From the packaging POV, it's far better to do cmake discovery for zstd like you do for bz2 and zlib. I am told the Debian build does this already.

xxhash is also a really common dependency on many distros. The other libs do not seem to be common, but if you're adding discovery for two, might as well add them for more.

The other cmake issue is BUILD_SHARED_LIBS. Unless set to OFF, the build fails because of relocation problems against the cacode and alp libraries. Forcing the build to be static means the external dependencies have to be built static also. Most distros don't like static-only builds for reasons widely shared.