only check SHA1 sums for files we're using