This says `md5`, but the code uses `sha1`