Any risk to use VCPKG as trusted static link solution for buliding Microsoft Product

[gaoyangxiaozhu]

Hey teams,

Security and compliance efforts are Microsoft wide. So we all know that when built product solution , microsoft always need make sure the dependency is coming from microsoft trusted sources / services.

since VCPKG is also a solution provided by Microsoft team, I want to discuss here for one question - we all know VCPKG always fetch source from respository pre-defined in each portfile.cmake which is not first party microsoft source repository, so it is possibile to use VCPKG as a static link solution for buliting microsft internal production, or it would break the microsoft security and compliance policy ?

in other worlds, does VCPKG can be treat a trusted sources for buiding microsft product or any risks ?