fix: guard wc_ecc_make_pub with HAVE_ECC_MAKE_PUB

In builds without HAVE_ECC_MAKE_PUB (e.g. hardware/CB-only), keep
the historical import behaviour instead of failing. Gate the test
with the same define.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: MarkAtwood

src/pk_ec.c

@@ -3435,13 +3435,18 @@ WOLFSSL_EC_KEY* wolfSSL_d2i_ECPrivateKey(WOLFSSL_EC_KEY** key,
          * wc_EccPrivateKeyDecode leaves type == ECC_PRIVATEKEY_ONLY with the
          * public point uninitialised.  Derive the public point now so that
          * all downstream operations (sign, ECDH, export) have a valid key,
-         * matching the behaviour of OpenSSL's d2i_ECPrivateKey. */
+         * matching the behaviour of OpenSSL's d2i_ECPrivateKey.
+         * In builds without HAVE_ECC_MAKE_PUB (e.g. hardware/CB-only),
+         * keep the historical import behaviour and leave the key as
+         * private-only instead of failing import. */
+    #ifdef HAVE_ECC_MAKE_PUB
         if (((ecc_key*)ret->internal)->type == ECC_PRIVATEKEY_ONLY) {
             if (wc_ecc_make_pub((ecc_key*)ret->internal, NULL) != 0) {
                 WOLFSSL_MSG("wc_ecc_make_pub error deriving public key");
                 err = 1;
             }
         }
+    #endif
     }
 
     if (!err) {

tests/api/test_ossl_ec.c

@@ -1632,7 +1632,7 @@ int test_d2i_ECPrivateKey_no_pubkey(void)
 {
     EXPECT_DECLS;
 #if defined(OPENSSL_EXTRA) && !defined(NO_ECC256) && !defined(NO_ECC_SECP) && \
-    defined(HAVE_ECC_KEY_IMPORT)
+    defined(HAVE_ECC_KEY_IMPORT) && defined(HAVE_ECC_MAKE_PUB)
     /* RFC 5915 ECPrivateKey DER with version + privateKey + parameters [0]
      * but NO publicKey [1] field. */
     static const byte kPrivOnlyDer[] = {
@@ -1669,7 +1669,7 @@ int test_d2i_ECPrivateKey_no_pubkey(void)
 
     XMEMSET(hash, 0xab, sizeof(hash));
 
-    /* Import private-only DER — must succeed and auto-derive the public key. */
+    /* Import private-only DER -- must succeed and auto-derive the public key. */
     ExpectNotNull(key = d2i_ECPrivateKey(NULL, &der, sizeof(kPrivOnlyDer)));
 
     /* Structural validity: public point on curve, priv/pub consistent. */
@@ -1691,7 +1691,8 @@ int test_d2i_ECPrivateKey_no_pubkey(void)
     ExpectIntEQ(ECDSA_verify(0, hash, sizeof(hash), sig, (int)sigSz, key), 1);
 
     EC_KEY_free(key);
-#endif /* OPENSSL_EXTRA && !NO_ECC256 && !NO_ECC_SECP && HAVE_ECC_KEY_IMPORT */
+#endif /* OPENSSL_EXTRA && !NO_ECC256 && !NO_ECC_SECP && HAVE_ECC_KEY_IMPORT
+        * && HAVE_ECC_MAKE_PUB */
     return EXPECT_RESULT();
 }