osptoolkits FTBFS against OpenSSL 4

[vmpyr]

Hello,

I am an Ubuntu Developer and we are currently transitioning to OpenSSL 4. osptoolkit fails to build from source against it with the following error:

| gcc -Wdate-time -D_FORTIFY_SOURCE=2 -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/osptoolkit-4.13.0=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -DOSP_ALLOW_DUP_TXN -DOSP_NO_DELETE_CHECK -DOSP_SDK -D_REENTRANT -D_POSIX_THREADS -DOPENSSL_NO_KRB5 -D_GNU_SOURCE -Iinclude -Ienroll -Itest -Wall -o enroll/osptneputil.o -c enroll/osptneputil.c
| libtool --mode=link gcc -Wl,-z,relro -Wl,-z,now -o bin/enroll enroll/osptnepinit.o enroll/osptnepenroll.o enroll/osptnep.o enroll/osptneputil.o lib/libosptk.la -lcrypto
| libtool: link: gcc -Wl,-z -Wl,relro -Wl,-z -Wl,now -o bin/.libs/enroll enroll/osptnepinit.o enroll/osptnepenroll.o enroll/osptnep.o enroll/osptneputil.o lib/.libs/libosptk.so -lcrypto -pthread
| /usr/bin/x86_64-linux-gnu-ld.bfd: lib/.libs/libosptk.so: undefined reference to `ENGINE_register_DH'
| /usr/bin/x86_64-linux-gnu-ld.bfd: lib/.libs/libosptk.so: undefined reference to `ENGINE_register_RAND'
| /usr/bin/x86_64-linux-gnu-ld.bfd: lib/.libs/libosptk.so: undefined reference to `ENGINE_register_ciphers'
| /usr/bin/x86_64-linux-gnu-ld.bfd: lib/.libs/libosptk.so: undefined reference to `ENGINE_register_RSA'
| /usr/bin/x86_64-linux-gnu-ld.bfd: lib/.libs/libosptk.so: undefined reference to `ENGINE_register_digests'
| /usr/bin/x86_64-linux-gnu-ld.bfd: lib/.libs/libosptk.so: undefined reference to `ENGINE_get_next'
| /usr/bin/x86_64-linux-gnu-ld.bfd: lib/.libs/libosptk.so: undefined reference to `ENGINE_get_first'
| /usr/bin/x86_64-linux-gnu-ld.bfd: lib/.libs/libosptk.so: undefined reference to `ENGINE_load_builtin_engines'
| collect2: error: ld returned 1 exit status

You can find the bug report here: https://bugs.launchpad.net/ubuntu/+source/osptoolkit/+bug/2155022

I've created a patch in Ubuntu for fixing this:

Description: Fix FTBFS with OSSL4 and port hardware acceleration to providers.
 The ENGINE API was deprecated in OpenSSL 3.0 (where it still built and
 linked fine) and its symbols (ENGINE_load_builtin_engines,
 ENGINE_get_first/next, ENGINE_register_ciphers/digests/RSA/DH/RAND) were
 removed from the library in OpenSSL 4.0, causing undefined-reference link
 errors.
 .
 The ENGINE subsystem was replaced by the provider API in OpenSSL 3.0. The
 builtin hardware engines that cha_engine_init() used to register (rdrand,
 padlock) were folded into the default provider, which transparently uses
 the CPU's crypto acceleration (AES-NI, RDRAND, SHA extensions). For
 OpenSSL >= 4.0 we therefore express "enable hardware acceleration" by
 loading the default provider instead of iterating ENGINEs. The OpenSSL 3.x
 code path is left unchanged and still built with the ENGINE API.
Author: Ujjwal Sarswat <ujjwal.sarswat@canonical.com>
Last-Update: 2026-07-08
--- osptoolkit-gu.orig/src/ospopenssl.c	2026-07-08 15:08:20.545481201 +0530
+++ osptoolkit-gu/src/ospopenssl.c	2026-07-08 15:09:25.387821599 +0530
@@ -32,7 +32,11 @@
 #include "openssl/err.h"
 #include "openssl/rand.h"
 #include "openssl/crypto.h"
+#if (OPENSSL_VERSION_NUMBER < 0x40000000L)
 #include "openssl/engine.h"
+#else
+#include "openssl/provider.h"
+#endif
 
 #define OSPC_MAX_CERT_BUFFER         4096
 
@@ -691,6 +695,7 @@
 int cha_engine_init(OSPTBOOL hw_enabled)
 {
     int errorcode = OSPC_ERR_NO_ERROR;
+#if (OPENSSL_VERSION_NUMBER < 0x40000000L)
     ENGINE *e = OSPC_OSNULL;
 
     if (hw_enabled) {
@@ -710,6 +715,28 @@
             ENGINE_register_RAND(e);
         }
     }
+#else
+    /*
+     * The ENGINE API was deprecated in OpenSSL 3.0 and its symbols removed
+     * in OpenSSL 4.0.  The builtin hardware engines it used to register
+     * (e.g. rdrand, padlock) were folded into the default provider, which
+     * transparently uses available CPU crypto acceleration (AES-NI, RDRAND,
+     * SHA extensions, ...).  Explicitly loading the default provider is the
+     * OpenSSL 4.0 equivalent of enabling hardware acceleration here.
+     */
+    if (hw_enabled) {
+        OSSL_PROVIDER *deflt = OSPC_OSNULL;
+
+        OSPM_DBGENTER(("ENTER: cha_engine_init()\n"));
+
+        deflt = OSSL_PROVIDER_load(OSPC_OSNULL, "default");
+        if (deflt == OSPC_OSNULL) {
+            errorcode = OSPC_ERR_SEC_MODULE;
+            OSPM_DBGERRORLOG(errorcode, "Unable to load OpenSSL default provider");
+            ERR_print_errors(bio_stdout);
+        }
+    }
+#endif
     OSPM_DBGEXIT(("EXIT : cha_engine_init() (%d)\n", errorcode));
 
     return errorcode;

This fixes the build issues. Please let me know if there is a better solution. Cheers!