The ExternalProject approach causes so many problems especially for downstream packaging because it is harder to override with manually extracted sources. For reference with FetchContent there's FETCHCONTENT_SOURCE_DIR_<PKG_NAME> which can be used to override the download procedure and for downstream packagers we can then apply patches on top of the extracted source.