Do I have to specify all dependencies in both the vcpkg.json file in the project repository AND in the port?

[ccpjosephf]

It's not clear from the documentation whether the vcpkg.json file in the port must specify all of a packages dependencies, as well as the vcpkg.json file in the top level of the package's actual code repository.

https://learn.microsoft.com/en-us/vcpkg/concepts/ports#vcpkgjson

Do we need to maintain information about all dependencies & versions in both places?

Example:

I have a private registry with package-b and package-a
package-b depends on package-a

package-b may be built both as a top level project, and as a dependency (through vcpkg) of another project

in package-b's code repository, I have this vcpkg.json file:

{
  "dependencies": [
    {
      "name": "package-a",
      "version>=": "1.0.0"
    }
  ]
}

In the port for package-b do I need to specify the dependency on package-a again?

{
  "name": "package-b",
  "version": "3.0.4",
  "description": "this is package b",
  "dependencies": [
    {
      "name": "package-a",
      "version>=": "1.0.0"
    },
  ]
}

Another question I have is about how this interacts with default and non-default registries.

Package-a depends on libuv from the official vcpkg registry. However package-a's port resides in a custom registry somewhere else on github. package-b uses this custom registry as it's default one.

Does package-b have to know that package-a wants to get libuv from the official vcpkg registry and list it in it's vcpkg-configuration.json file like this?

...
  "registries": [
    {
      "kind": "git",
      "repository": "https://github.com/microsoft/vcpkg.git",
      "packages": ["vcpkg-cmake", "vcpkg-cmake-config", "libuv"]
    }
  ]
....

Or will package-b use the vcpkg-configuration.json file from package-a's repository?
Is there any way of making it so that package-b can continue using the custom registry as default, without having to know about where it's dependecies' dependencies are from?

[ccpjosephf]

Answering my own question:
Part 1:

Do I have to specify all dependencies in both the vcpkg.json file in the project repository AND in the port?

Yes, as per this discussion: #33673

Part 2:

Is there any way of making it so that package-b can continue using the custom registry as default, without having to know about where it's dependecies' dependencies are from?

as per the vcpkg-configuration.json reference https://learn.microsoft.com/en-us/vcpkg/reference/vcpkg-configuration-json
Only the top-level project's vcpkg-configuration.json file is used, and any packages that are not specifically mentioned in registries and that that are not contained within the default regsitry will fail to resolve.

In this case, the better option would be to use the custom registry for specific packages, and the microsoft registry as the default one. Or add the ports we need from the main microsoft vcpkg registry to our custom one.