[zep fromlist] psa_crypto.c: Fix ifdefs to avoid build warning

[aescolar]

Add a couple of missing ifdefs to avoid having unreachable code with AT_LEAST_ONE_BUILTIN_KDF not defined, which otherwise causes a build warning with clang.

Issue seen in Zephyr CI's clang workflow:
https://github.com/zephyrproject-rtos/zephyr/actions/runs/23368380259/job/67987251166

More details in Zephyr PR:

• manifest: Update TF-PSA-Crypto with hotfix zephyr#105990

Upstream PR:

• psa_crypto.c: Fix ifdefs to avoid build warning Mbed-TLS/TF-PSA-Crypto#723

[valeriosetti]

I'm not against the change, but why is this a [zep noup]?
This change doesn't seem to be Zephyr specific so there must be an upstream PR ported here. A PR of mine on this repo has been nacked just a few days ago for the very same reason.
Please open an upstream PR with this change and add it here with git cherry-pick -x (here's the guideline).

[aescolar]

Thanks @valeriosetti I created the PR upstream Mbed-TLS#723 and changed this to be a fromlist.
You are more than welcome to take over this PR and/or the upstream one and fix anything however you think it is best. You can of course also advice on how to fix things, but you are much more knowledgable about this areas and this module upstream contribution process, and from my POV, my interest is limited on stabilizing Zephyr's main.

If contributing in an appropriate way to this modules branch is too complex/lengthy, another option would be to merge this as a zephyr_2026_03_21 hotfix branch, and handle the fix into the zephyr_tf-psa-crypto_v1.1.0 branch calmly after.

[fabiobaltieri]

For other repos in the org divergence are kept in branches that match the main repo release branch name, so for example this could go on a v4.3-branch and then v4.4-branch as well I guess and when v4.5 happens that branch could be rebase to drop the commits that have been upstreamed, though I don't see a main tracking branch in https://github.com/zephyrproject-rtos/TF-PSA-Crypto? But yeah I think it'd be nice to stay away from arbitrary branch name for fixes.

[valeriosetti]

Thank you for opening the upstream PR and adjusting this one. LGTM now :)

[valeriosetti]

You are more than welcome to take over this PR and/or the upstream one and fix anything however you think it is best

@aescolar I already added myself as reviewer for the upstream PR and I'll take care of bringing that one forward

[valeriosetti]

For other repos in the org divergence are kept in branches that match the main repo release branch name, so for example this could go on a v4.3-branch and then v4.4-branch as well I guess and when v4.5 happens that branch could be rebase to drop the commits that have been upstreamed, though I don't see a main tracking branch in https://github.com/zephyrproject-rtos/TF-PSA-Crypto? But yeah I think it'd be nice to stay away from arbitrary branch name for fixes.

Here we're following the bumping guidelines described in Mbed TLS's README file where we track the upstream project lifecycle instead of the Zephyr one. The branch where this PR is merged is zephyr_tf-psa-crypto_v1.1.0 which corresponds to zephyr_<module_name>_<release_numbers>.
This procedure was introduced last year and it's now adopted by a variety of repos in Zephyr:

• https://github.com/zephyrproject-rtos/mbedtls
• this one
• https://github.com/zephyrproject-rtos/trusted-firmware-m
• https://github.com/zephyrproject-rtos/tf-m-tests
• https://github.com/zephyrproject-rtos/psa-arch-tests

[fabiobaltieri]

Cool, sounds like you have your plan together, thanks for clarifying.