Apple’s sample code for Mac App Store receipt validation still uses OpenSSL, which as of Mac OS X 10.7 we are not supposed to dynamically link against. You can statically link with OpenSSL, but Satoshi Numata has posted some more modern code that uses only the built-in libraries (via Craig Hockenberry).