arm/trusted-firmware-a: enable OpenSSL stub engine API

The cert_create tool uses the OpenSSL engine API, which has been removed
from OpenSSL 4.  Enable the engine stubs to fix the build until this is
resolved upstream.

Also shoe-horn BUILD_CFLAGS into cert_create/Makefile, so the define is
passed to the build.

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>

meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc

@@ -93,6 +93,10 @@ def remove_options_tail (in_string):
     from itertools import takewhile
     return ' '.join(takewhile(lambda x: not x.startswith('-'), in_string.split(' ')))
 
+# tools/cert_create/src/key.c uses the OpenSSL engine API, but this has been removed
+# from OpenSSL 4.  Enable the compatibility stub APIs until upstream is fixed.
+BUILD_CFLAGS += "-DOPENSSL_ENGINE_STUBS"
+
 EXTRA_OEMAKE += "${@'' if d.getVar('TFA_LTO') else "'LD=" + remove_options_tail(d.getVar('LD')) + "'"}"
 
 EXTRA_OEMAKE += "CC='${@remove_options_tail(d.getVar('CC'))}'"
@@ -158,6 +162,7 @@ do_compile() {
     sed -i '/^LDOPTS/ s,$, \$\{BUILD_LDFLAGS},' ${S}/tools/fiptool/Makefile
     sed -i '/^INCLUDE_PATHS/ s,$, \$\{BUILD_CFLAGS},' ${S}/tools/fiptool/Makefile
     sed -i '/^LIB/ s,$, \$\{BUILD_LDFLAGS},' ${S}/tools/cert_create/Makefile
+    sed -i '/^INC_DIR / s,$, \$\{BUILD_CFLAGS},' ${S}/tools/cert_create/Makefile
 
     # Currently there are races if you build all the targets at once in parallel
     for T in ${TFA_BUILD_TARGET}; do