Shell out to sha1sum.

For some reason the commons-digest checksums never match the index.