don't duplicate sha1 hashes with strdup() (not \0 terminated)