Commit 909c0737c for clamav.net

commit 909c0737c2d9e1ee429b7560b6bf1c5e49039071
Author: Val S. <valsnyde@cisco.com>
Date:   Tue Jun 30 17:54:01 2026 -0400

    Raise minimum CMake version to 3.17 (#1753)

    Linux static dependency builds can fail when a package exports private static dependencies as bare -l flags plus interface link directories. In older CMake policy mode, those link directories are not propagated through private dependencies of static libraries, so consumers can lose the directory needed to resolve libraries such as libssh2, OpenSSL, and nghttp2.

    Possible fixes include forcing the dependency package metadata to avoid pkg-config, adding project-specific link directory workarounds, or using CMake policy CMP0099's newer behavior. Since the oldest supported Linux distributions now provide CMake 3.18 or newer, use CMake 3.17 as the minimum for every platform so CMP0099 is set to NEW by cmake_minimum_required().

    CLAM-3015

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 3a53e9ead..eddbd5de8 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,11 +1,8 @@

 # Copyright (C) 2019-2026 Cisco Systems, Inc. and/or its affiliates. All rights reserved.

-if(WIN32)
-    cmake_minimum_required( VERSION 3.16 ) # For file(GET_RUNTIME_DEPENDENCIES)
-else()
-    cmake_minimum_required( VERSION 3.14 )
-endif()
+# CMake 3.17 preserves link directories from private static dependencies.
+cmake_minimum_required( VERSION 3.17 )

 set(CMAKE_C_STANDARD 90)
 set(CMAKE_C_STANDARD_REQUIRED ON)
diff --git a/INSTALL.md b/INSTALL.md
index fe91ffa26..5fc4bf711 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -76,7 +76,7 @@ As of ClamAV 0.104, CMake is required to build ClamAV.
 The Windows Visual Studio and Autotools build systems have been removed.

 You will need:
-- CMake (3.14+ for Unix/Linux; 3.16+ for Windows)
+- CMake 3.17 or newer
 - A C compiler toolchain such as `gcc`, `clang`, or Microsoft Visual Studio.
 - The Rust compiler toolchain.