Remove stale NO_PWDBASED guards from OpenSSL compat layer

[kojo1]

Description

wolfSSL_sigTypeFromPKEY() was guarded by !NO_PWDBASED because
wolfSSL_EVP_get_hashinfo() originally lived inside the PBE section of
evp.c. The function now only requires OPENSSL_EXTRA, but the
caller-side guard was left behind, so X509_sign()/X509_REQ_sign()
fail at runtime when NO_PWDBASED is defined. The same stale condition
spread to other compat functions whose callees never depended on
password-based crypto; this PR removes those guards as well.

Fixes zd#22275

Testing

• --enable-opensslextra --enable-certgen --enable-certreq
  --enable-keygen CPPFLAGS=-DNO_PWDBASED: CSR generation via
  X509_REQ_sign() succeeds (previously returned failure)
• make check passes with --enable-opensslall both with and without
  NO_PWDBASED (the NO_PWDBASED variant did not even link before)

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 775,612 B / 1,048,576 B, total: 74% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11149

Scan targets checked: wolfcrypt-bugs, wolfssl-bugs
Failed targets: wolfcrypt-src, wolfssl-src

⚠️ Review incomplete — one or more scan targets failed before findings could be produced. See the Fenrir PR review detail page for logs.

[Copilot]

Pull request overview

This PR removes stale !NO_PWDBASED preprocessor guards from the OpenSSL compatibility layer so that signing and digest-related APIs (notably X509_sign() / X509_REQ_sign()) work correctly when NO_PWDBASED is defined.

Changes:

• Relaxed compile-time gating in the OpenSSL-compat key export/encoding path (e.g., wolfSSL_i2d_PrivateKey() / wolfSSL_sigTypeFromPKEY() call paths) to no longer depend on !NO_PWDBASED.
• Updated X.509 digest helpers and PEM/key-writing feature guards to remove NO_PWDBASED as an unrelated constraint.
• Adjusted API tests to exercise the updated build configurations (and tightened EVP_BytesToKey gating to remain password-crypto dependent).

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
wolfcrypt/src/evp_pk.c	Removes NO_PWDBASED gating from DER export APIs; tightens PKCS#8 i2d compilation guard.
src/x509.c	Removes stale NO_PWDBASED guards around X.509 digest/signature-type helpers.
src/pk.c	Removes stale NO_PWDBASED guards from PEM write helpers; adjusts PKCS#8 guard structure.
tests/api/test_ossl_x509_pk.c	Updates X.509 pubkey tests to run under NO_PWDBASED where applicable.
tests/api/test_ossl_x509_name.c	Updates X509_NAME digest tests to run under NO_PWDBASED.
tests/api/test_evp_pkey.c	Updates EVP_PKEY tests to run under NO_PWDBASED where applicable.
tests/api/test_evp_digest.c	Updates EVP digest test gating to not depend on NO_PWDBASED.
tests/api/test_evp_cipher.c	Ensures EVP_BytesToKey test remains gated on encrypted-keys/password support.
tests/api.c	Updates API tests gating to not depend on NO_PWDBASED where unrelated.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[kojo1]

Good catch, thanks. Restored an internal gate keyed on the actual dependency:
wolfSSL_EVP_Digest() is compiled under OPENSSL_EXTRA || HAVE_CURL (evp.c).