Use `sha1` unless the homepage has the `sha256` prominently.