Environment variable <PackageName>_ROOT ignored with a cmake minimum required 3.22

Code
,
1

Hello, I recently faced a curious situation.

My project has the following structure: my CMakeLists.txt starts with a cmake_minimum_required(VERSION 3.22) then calls find_package(Foo REQUIRED). The file FooConfig.cmake calls find_dependency(Bar) then find_dependency(Baz). My environment contains the variables Foo_ROOT, Bar_ROOT and Baz_ROOT.

The configuration stopped because cmake could not find Baz. During the configuration it displayed the warning “Policy CMP0074 is not set: find_package uses _ROOT variables.”.

I found it surprising as the minimum required that I asked should have defined the policy CMP0074 to NEW.

I noticed that the file BarConfig.cmake was calling cmake_minimum_required(VERSION 3.8) then include(CMakeFindDependencyMacro). My understanding is that the macro find_dependency was redefined capturing a policy CMP0074 unset due to the new minimum required 3.8. Back in the file FooConfig.cmake, the find_dependency(Baz) command called find_package in a scope where the policy CMP0074 was then unset thus ignoring the Baz_ROOT variable.

Can you confirm that it makes sense ?

Side effects of cmake_minimum_required in dependency provider
2

Leaving this here since it has been referenced by another discussion.

When CMake generates files with install(EXPORT), it uses this pattern:

cmake_policy(PUSH)
cmake_policy(VERSION 2.8.3...4.0)

# ...things from the export set appear here

cmake_policy(POP)

The minimum and maximum values in the cmake_policy(VERSION) command are updated from time-to-time in CMake releases, especially the maximum of that version range. Projects would do well to follow a similar pattern in their own packageName-config.cmake files. This does, however, mean packages need to not fall too far behind the latest CMake release, otherwise they risk generating deprecation or policy warnings whenever their package is used by consumers.

For the scenario described in this thread, it sounds like the package being consumed may have done this, or at least has called cmake_policy(...) or cmake_minimum_version(), but it apears to have specified an older CMake version (it would have to be 3.11 or older to generate a warning for CMP0074). Most likely, it just specifies a single version rather than a version range (version ranges only became a thing with CMake 3.12).

Your options here would be limited. Updating to a newer version of the offending package would be the simplest and recommended solution if newer package versions addressed this problem. If that isn’t possible or newer packages still have the issue, you could potentially try using the CMAKE_POLICY_DEFAULT_CMP0074 variable to override the dependency’s policy settings, but that’s not ideal.