CMakeLists.txt wrong minimum required version for validate FIPS version

[leo-costa]

Problem:

This problem was patched here but it wasn't back ported to work with a version that is currently FIPS validated (1.11.0, 1.11.1).

Relevant details

AWS-LC for Rust versions or commit: 1.11.1

System information:

• Darwin 24.6.0 Darwin Kernel Version 24.6.0: Mon Jul 14 11:30:40 PDT 2025; root:xnu-11417.140.69~1/RELEASE_ARM64_T8132 arm64 arm

[justsmth]

This problem was patched #716 but it wasn't back ported to work with a version that is currently FIPS validated (1.11.0, 1.11.1).

Yes, this is correct. aws-lc-fips-sys v0.12.x (corresponding to aws-lc-rs v1.11.x and AWS-LC's "FIPS v2" module) will build successfully with any CMake version 3.x, but this failure message will appear when using CMake 4.x.

Fixing this issue relies on changes being made upstream in AWS-LC. This build problem has been fixed on AWS-LC's fips-2024-09-27 (i.e., "FIPS v3") branch, but it was not backported to fips-2022-11-02 (i.e., "FIPS v2"). I did attempt a similar fix for the fips-2022-11-02 branch, but unfortunately, the build still fails for other reasons. 😞 (AWS-LC's FIPS v3.0 module completed 3rd-party testing and has been on NIST's Modules In Process List since December of 2024.)

As a workaround, I would recommend building with CMake 3.x for now. Hopefully, the FIPS v3.0 module will complete its review soon.

[leo-costa]

Hopefully, the FIPS v3.0 module will complete its review soon.

I hope so too, but reading it online it can take years to be fully validated. Kinda sucks that we can't build with a new make but I guess 3.x will do. I hope for FIPS v3.0 module in the future it won't stop being built because CMake 5.x dropped support for 4.x :D