use a sha1 to verify the download, not md5