I am developing a package, say, TOOL with dependency package DEPY. In TOOL's CMakeLists.txt I may call find_package(DEPY) and may obtain that DEPY_FOUND is true. Then I may (depending on other things) declare via a variable, say, TOOL_HAVE_DEPY that I actually rely on DEPY and start using it, e.g., by adding targets from DEPY to those of TOOL.

I also create a tool-config.cmake file and came up with the following code to (only) search for DEPY if TOOL_HAVE_DEPY is true, and declare TOOL to not be found if that fails.

set(TOOL_FOUND 1) # Initially we declare TOOL to be found.

if(@TOOL_HAVE_DEPY@) # Disable this block in case configuration of TOOL did not find DEPY.
   if(NOT DEPY_FOUND) # No need to do anything in case DEPY was already found.
      find_dependency(DEPY) # Find DEPY.
      if(NOT DEPY_FOUND) # If that failed.
         if(NOT TOOL_FIND_QUIETLY)
            message(WARNING "DEPY was not found, but is required for TOOL.")
         endif()
         set(TOOL_FOUND 0) # TOOL was built with DEPY but when finding it, DEPY was not found.
      endif()
   endif()
endif()

Now it may happen that the configuration of TOOL only found DEPY because of some settings such as setting a DEPY_DIR (environment) variable or build parameter. To support that I could add

if(NOT DEPY_DIR)
   set(DEPY_DIR @DEPY_DIR@)
endif()

just before the find_dependency call. However, this only works if DEPY_DIR was really the reason for finding DEPY, and it also sets the DEPY_DIR variable, which may have side-effect that I cannot foresee right now.

My questions are:

1. Is there a better way to ensure that dependencies are found?
2. Is there a standardized / recommended way for how a depy-config.cmake or FindDEPY.cmake would provide information that is necessary to again find exactly the same configuration? I imagine something like declaring DEPY_FOUND_DIR that is set to a directory such that setting DEPY_DIR to that directory makes sure to find exactly the same configuration again?

In fact I would even add version information to the find_dependency call. Otherwise, if two versions of DEPY are lying around, TOOL is built with one, then it can cause trouble if someone using TOOL searchers for DEPY and finds the other version.