move sha1 from Builder to watch

since watch actually uses it and Builder doesn't