sha, not sha1