Mark download_hash.sha1 optional in spec

Spec.md

@@ -451,14 +451,14 @@ and not filled in by hand.
 
 ##### download_hash
 
-If supplied, `download_hash` is an object of hash digests. Currently
-SHA1 and SHA256 calculated hashes of the resulting file downloaded.
+If supplied, `download_hash` is an object of hash digests of the downloaded file.
+Clients up to **v1.34** require both `sha1` and `sha256` to be populated, but
+later clients allow either or both to be omitted.
 It is recommended that this field is only generated by automated
 tools (where it is encouraged), and not filled in by hand.
 
 ```json
     "download_hash": {
-        "sha1": "1F4B3F21A77D4A302E3417A7C7A24A0B63740FC5",
         "sha256": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855"
     }
 ```