bundle target passes only the first entry of BUNDLE_LIBS_PATHS to MakeBundle.cmake

Locate the bundle target definition that invokes src/cmake/MakeBundle.cmake, then inspect the generated command in build.ninja. Verify that the configured BUNDLE_LIBS_PATHS list reaches MakeBundle.cmake as one escaped argument on Linux and Windows, and confirm that fixup_bundle completes for paths such as the PopSIFT directory.

BUNDLE_LIBS_PATHS is a CMake list, and the bundle target passes it unquoted:

add_custom_target(bundle
    ${CMAKE_COMMAND}
    -DBUNDLE_INSTALL_PREFIX=${ALICEVISION_BUNDLE_PREFIX}
    -DCMAKE_INSTALL_PREFIX=${CMAKE_INSTALL_PREFIX}
    -DBUNDLE_LIBS_PATHS=${BUNDLE_LIBS_PATHS}
    -DCMAKE_INSTALL_LIBDIR=${CMAKE_INSTALL_LIBDIR}
    -P ${CMAKE_CURRENT_SOURCE_DIR}/src/cmake/MakeBundle.cmake
)

An unquoted list expands to one argument per element, so MakeBundle.cmake receives only the
first path as the value of BUNDLE_LIBS_PATHS. Every remaining element becomes a separate
argument, which cmake -P ignores. LIBS_LOOKUPS_PATHS is then short by however many paths were
configured, and fixup_bundle resolves against an incomplete search list.

The generated rule shows it directly — from build.ninja, with three paths configured:

cmake -DBUNDLE_INSTALL_PREFIX=/opt/AliceVision/bundle -DCMAKE_INSTALL_PREFIX=/opt/AliceVision
  -DBUNDLE_LIBS_PATHS=/opt/deps/lib /usr/local/cuda-12.9/lib64 /opt/popsift/lib ...
  -P .../MakeBundle.cmake

Only /opt/deps/lib is assigned; the other two are loose arguments.

Why it is easy to miss

It is silent whenever the dropped paths happen to be redundant — a dependency already beside the
executable, or reachable through the loader, is found anyway and the bundle looks correct. In the
common configuration (a vcpkg bin directory plus a CUDA toolkit directory) the toolkit path is
quietly absent from the search list without any visible consequence.

It surfaces only when a dependency lives exclusively in one of the dropped paths, and then as:

warning: cannot resolve item 'libpopsift.so.0.10.0'
CMake Error at .../BundleUtilities.cmake:740 (file):
  file READ_ELF given FILE "libpopsift.so.0.10.0" that does not exist.

which does not obviously point at argument quoting.

Quoting alone is not sufficient

With "-DBUNDLE_LIBS_PATHS=${BUNDLE_LIBS_PATHS}" the generator emits one argument containing ;
separators, and the build tool runs the command through a shell where ; separates commands, so
the shell tries to execute the paths:

/bin/sh: 1: /opt/deps/lib64: Permission denied

The COMMAND form with VERBATIM is what makes CMake escape each argument for the native tool,
correctly on POSIX shells and on Windows:

add_custom_target(bundle
    COMMAND ${CMAKE_COMMAND}
    -DBUNDLE_INSTALL_PREFIX=${ALICEVISION_BUNDLE_PREFIX}
    -DCMAKE_INSTALL_PREFIX=${CMAKE_INSTALL_PREFIX}
    "-DBUNDLE_LIBS_PATHS=${BUNDLE_LIBS_PATHS}"
    -DCMAKE_INSTALL_LIBDIR=${CMAKE_INSTALL_LIBDIR}
    -P ${CMAKE_CURRENT_SOURCE_DIR}/src/cmake/MakeBundle.cmake
    VERBATIM
)

How it was found

Building with ALICEVISION_USE_POPSIFT=ON against a PopSIFT installed outside the dependency
prefix, with the extra prefix configured through ALICEVISION_BUNDLE_SEARCH_LIBS_PATHS. The path
appeared correctly in BUNDLE_LIBS_PATHS and was dropped on the way to MakeBundle.cmake.
Verified in both directions by reading the generated command out of build.ninja before and after
the change; with the fix the full a;b;c list arrives as one argument and fixup_bundle
completes.

Reproduced on Linux (Ninja, CMake 4.4) and on Windows.

Happy to open a PR with the three-line change if that is useful.