Bundle sha1 rather than use libgcrypt/nettle