Just leave this as `sha1` unless the `sha256` is prominent on the homepage (doesn't seem to be).