The pipefail option causes the script to terminate with an error,
because the pipes are closed while they are still being written
to from /dev/urandom.
It would be possible to disable pipefail locally for this command,
but using openssl seems easier and more robust anyways.
For the future we should consider adapting the Fedora python scripts
for Debian and move the logic out of the CI script into a dedicated
packaging script.