Reusing 'sha1' as a local variable name seems confusing here, since once we append the guid it's not a SHA1 hash anymore. Could you rename this to something like 'buildpack_key'?