Use `sha1` unless it's available on the website only as `sha256`.