prefer "hash mismatch" to "sha1 mismatch"