration. As a result, separate projects repeatedly build the same library sources instead of compiling them once and reusing them as a static library across the solution.

This approach presents several challenges: there is no unified solution for dependency management, each build configuration requires manual upkeep, and library usage is inconsistent across components.

Microsoft’s sandboxed build environment automates software compilation, packaging, and deployment in local and cloud environments. Projects build independently on isolated cloud machines, supporting continuous integration workflows and simplifying build tracking, diagnostics, and artifact distribution. The lack of internet access and Visual Studio in this sandboxed build environment presents additional challenges for acquiring and maintaining open-source native libraries.

Build Integration

After the prototype is successfully completed, the project was scaled up across the entire build environment.

To avoid high maintenance costs, the team generates custom vcpkg triplets during the build process. Custom triplets allow developers to define specific build configurations (e.g., platform, architecture, compiler settings) tailored to the project. This flexibility is essential for our heterogeneous build environments and helps ensure compatibility across legacy and modern components.

Triplet Generator Projects:

• Dynamically create custom vcpkg triplets during the build process.
• Eliminate the need for checked-in triplets, reducing maintenance overhead.
• Automatically configure toolset paths and compiler settings (PATH, INCLUDE, LIB).
• Ensure consistent library configurations and IntelliSense support across all projects.

Internal Asset Caching Tool:

• Securely retrieves Open-Source Software (OSS) dependencies from internal registries.
• Resolves challenges related to restricted or offline build environments.
• Ensures compliance and traceability for third-party libraries.

Library Integration:

• Libraries such as SQLite, libuv, and cereal are built in a consistent and reproducible way.
• Provides seamless integration with MSBuild.
• Minimizes manual configuration and improves build reliability.

Sandboxed Build Environment Integration

Challenges Addressed:

• Introduced dedicated build nodes to handle vcpkg installation tasks efficiently.
• Leveraged triplet generator projects to override and improve CloudBuild’s native vcpkg integration.
• Ensured libraries are built once and reliably reused across dependent projects, reducing redundant builds and improving consistency.

Conclusion

vcpkg has emerged as Microsoft’s preferred solution for C++ dependency management, with many teams using it to address their needs. By adopting vcpkg, we were able to drive increased productivity, security compliance and consistency across our engineering processes.

Interested in learning more? Check out the stories below for additional insights and experiences from teams adopting vcpkg in their workflows.

• Siemens Healthineers manages C++ libraries with vcpkg in an offline build environment
• Askia, an Ipsos company, achieved faster, reproducible builds with vcpkg

Author

Eve Silfanus is a Software Engineer on the Visual Studio C++ Cross Platform team.