Implicit knowledge of listing all packages in a private registry. why?

[sdajklfw389]

I have a private registry like this tutorial says:

{
  "default-registry": {
    "kind": "git",
    "baseline": "7476f0d4e77d3333fbb249657df8251c28c4faae",
    "repository": "https://github.com/microsoft/vcpkg"
  },
  "registries": [
    {
      "kind": "git",
      "repository": "https://github.com/northwindtraders/vcpkg-registry",
      "baseline": "dacf4de488094a384ca2c202b923ccc097956e0c",
      "packages": [ "beicode", "beison" ]
    }
  ]
}

https://learn.microsoft.com/en-us/vcpkg/consume/git-registries

so assuming the registry has two packages: beicode and beison. And my project only need the dependency of beicode. So naturally, i only include beicode in the vpckg-configuration.json file. But then vcpkg complains baseline does not contain beison.

Then i know, i have to include ALL packages in vpckg-configuration.json which my private registry provides. But why design it this way?

firstly the document does not say excplicitly I need to list ALL packages.

secondly, if my private packages have 100 packages, then i need to list all 100 packages?

thirdly, the error message is also not telling what exactly the problem is.

[AugP]

The registries field from vcpkg-configuration.json is used to configure a registry of packages. This should list all the packages by name that end users may ever want to access for any projects they may have. A baseline is basically a list of all the package names that are available with a default version they will be installed at (unless a different version is requested in vcpkg.json). An analogy for this if you work at a company is that the registry contains all the libraries anyone at your company may ever want to install. Similarly, the curated registry vcpkg ships with contains thousands of open-source libraries. No one will ever install all of them (except for our CI system), but they are all available at a particular version by default. So, while a baseline lists all of the packages and their corresponding version, it isn't determining the subset of packages an individual user may want.

The vcpkg.json file lists dependencies for a particular project. Therefore, it is there where you would only specify beicode. You do not need to specify transitive dependencies (unless you want to modify how they are installed by default) or dependencies you do not need at all for your project.

When you are creating your own registry and also are working on a particular project with dependencies, you need to define both the full set of packages that should be available as well as the particular packages you want for your specific project.

[zcotman]

We just started using vcpk to manage dependencies where I work, and I ran into this same issue:

"error: the baseline does not contain an entry for port "

I don't mean to be rude, but this explanation for custom registry listing(s) in vcpkg-configuration.json seems wild to me.
The custom registry itself already defines "the full set of packages that should be available". All that is necessary to get the list is to go there and look at baseline.json. Why would another list of packages inside the registry setting be necessary?

It is really hard to imagine that the real purpose of the custom registry listing(s) in vcpkg-configuration.json is to do basically the exact same thing, but if it is really meant to list "the full set of packages that should be available", then I think my new default behavior will be to just list every package in our custom registry inside of every vcpkg-configuration.json attached to every project, and to automate updates to it, although I would love to know if this is not good to do for some reason.

Is there some reason there can't be just a list of multiple registries that should be searched to find packages? ("default-registries")? Or maybe preserve the info about what registries to find packages in through the dependency tree?

I am seriously interested in understanding the thoughts behind the current implementation. Is there some harm in checking the listed registries if an up-stream dependency can't be found in the default registry? Something to do with injection of malicious packages maybe?

Also, it might be helpful to remind people that packages can be specified for the custom registry using wildcards as discussed in the vcpkg-configuration.json documentation here.

Thanks.