ci-github: Use older form of openssl command to generate HMACHEADmaster

In order to support openssl versions older than 3.0.

1 files changed, 9 insertions, 4 deletions

diff --git a/mod/hmac.cxx b/mod/hmac.cxx
index 1a78b4c..cfb0e23 100644
--- a/mod/hmac.cxx
+++ b/mod/hmac.cxx
@@ -16,6 +16,12 @@ compute_hmac (const options::openssl_options& o,
 
     // To compute an HMAC over stdin with the key <secret>:
     //
+    //   openssl dgst -sha256 -hmac <secret>
+    //
+    // Note that since openssl 3.0 the `mac` command is the preferred method
+    // for generating HMACs. For future reference, the equivalent command
+    // would be:
+    //
     //   openssl mac -digest SHA256 -macopt "key:<secret>" HMAC
     //
     // Note that here we assume both output and diagnostics will fit into pipe
@@ -25,10 +31,9 @@ compute_hmac (const options::openssl_options& o,
                 path ("-"), // Write output to openssl::in.
                 process::pipe (errp.in.get (), move (errp.out)),
                 process_env (o.openssl (), o.openssl_envvar ()),
-                "mac", o.openssl_option (),
-                "-digest", "SHA256",
-                "-macopt", string ("key:") + k,
-                "HMAC");
+                "dgst", o.openssl_option (),
+                "-sha256",
+                "-hmac", k);
 
     ifdstream err (move (errp.in));