In our case, I didn't care since we wantred fixed sha1:s for everything anyway.