feat(crypto): support OpenSSL 1.1.x with per-version backend files

.github/workflows/engine-matrix.yml

@@ -102,11 +102,29 @@ jobs:
           cargo clippy -p azihsm_engine -p openssl-engine -p openssl-sys-engine \
             --features engine --all-targets -- -D warnings
 
+      # azihsm_crypto's *_ossl11.rs backends only compile under cfg(not(ossl300)),
+      # so the 3.x workspace clippy in rust.yml never lints them; lint them here.
+      - name: Clippy azihsm_crypto
+        run: cargo clippy -p azihsm_crypto --all-targets -- -D warnings
+
+      # cargo-nextest isn't in the base image and building it from source is
+      # unreliable here; fetch the prebuilt binary, pinned to the version xtask
+      # installs elsewhere (xtask/src/setup.rs CARGO_NEXTEST_VERSION).
+      - name: Install cargo-nextest
+        run: curl -LsSf https://get.nexte.st/0.9.132/linux | tar zxf - -C "${CARGO_HOME:-$HOME/.cargo}/bin"
+
       # openssl-engine's unit tests (error queue, ex_data, set_destroy) depend
       # only on the 1.1 FFI, so they run here. The azihsm_engine mock lifecycle
       # tests pull the OpenSSL-3.x SDK and need separate handling (roadmap #19).
       - name: Test openssl-engine
-        run: cargo test -p openssl-engine --features engine
+        run: cargo nextest run -p openssl-engine --features engine
+
+      - name: Test azihsm_crypto
+        run: cargo nextest run -p azihsm_crypto
+
+      # nextest does not run doctests; run azihsm_crypto's separately.
+      - name: Doctests
+        run: cargo test --doc -p azihsm_crypto
 
       - name: Load engine
         run: openssl engine -t "$(pwd)/target/debug/libazihsm_engine.so"

crates/crypto/build.rs

@@ -0,0 +1,21 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Emits `cfg(ossl300)` when building against OpenSSL 3.0+ so the crate can
+//! select 3.x-only backends or OpenSSL 1.1.x-compatible code. `openssl-sys` is
+//! a direct dependency declaring `links = "openssl"`, so cargo exposes the
+//! detected version here as `DEP_OPENSSL_VERSION_NUMBER` (hex `MNNFFPPS`).
+
+/// OpenSSL 3.0.0 as the packed `DEP_OPENSSL_VERSION_NUMBER` value.
+const OPENSSL_3_0_0: u64 = 0x3000_0000;
+
+fn main() {
+    println!("cargo::rustc-check-cfg=cfg(ossl300)");
+    println!("cargo::rerun-if-env-changed=DEP_OPENSSL_VERSION_NUMBER");
+    if let Ok(v) = std::env::var("DEP_OPENSSL_VERSION_NUMBER")
+        && let Ok(n) = u64::from_str_radix(&v, 16)
+        && n >= OPENSSL_3_0_0
+    {
+        println!("cargo::rustc-cfg=ossl300");
+    }
+}