How to create a tarball with all the sources from FetchContents?

Over the course of a few months since we started a project we realized that FetchContents has beaten us a number of times when upstream projects that we depend on rewrote git history, added a few commits on top of their main branch (and we used GIT_SHALLOW ON, so FetchContents wasn’t able to find anything), …

I would like to be able to create a “self-contained fat tarball” that would pre-fetch all dependencies and pack them together with our source code into a tarball that could be compiled any time in the future, independent of whether or not the upstream sources still exist at their original location.

When using git sumbodules that can easily be achieved by recursively fetching all the submodules, but it seems somewhat more tricky to achieve the same with FetchContents.

GIT_SHALLOW is incompatible with commit hashes. I would recommend forking and adding tags.

What we do is upload tarballs to our own infrastructure and fetch those instead. Much more reliable over time and allows for offline builds (by prefetching all network resources).

That said, maybe others have better experience to share about FetchContent in particular.