P.S. I have not tested it yet

I would rather have us #define these BIO_ setters and getters if we detect that OpenSSL doesn't provide them so we don't have our code littered with preprocessor statements.

No need to use a #define, real functions will work just fine. Just add a compatibility header that only defines the functions if SSH isn't providing them.

#if !OPENSSL_HAS_BIO_SET_INIT
void BIO_set_init(BIO* b, int v) {
    b->init = v;
    b->num = 0;
    b->ptr = NULL;
    b->flags = 0;
}
#endif

etc.

Declaring functions in someone else's namespace is something you have to be very careful about, or you might end up overwriting the one hat libssl itself provides, depending on exactly how the libraries are loaded, like in the example above.

so what should I do after all?

Either would work, but if you prefer functions, they should be using the GIT_INLINE macro so they're local and the compiler is more likely to inline these single-use tiny functions.

My distribution just upgraded to 1.1 in the headers, so I've gone ahead and updated to what the kind of interfaces we program against.

I also moved the creation of the method to the global initialisation function. Creating a new one on each connection is unsafe thread-wise and it's also a memory leak.

Thanks for doing the 1.1 conversion.