Take sha1 of buffer contents, not buffer

This prevents the sha1 function from attempting and then failing to
encode the buffer contents in the wrong encoding.

Fixes #1996.

There is a chance that this will change the checksum for some packages.