In the tarball there is a folder for 3rd party plugin -
There you can see how GMIC is fecthed. The cmake file shows it is fetched from this tarball - https://files.kde.org/krita/build/dependencies/gmic-3.0.0.1-patched.tar.gz
The CMAKE files are open you can view them on Graphics / Krita · GitLab
Our CI system is also open they can refer to it too.