Tests: Add test for file(DOWNLOAD) with TLS_VERIFY

Occasionally curl updates introduce errors in https verification.
Add an explicit test for this capability, activated by an undocumented
option that we can use in CI to specify a URL to test.

Co-authored-by: Brad King <brad.king@kitware.com>
Fixes: #24405
Issue: #24147
Issue: #24398

Tests/RunCMake/CMakeLists.txt

@@ -469,7 +469,15 @@ add_RunCMake_test(ctest_fixtures)
 add_RunCMake_test(define_property)
 add_RunCMake_test(file -DCYGWIN=${CYGWIN} -DMSYS=${MSYS})
 add_RunCMake_test(file-CHMOD -DMSYS=${MSYS})
-add_RunCMake_test(file-DOWNLOAD -DCMake_TEST_NO_NETWORK=${CMake_TEST_NO_NETWORK})
+foreach(var
+    CMake_TEST_NO_NETWORK
+    CMake_TEST_TLS_VERIFY_URL
+    )
+  if(DEFINED ${var})
+    list(APPEND file-DOWNLOAD_ARGS -D${var}=${${var}})
+  endif()
+endforeach()
+add_RunCMake_test(file-DOWNLOAD)
 add_RunCMake_test(file-RPATH -DCMAKE_SYSTEM_NAME=${CMAKE_SYSTEM_NAME})
 add_RunCMake_test(find_file)
 add_RunCMake_test(find_library -DCYGWIN=${CYGWIN} -DMSYS=${MSYS})

Tests/RunCMake/file-DOWNLOAD/RunCMakeTest.cmake

@@ -24,3 +24,8 @@ run_cmake(SHOW_PROGRESS)
 if(NOT CMake_TEST_NO_NETWORK)
   run_cmake(bad-hostname)
 endif()
+
+if(CMake_TEST_TLS_VERIFY_URL)
+  run_cmake(TLS_VERIFY-bad)
+  run_cmake_with_options(TLS_VERIFY-good -Durl=${CMake_TEST_TLS_VERIFY_URL})
+endif()

Tests/RunCMake/file-DOWNLOAD/TLS_VERIFY-bad-stdout.txt

@@ -0,0 +1 @@
+-- (60;"SSL peer certificate or SSH remote key was not OK"|35;"SSL connect error")

Tests/RunCMake/file-DOWNLOAD/TLS_VERIFY-bad.cmake

@@ -0,0 +1,6 @@
+file(DOWNLOAD https://expired.badssl.com TLS_VERIFY 1 STATUS status LOG log)
+message(STATUS "${status}")
+list(GET status 0 code)
+if(NOT code MATCHES "^(35|60)$")
+  message("${log}")
+endif()

Tests/RunCMake/file-DOWNLOAD/TLS_VERIFY-good-stdout.txt

@@ -0,0 +1 @@
+-- 0;"No error"

Tests/RunCMake/file-DOWNLOAD/TLS_VERIFY-good.cmake

@@ -0,0 +1,6 @@
+file(DOWNLOAD ${url} TLS_VERIFY 1 STATUS status LOG log)
+message(STATUS "${status}")
+list(GET status 0 code)
+if(NOT code EQUAL 0)
+  message("${log}")
+endif()