opam: use SHA1 because MD5 is deprecated.