more spec fixes

don't test a sha1 hash for results from external libraries