please use sha1, per discussion earlier