FetchContent: Pass through networking-related CMAKE_... variables

CMAKE_TLS_VERIFY, CMAKE_TLS_CAINFO, CMAKE_NETRC and
CMAKE_NETRC_FILE are now passed through to the underlying
ExternalProject sub-build. Previously, they were silently ignored.

Fixes: #22144

8 files changed, 88 insertions, 19 deletions

diff --git a/Help/release/dev/fetchcontent-CMAKE-vars-passthrough.rst b/Help/release/dev/fetchcontent-CMAKE-vars-passthrough.rst
new file mode 100644
index 0000000000..842c016a0b
--- /dev/null
+++ b/Help/release/dev/fetchcontent-CMAKE-vars-passthrough.rst
@@ -0,0 +1,8 @@
+fetchcontent-CMAKE-vars-passthrough.rst
+---------------------------------------
+
+* The :module:`FetchContent` module now passes through the
+  :variable:`CMAKE_TLS_VERIFY`, :variable:`CMAKE_TLS_CAINFO`,
+  :variable:`CMAKE_NETRC` and :variable:`CMAKE_NETRC_FILE` variables (when
+  defined) to the underlying :module:`ExternalProject` sub-build.
+  Previously, those variables were silently ignored by :module:`FetchContent`.
diff --git a/Help/variable/CMAKE_NETRC.rst b/Help/variable/CMAKE_NETRC.rst
index 2c64a81495..bddfca555d 100644
--- a/Help/variable/CMAKE_NETRC.rst
+++ b/Help/variable/CMAKE_NETRC.rst
@@ -3,9 +3,11 @@ CMAKE_NETRC
 
 .. versionadded:: 3.11
 
-This variable is used to initialize the ``NETRC`` option for
-:command:`file(DOWNLOAD)` and :command:`file(UPLOAD)` commands and the
-module :module:`ExternalProject`. See those commands for additional
-information.
+This variable is used to initialize the ``NETRC`` option for the
+:command:`file(DOWNLOAD)` and :command:`file(UPLOAD)` commands.
+See those commands for additional information.
+
+This variable is also used by the :module:`ExternalProject` and
+:module:`FetchContent` modules for internal calls to :command:`file(DOWNLOAD)`.
 
 The local option takes precedence over this variable.
diff --git a/Help/variable/CMAKE_NETRC_FILE.rst b/Help/variable/CMAKE_NETRC_FILE.rst
index 97a645efea..af98170b96 100644
--- a/Help/variable/CMAKE_NETRC_FILE.rst
+++ b/Help/variable/CMAKE_NETRC_FILE.rst
@@ -3,9 +3,11 @@ CMAKE_NETRC_FILE
 
 .. versionadded:: 3.11
 
-This variable is used to initialize the ``NETRC_FILE`` option for
-:command:`file(DOWNLOAD)` and :command:`file(UPLOAD)` commands and the
-module :module:`ExternalProject`. See those commands for additional
-information.
+This variable is used to initialize the ``NETRC_FILE`` option for the
+:command:`file(DOWNLOAD)` and :command:`file(UPLOAD)` commands.
+See those commands for additional information.
+
+This variable is also used by the :module:`ExternalProject` and
+:module:`FetchContent` modules for internal calls to :command:`file(DOWNLOAD)`.
 
 The local option takes precedence over this variable.
diff --git a/Help/variable/CMAKE_TLS_CAINFO.rst b/Help/variable/CMAKE_TLS_CAINFO.rst
index fe3433527b..07f63660db 100644
--- a/Help/variable/CMAKE_TLS_CAINFO.rst
+++ b/Help/variable/CMAKE_TLS_CAINFO.rst
@@ -5,5 +5,5 @@ Specify the default value for the :command:`file(DOWNLOAD)` and
 :command:`file(UPLOAD)` commands' ``TLS_CAINFO`` options.
 It is unset by default.
 
-This variable is also used by the :module:`ExternalProject` module
-for internal calls to :command:`file(DOWNLOAD)`.
+This variable is also used by the :module:`ExternalProject` and
+:module:`FetchContent` modules for internal calls to :command:`file(DOWNLOAD)`.
diff --git a/Help/variable/CMAKE_TLS_VERIFY.rst b/Help/variable/CMAKE_TLS_VERIFY.rst
index 24f8a256a0..b22f1cefc6 100644
--- a/Help/variable/CMAKE_TLS_VERIFY.rst
+++ b/Help/variable/CMAKE_TLS_VERIFY.rst
@@ -5,8 +5,8 @@ Specify the default value for the :command:`file(DOWNLOAD)` and
 :command:`file(UPLOAD)` commands' ``TLS_VERIFY`` options.
 If not set, the default is *off*.
 
-This setting is also used by the :module:`ExternalProject` module
-for internal calls to :command:`file(DOWNLOAD)`.
+This variable is also used by the :module:`ExternalProject` and
+:module:`FetchContent` modules for internal calls to :command:`file(DOWNLOAD)`.
 
 TLS verification can help provide confidence that one is connecting
 to the desired server.  When downloading known content, one should
diff --git a/Modules/FetchContent.cmake b/Modules/FetchContent.cmake
index 5ea8b2a92c..be75689b0a 100644
--- a/Modules/FetchContent.cmake
+++ b/Modules/FetchContent.cmake
@@ -162,6 +162,13 @@ Commands
     This may be needed for things like password prompts or real-time display
     of command progress.
 
+  .. versionadded:: 3.22
+    The :variable:`CMAKE_TLS_VERIFY`, :variable:`CMAKE_TLS_CAINFO`,
+    :variable:`CMAKE_NETRC` and :variable:`CMAKE_NETRC_FILE` variables now
+    provide the defaults for their corresponding content options, just like
+    they do for :command:`ExternalProject_Add`. Previously, these variables
+    were ignored by the ``FetchContent`` module.
+
 .. command:: FetchContent_MakeAvailable
 
   .. versionadded:: 3.14
@@ -1016,18 +1023,29 @@ ExternalProject_Add_Step(${contentName}-populate copyfile
     unset(subCMakeOpts)
   endif()
 
-  if(DEFINED CMAKE_EP_GIT_REMOTE_UPDATE_STRATEGY)
-    list(APPEND subCMakeOpts
-      "-DCMAKE_EP_GIT_REMOTE_UPDATE_STRATEGY=${CMAKE_EP_GIT_REMOTE_UPDATE_STRATEGY}")
-  endif()
+  set(__FETCHCONTENT_CACHED_INFO "")
+  set(__passthrough_vars
+    CMAKE_EP_GIT_REMOTE_UPDATE_STRATEGY
+    CMAKE_TLS_VERIFY
+    CMAKE_TLS_CAINFO
+    CMAKE_NETRC
+    CMAKE_NETRC_FILE
+  )
+  foreach(var IN LISTS __passthrough_vars)
+    if(DEFINED ${var})
+      # Embed directly in the generated CMakeLists.txt file to avoid making
+      # the cmake command line excessively long. It also makes debugging and
+      # testing easier.
+      string(APPEND __FETCHCONTENT_CACHED_INFO "set(${var} [==[${${var}}]==])\n")
+    endif()
+  endforeach()
 
   # Avoid using if(... IN_LIST ...) so we don't have to alter policy settings
-  set(__FETCHCONTENT_CACHED_INFO "")
   list(FIND ARG_UNPARSED_ARGUMENTS GIT_REPOSITORY indexResult)
   if(indexResult GREATER_EQUAL 0)
     find_package(Git QUIET)
-    set(__FETCHCONTENT_CACHED_INFO
-"# Pass through things we've already detected in the main project to avoid
+    string(APPEND __FETCHCONTENT_CACHED_INFO "
+# Pass through things we've already detected in the main project to avoid
 # paying the cost of redetecting them again in ExternalProject_Add()
 set(GIT_EXECUTABLE [==[${GIT_EXECUTABLE}]==])
 set(GIT_VERSION_STRING [==[${GIT_VERSION_STRING}]==])
diff --git a/Tests/RunCMake/FetchContent/RunCMakeTest.cmake b/Tests/RunCMake/FetchContent/RunCMakeTest.cmake
index 9baeab75e2..e83c45e703 100644
--- a/Tests/RunCMake/FetchContent/RunCMakeTest.cmake
+++ b/Tests/RunCMake/FetchContent/RunCMakeTest.cmake
@@ -9,6 +9,7 @@ run_cmake(DownloadTwice)
 run_cmake(DownloadFile)
 run_cmake(SameGenerator)
 run_cmake(VarDefinitions)
+run_cmake(VarPassthroughs)
 run_cmake(GetProperties)
 run_cmake(UsesTerminalOverride)
 run_cmake(MakeAvailable)
diff --git a/Tests/RunCMake/FetchContent/VarPassthroughs.cmake b/Tests/RunCMake/FetchContent/VarPassthroughs.cmake
new file mode 100644
index 0000000000..ad743d890c
--- /dev/null
+++ b/Tests/RunCMake/FetchContent/VarPassthroughs.cmake
@@ -0,0 +1,38 @@
+include(FetchContent)
+
+set(CMAKE_EP_GIT_REMOTE_UPDATE_STRATEGY AAAA)
+set(CMAKE_TLS_VERIFY BBBB)
+set(CMAKE_TLS_CAINFO CCCC)
+set(CMAKE_NETRC DDDD)
+set(CMAKE_NETRC_FILE EEEE)
+
+FetchContent_Declare(PassThrough
+  DOWNLOAD_COMMAND ${CMAKE_COMMAND} -E echo "Download command executed"
+)
+FetchContent_Populate(PassThrough)
+
+set(gen_file ${FETCHCONTENT_BASE_DIR}/passthrough-subbuild/CMakeLists.txt)
+if(NOT EXISTS ${gen_file})
+  message(FATAL_ERROR "File does not exist: ${gen_file}")
+endif()
+file(READ ${gen_file} contents)
+
+if(NOT contents MATCHES "CMAKE_EP_GIT_REMOTE_UPDATE_STRATEGY \\[==\\[AAAA\\]==\\]")
+  message(FATAL_ERROR "Missing CMAKE_EP_GIT_REMOTE_UPDATE_STRATEGY")
+endif()
+
+if(NOT contents MATCHES "CMAKE_TLS_VERIFY \\[==\\[BBBB\\]==\\]")
+  message(FATAL_ERROR "Missing CMAKE_TLS_VERIFY")
+endif()
+
+if(NOT contents MATCHES "CMAKE_TLS_CAINFO \\[==\\[CCCC\\]==\\]")
+  message(FATAL_ERROR "Missing CMAKE_TLS_CAINFO")
+endif()
+
+if(NOT contents MATCHES "CMAKE_NETRC \\[==\\[DDDD\\]==\\]")
+  message(FATAL_ERROR "Missing CMAKE_NETRC")
+endif()
+
+if(NOT contents MATCHES "CMAKE_NETRC_FILE \\[==\\[EEEE\\]==\\]")
+  message(FATAL_ERROR "Missing CMAKE_NETRC_FILE")
+endif()