diff --git a/scripts/build_info.cmake b/scripts/build_info.cmake
index e86570aaa4..46e9cb36a1 100644
--- a/scripts/build_info.cmake
+++ b/scripts/build_info.cmake
@@ -89,4 +89,11 @@ if (DEFINED VCPKG_HEAD_VERSION)
     string(APPEND "Z_BUILD_INFO_FILE_CONTENTS" "Version: ${VCPKG_HEAD_VERSION}\n")
 endif()
 
+get_property(Z_VCPKG_SPDX_OBJECTS GLOBAL PROPERTY Z_VCPKG_SPDX_OBJECTS)
+if(Z_VCPKG_SPDX_OBJECTS)
+    string(JOIN ",\n" Z_VCPKG_SPDX_PACKAGES ${Z_VCPKG_SPDX_OBJECTS})
+    file(WRITE "${CURRENT_PACKAGES_DIR}/share/${PORT}/vcpkg-spdx-resources.json"
+        "{\n  \"packages\": [\n${Z_VCPKG_SPDX_PACKAGES}\n  ]\n}\n")
+endif()
+
 file(WRITE "${CURRENT_PACKAGES_DIR}/BUILD_INFO" "${Z_BUILD_INFO_FILE_CONTENTS}")
diff --git a/scripts/cmake/vcpkg_acquire_msys.cmake b/scripts/cmake/vcpkg_acquire_msys.cmake
index c7c2d39c52..3bcfd50422 100644
--- a/scripts/cmake/vcpkg_acquire_msys.cmake
+++ b/scripts/cmake/vcpkg_acquire_msys.cmake
@@ -22,11 +22,10 @@ function(z_vcpkg_acquire_msys_download_package out_archive)
         list(APPEND all_urls "${mirror_url}")
     endforeach()
 
-    vcpkg_download_distfile(msys_archive
+    z_vcpkg_download_distfile(msys_archive
         URLS ${all_urls}
         SHA512 "${arg_SHA512}"
         FILENAME "${arg_FILENAME}"
-        QUIET
     )
     set("${out_archive}" "${msys_archive}" PARENT_SCOPE)
 endfunction()
diff --git a/scripts/cmake/vcpkg_download_distfile.cmake b/scripts/cmake/vcpkg_download_distfile.cmake
index 1466ea6cef..fa6a11afa3 100644
--- a/scripts/cmake/vcpkg_download_distfile.cmake
+++ b/scripts/cmake/vcpkg_download_distfile.cmake
@@ -1,20 +1,18 @@
-function(vcpkg_download_distfile out_var)
+function(z_vcpkg_download_distfile out_var)
     cmake_parse_arguments(PARSE_ARGV 1 arg
         "SKIP_SHA512;SILENT_EXIT;QUIET;ALWAYS_REDOWNLOAD"
         "FILENAME;SHA512"
         "URLS;HEADERS"
     )
 
+    # SILENT_EXIT and QUIET are meaningless but accepting and ignoring them allows
+    # vcpkg_download_distfile to pass through parameters without needing manipulation.
     if(NOT DEFINED arg_URLS)
         message(FATAL_ERROR "vcpkg_download_distfile requires a URLS argument.")
     endif()
     if(NOT DEFINED arg_FILENAME)
         message(FATAL_ERROR "vcpkg_download_distfile requires a FILENAME argument.")
     endif()
-    if(arg_SILENT_EXIT)
-        message(WARNING "SILENT_EXIT no longer has any effect. To resolve this warning, remove SILENT_EXIT.")
-    endif()
-
     # Note that arg_ALWAYS_REDOWNLOAD implies arg_SKIP_SHA512, and NOT arg_SKIP_SHA512 implies NOT arg_ALWAYS_REDOWNLOAD
     if(arg_ALWAYS_REDOWNLOAD AND NOT arg_SKIP_SHA512)
         message(FATAL_ERROR "ALWAYS_REDOWNLOAD requires SKIP_SHA512")
@@ -138,3 +136,29 @@ If you do not know the SHA512, add it as 'SHA512 0' and retry.")
 
     set("${out_var}" "${downloaded_file_path}" PARENT_SCOPE)
 endfunction()
+
+function(vcpkg_download_distfile out_var)
+    cmake_parse_arguments(PARSE_ARGV 1 arg
+        "SKIP_SHA512;SILENT_EXIT;QUIET;ALWAYS_REDOWNLOAD"
+        "FILENAME;SHA512"
+        "URLS;HEADERS"
+    )
+    if(DEFINED arg_UNPARSED_ARGUMENTS)
+        message(FATAL_ERROR "vcpkg_download_distfile was passed extra arguments: ${arg_UNPARSED_ARGUMENTS}")
+    endif()
+    if(arg_SILENT_EXIT)
+        message(WARNING "SILENT_EXIT no longer has any effect. To resolve this warning, remove SILENT_EXIT.")
+    endif()
+
+    z_vcpkg_function_arguments(forwarded_args 1)
+    z_vcpkg_download_distfile("${out_var}" ${forwarded_args})
+    set("${out_var}" "${${out_var}}" PARENT_SCOPE)
+
+    list(GET arg_URLS 0 spdx_download_location)
+    z_vcpkg_add_spdx_resource(
+        NAME "${arg_FILENAME}"
+        FILENAME "${arg_FILENAME}"
+        DOWNLOAD_LOCATION "${spdx_download_location}"
+        SHA512 "${arg_SHA512}"
+    )
+endfunction()
diff --git a/scripts/cmake/vcpkg_download_sourceforge.cmake b/scripts/cmake/vcpkg_download_sourceforge.cmake
index a8c1f1f259..9cb6831fd4 100644
--- a/scripts/cmake/vcpkg_download_sourceforge.cmake
+++ b/scripts/cmake/vcpkg_download_sourceforge.cmake
@@ -27,13 +27,13 @@ function(vcpkg_download_sourceforge out_var)
     - an organization name without any slashes, or
     - an organization name followed by a repository name separated by a single slash")
     endif()
-    
+
     if(NOT "${arg_REF}" STREQUAL "")
         set(url "${sourceforge_host}/${org_name}/files/${repo_name}/${arg_REF}/${arg_FILENAME}")
     else()
         set(url "${sourceforge_host}/${arg_REPO}/files/${arg_FILENAME}")
     endif()
-        
+
     string(SUBSTRING "${arg_SHA512}" 0 10 sanitized_ref)
 
     set(sourceforge_mirrors
@@ -72,8 +72,8 @@ function(vcpkg_download_sourceforge out_var)
     foreach(mirror IN LISTS sourceforge_mirrors)
         list(APPEND all_urls "${url}/download?use_mirror=${mirror}")
     endforeach()
-    
-    vcpkg_download_distfile(archive
+
+    z_vcpkg_download_distfile(archive
         URLS ${all_urls}
         SHA512 "${arg_SHA512}"
         FILENAME "${arg_FILENAME}"
diff --git a/scripts/cmake/vcpkg_find_acquire_program.cmake b/scripts/cmake/vcpkg_find_acquire_program.cmake
index b8fe4002a4..0545a4a701 100644
--- a/scripts/cmake/vcpkg_find_acquire_program.cmake
+++ b/scripts/cmake/vcpkg_find_acquire_program.cmake
@@ -190,6 +190,7 @@ function(vcpkg_find_acquire_program program)
             VERSION_COMMAND ${version_command}
         )
     endif()
+
     if(NOT ${program})
         if("${download_urls}" STREQUAL "" AND "${sourceforge_args}" STREQUAL "")
             set(example ".")
@@ -202,7 +203,7 @@ function(vcpkg_find_acquire_program program)
         endif()
 
         if("${sourceforge_args}" STREQUAL "")
-            vcpkg_download_distfile(archive_path
+            z_vcpkg_download_distfile(archive_path
                 URLS ${download_urls}
                 SHA512 "${download_sha512}"
                 FILENAME "${download_filename}"
diff --git a/scripts/cmake/vcpkg_from_bitbucket.cmake b/scripts/cmake/vcpkg_from_bitbucket.cmake
index 2cd9c998a8..edb502e753 100644
--- a/scripts/cmake/vcpkg_from_bitbucket.cmake
+++ b/scripts/cmake/vcpkg_from_bitbucket.cmake
@@ -57,7 +57,7 @@ function(vcpkg_from_bitbucket)
 
     # exports VCPKG_HEAD_VERSION to the caller. This will get picked up by ports.cmake after the build.
     if(VCPKG_USE_HEAD_VERSION)
-        vcpkg_download_distfile(archive_version
+        z_vcpkg_download_distfile(archive_version
             URLS "https://api.bitbucket.com/2.0/repositories/${org_name}/${repo_name}/refs/branches/${arg_HEAD_REF}"
             FILENAME "${downloaded_file_name}.version"
             SKIP_SHA512
@@ -76,7 +76,7 @@ ${version_contents}
     endif()
 
     # download the file information from bitbucket.
-    vcpkg_download_distfile(archive
+    z_vcpkg_download_distfile(archive
         URLS "https://bitbucket.com/${org_name}/${repo_name}/get/${ref_to_use}.tar.gz"
         FILENAME "${downloaded_file_name}"
         ${sha512_param}
@@ -89,5 +89,10 @@ ${version_contents}
         PATCHES ${arg_PATCHES}
         ${working_directory_param}
     )
+    z_vcpkg_add_spdx_resource(
+        NAME "${arg_REPO}"
+        DOWNLOAD_LOCATION "git+https://bitbucket.com/${arg_REPO}@${ref_to_use}"
+        SHA512 "${arg_SHA512}"
+    )
     set("${arg_OUT_SOURCE_PATH}" "${SOURCE_PATH}" PARENT_SCOPE)
 endfunction()
diff --git a/scripts/cmake/vcpkg_from_git.cmake b/scripts/cmake/vcpkg_from_git.cmake
index ca2d593094..318de4e5e1 100644
--- a/scripts/cmake/vcpkg_from_git.cmake
+++ b/scripts/cmake/vcpkg_from_git.cmake
@@ -185,5 +185,14 @@ SHA is in the history. For example, you may be able to fix this error by changin
         ${skip_patch_check_param}
     )
 
+    if(VCPKG_USE_HEAD_VERSION AND DEFINED arg_HEAD_REF)
+        set(spdx_ref "${rev_parse_ref}")
+    else()
+        set(spdx_ref "${arg_REF}")
+    endif()
+    z_vcpkg_add_spdx_resource(
+        NAME "${arg_URL}"
+        DOWNLOAD_LOCATION "git+${arg_URL}@${spdx_ref}"
+    )
     set("${arg_OUT_SOURCE_PATH}" "${SOURCE_PATH}" PARENT_SCOPE)
 endfunction()
diff --git a/scripts/cmake/vcpkg_from_github.cmake b/scripts/cmake/vcpkg_from_github.cmake
index 5e5c2c1b06..f1210cd8d4 100644
--- a/scripts/cmake/vcpkg_from_github.cmake
+++ b/scripts/cmake/vcpkg_from_github.cmake
@@ -57,7 +57,7 @@ function(vcpkg_from_github)
     # exports VCPKG_HEAD_VERSION to the caller. This will get picked up by ports.cmake after the build.
     if(VCPKG_USE_HEAD_VERSION)
         string(REPLACE "/" "_-" sanitized_head_ref "${arg_HEAD_REF}")
-        vcpkg_download_distfile(archive_version
+        z_vcpkg_download_distfile(archive_version
             URLS "${github_api_url}/repos/${org_name}/${repo_name}/git/refs/heads/${arg_HEAD_REF}"
             FILENAME "${org_name}-${repo_name}-${sanitized_head_ref}.version"
             ${headers_param}
@@ -117,7 +117,7 @@ Error was: ${head_version_err}
     endif()
 
     # Try to download the file information from github
-    vcpkg_download_distfile(archive
+    z_vcpkg_download_distfile(archive
         URLS "${download_url}"
         FILENAME "${downloaded_file_name}"
         ${headers_param}
@@ -132,5 +132,10 @@ Error was: ${head_version_err}
         ${working_directory_param}
         ${skip_patch_check_param}
     )
+    z_vcpkg_add_spdx_resource(
+        NAME "${arg_REPO}"
+        DOWNLOAD_LOCATION "git+${github_host}/${arg_REPO}@${ref_to_use}"
+        SHA512 "${arg_SHA512}"
+    )
     set("${arg_OUT_SOURCE_PATH}" "${SOURCE_PATH}" PARENT_SCOPE)
 endfunction()
diff --git a/scripts/cmake/vcpkg_from_gitlab.cmake b/scripts/cmake/vcpkg_from_gitlab.cmake
index 93e8e60bdf..9c01bbffb2 100644
--- a/scripts/cmake/vcpkg_from_gitlab.cmake
+++ b/scripts/cmake/vcpkg_from_gitlab.cmake
@@ -1,5 +1,3 @@
-include(vcpkg_execute_in_download_mode)
-
 function(z_uri_encode input output_variable)
     string(HEX "${input}" hex)
     string(LENGTH "${hex}" length)
@@ -94,7 +92,7 @@ function(vcpkg_from_gitlab)
     if(VCPKG_USE_HEAD_VERSION AND NOT DEFINED VCPKG_HEAD_VERSION)
         z_uri_encode("${arg_REPO}" encoded_repo_path)
         set(version_url "${arg_GITLAB_URL}/api/v4/projects/${encoded_repo_path}/repository/branches/${arg_HEAD_REF}")
-        vcpkg_download_distfile(archive_version
+        z_vcpkg_download_distfile(archive_version
             URLS "${version_url}"
             FILENAME "${downloaded_file_name}.version"
             ${headers_param}
@@ -110,7 +108,7 @@ function(vcpkg_from_gitlab)
     endif()
 
     # download the file information from gitlab
-    vcpkg_download_distfile(archive
+    z_vcpkg_download_distfile(archive
         URLS "${gitlab_link}/-/archive/${ref_to_use}/${repo_name}-${ref_to_use}.tar.gz"
         FILENAME "${downloaded_file_name}"
         ${headers_param}
@@ -124,5 +122,10 @@ function(vcpkg_from_gitlab)
         PATCHES ${arg_PATCHES}
         ${working_directory_param}
     )
+    z_vcpkg_add_spdx_resource(
+        NAME "${arg_REPO}"
+        DOWNLOAD_LOCATION "git+${arg_GITLAB_URL}/${arg_REPO}@${ref_to_use}"
+        SHA512 "${arg_SHA512}"
+    )
     set("${arg_OUT_SOURCE_PATH}" "${SOURCE_PATH}" PARENT_SCOPE)
 endfunction()
diff --git a/scripts/cmake/vcpkg_from_sourceforge.cmake b/scripts/cmake/vcpkg_from_sourceforge.cmake
index 19772c3050..477298a173 100644
--- a/scripts/cmake/vcpkg_from_sourceforge.cmake
+++ b/scripts/cmake/vcpkg_from_sourceforge.cmake
@@ -42,5 +42,11 @@ function(vcpkg_from_sourceforge)
         PATCHES ${arg_PATCHES}
     )
 
+    z_vcpkg_add_spdx_resource(
+        NAME "${arg_FILENAME}"
+        FILENAME "${arg_FILENAME}"
+        DOWNLOAD_LOCATION "https://sourceforge.net/projects/${arg_REPO}/files/${arg_REF}/${arg_FILENAME}"
+        SHA512 "${arg_SHA512}"
+    )
     set("${arg_OUT_SOURCE_PATH}" "${SOURCE_PATH}" PARENT_SCOPE)
 endfunction()
diff --git a/scripts/cmake/z_vcpkg_spdx.cmake b/scripts/cmake/z_vcpkg_spdx.cmake
new file mode 100644
index 0000000000..60e9e0e919
--- /dev/null
+++ b/scripts/cmake/z_vcpkg_spdx.cmake
@@ -0,0 +1,37 @@
+function(z_vcpkg_add_spdx_resource)
+    cmake_parse_arguments(PARSE_ARGV 0 "arg"
+        ""
+        "NAME;DOWNLOAD_LOCATION;SHA512;FILENAME"
+        "")
+    if(DEFINED arg_UNPARSED_ARGUMENTS)
+        message(FATAL_ERROR "z_vcpkg_add_spdx_resource was passed extra arguments: ${arg_UNPARSED_ARGUMENTS}")
+    endif()
+
+    get_property(Z_VCPKG_SPDX_OBJECTS GLOBAL PROPERTY Z_VCPKG_SPDX_OBJECTS)
+    list(LENGTH Z_VCPKG_SPDX_OBJECTS resource_index)
+    set(resource "{}")
+
+    string(JSON resource SET "${resource}" "SPDXID" "\"SPDXRef-resource-${resource_index}\"")
+    string(JSON value STRING_ENCODE "${arg_NAME}")
+    string(JSON resource SET "${resource}" "name" "${value}")
+    if(DEFINED arg_FILENAME)
+        string(JSON value STRING_ENCODE "${arg_FILENAME}")
+        string(JSON resource SET "${resource}" "packageFileName" "${value}")
+    endif()
+    string(JSON value STRING_ENCODE "${arg_DOWNLOAD_LOCATION}")
+    string(JSON resource SET "${resource}" "downloadLocation" "${value}")
+    foreach(property IN ITEMS licenseConcluded licenseDeclared copyrightText)
+        string(JSON resource SET "${resource}" "${property}" [["NOASSERTION"]])
+    endforeach()
+
+    if(DEFINED arg_SHA512 AND NOT "${arg_SHA512}" STREQUAL "")
+        string(TOLOWER "${arg_SHA512}" sha512)
+        string(JSON checksum SET "{}" "algorithm" [["SHA512"]])
+        string(JSON checksum SET "${checksum}" "checksumValue" "\"${sha512}\"")
+        string(JSON checksums SET "[]" 0 "${checksum}")
+        string(JSON resource SET "${resource}" "checksums" "${checksums}")
+    endif()
+
+    vcpkg_list(APPEND Z_VCPKG_SPDX_OBJECTS "${resource}")
+    set_property(GLOBAL PROPERTY Z_VCPKG_SPDX_OBJECTS "${Z_VCPKG_SPDX_OBJECTS}")
+endfunction()
diff --git a/scripts/ports.cmake b/scripts/ports.cmake
index 87db34d00f..244769fb40 100644
--- a/scripts/ports.cmake
+++ b/scripts/ports.cmake
@@ -34,6 +34,9 @@ list(APPEND CMAKE_MODULE_PATH "${SCRIPTS}/cmake")
 # Increment this number if we intentionally need to invalidate all binary caches due a change in
 # the following scripts: 1
 include("${SCRIPTS}/cmake/execute_process.cmake")
+include("${SCRIPTS}/cmake/vcpkg_execute_in_download_mode.cmake")
+include("${SCRIPTS}/cmake/z_vcpkg_spdx.cmake")
+
 include("${SCRIPTS}/cmake/vcpkg_acquire_msys.cmake")
 include("${SCRIPTS}/cmake/vcpkg_add_to_path.cmake")
 include("${SCRIPTS}/cmake/vcpkg_apply_patches.cmake")