change sha256 as default from sha1.
there is reports that sha1 is broken and direct intentional conflict has been made.