hunter_protected_sources doesn't seem to be working with custom packages

[gdalex]

I have a custom package that is defined in cmake/Hunter/config.cmake. Its source code points to a git repo that requires HTTP authentication.

I've defined the user and password ~/.config/Hunter/passwords.cmake. When Hunter tries to download the source code, I see that HUNTER_PACKAGE_PROTECTED_SOURCES is not being set, even though I've specified that this package has protected sources by calling hunter_protected_sources in cmake/Hunter/config.cmake.

If I modify Hunter's source code and set HUNTER_PACKAGE_PROTECTED_SOURCES manually, the download succeeds.

The custom package was defined in cmake/Hunter/config.cmake like this

hunter_config(SimpleLibrary
    VERSION 0.3
    URL "https://github.com/gdalex/hunter-test-lib/archive/refs/tags/0.3.zip"
    SHA1 d31ce498f28cde343deee90c4e9035928fa9c5fc
)

include(hunter_protected_sources)
hunter_protected_sources(SimpleLibrary)

~/.config/Hunter/passwords.cmake looks similar to this (the real values have been removed):

hunter_http_password(SimpleLibrary
    USERNAME "..."
    PASSWORD "..."
)

Hunter fails to download the source code. The error is access denied or unauthorized.

Setting HUNTER_PACKAGE_PROTECTED_SOURCES to YES just before the check in hunter_download.cmake leads to a successful download:

set(HUNTER_PACKAGE_PROTECTED_SOURCES YES)
if(HUNTER_PACKAGE_PROTECTED_SOURCES)