ExternalProject: Respect TLS_VERIFY for git update step

Git config options can be passed to git clone before or after the
"clone" keyword. If specified before, the config setting is only
applied to that command invocation. It acts to override the value
in the global or project defaults (the latter doesn't exist for clone).
When the config setting is passed after the "clone" keyword, it is
saved into the cloned repository's config and will persist for later
git operations. The existing implementation expected the latter
behavior, but put the config setting before the "clone" keyword
and therefore the setting was not persisting to the git update
step. Move it to after the "clone" keyword so that it will persist.

The submodule handling is different. There is no support for
doing a "git submodule update" with a "sticky" config setting.
Instead, you have to pass the setting with all such calls. The
existing implementation was doing this for the clone step, but
not the git update step. Add the config setting there as well
so that submodules also effectively have the sslVerify setting
persist to the update step too.

Fixes: #18948

2 files changed, 6 insertions, 4 deletions

diff --git a/Modules/ExternalProject/gitclone.cmake.in b/Modules/ExternalProject/gitclone.cmake.in
index 3312171..94b329a 100644
--- a/Modules/ExternalProject/gitclone.cmake.in
+++ b/Modules/ExternalProject/gitclone.cmake.in
@@ -25,7 +25,7 @@ set(error_code 1)
 set(number_of_tries 0)
 while(error_code AND number_of_tries LESS 3)
   execute_process(
-    COMMAND "@git_EXECUTABLE@" @git_options@
+    COMMAND "@git_EXECUTABLE@"
             clone @git_clone_options@ "@git_repository@" "@src_name@"
     WORKING_DIRECTORY "@work_dir@"
     RESULT_VARIABLE error_code
@@ -40,7 +40,7 @@ if(error_code)
 endif()
 
 execute_process(
-  COMMAND "@git_EXECUTABLE@" @git_options@
+  COMMAND "@git_EXECUTABLE@"
           checkout "@git_tag@" @git_checkout_explicit--@
   WORKING_DIRECTORY "@work_dir@/@src_name@"
   RESULT_VARIABLE error_code
@@ -52,7 +52,7 @@ endif()
 set(init_submodules @init_submodules@)
 if(init_submodules)
   execute_process(
-    COMMAND "@git_EXECUTABLE@" @git_options@
+    COMMAND "@git_EXECUTABLE@" @git_submodules_config_options@
             submodule update @git_submodules_recurse@ --init @git_submodules@
     WORKING_DIRECTORY "@work_dir@/@src_name@"
     RESULT_VARIABLE error_code
diff --git a/Modules/ExternalProject/gitupdate.cmake.in b/Modules/ExternalProject/gitupdate.cmake.in
index eb3cda7..171aa7b 100644
--- a/Modules/ExternalProject/gitupdate.cmake.in
+++ b/Modules/ExternalProject/gitupdate.cmake.in
@@ -283,7 +283,9 @@ endif()
 set(init_submodules "@init_submodules@")
 if(init_submodules)
   execute_process(
-    COMMAND "@git_EXECUTABLE@" --git-dir=.git submodule update @git_submodules_recurse@ --init @git_submodules@
+    COMMAND "@git_EXECUTABLE@"
+            --git-dir=.git @git_submodules_config_options@
+            submodule update @git_submodules_recurse@ --init @git_submodules@
     WORKING_DIRECTORY "@work_dir@"
     COMMAND_ERROR_IS_FATAL ANY
   )