SHA-1 is insecure. See a representative summary of known attacks here: https://en.wikipedia.org/wiki/Hash_function_security_summary Some external build systems warn about sha1 uses and reject to build. Whitelisting is pain. Switch to sha256.