I don't have a _problem_ with using SHA1, but I would to confirm that it's more important to you guys to use SHA1 than to reflect [the build's original logic (which uses MD5)][0].

[0]: https://github.com/ocaml/opam/blob/240edf448162832c42ddc354ebb52ec5aca2a0eb/src_ext/Makefile#L3-19