diff --git a/tests/component/updater_test.cpp b/tests/component/updater_test.cpp
index ec9c290..bd6534b 100644
--- a/tests/component/updater_test.cpp
+++ b/tests/component/updater_test.cpp
@@ -25,8 +25,7 @@
 
 struct selabel_handle *sehandle = nullptr;
 
-static void expect(const char* expected, const char* expr_str,
-                   ErrorCode error_code, CauseCode cause_code) {
+static void expect(const char* expected, const char* expr_str, CauseCode cause_code) {
     Expr* e;
     int error_count;
     EXPECT_EQ(parse_string(expr_str, &e, &error_count), 0);
@@ -41,7 +40,10 @@
         EXPECT_STREQ(expected, result);
     }
 
-    EXPECT_EQ(error_code, state.error_code);
+    // Error code is set in updater/updater.cpp only, by parsing State.errmsg.
+    EXPECT_EQ(kNoError, state.error_code);
+
+    // Cause code should always be available.
     EXPECT_EQ(cause_code, state.cause_code);
 
     free(result);
@@ -59,13 +61,40 @@
 TEST_F(UpdaterTest, getprop) {
     expect(android::base::GetProperty("ro.product.device", "").c_str(),
            "getprop(\"ro.product.device\")",
-           kNoError, kNoCause);
+           kNoCause);
 
     expect(android::base::GetProperty("ro.build.fingerprint", "").c_str(),
            "getprop(\"ro.build.fingerprint\")",
-           kNoError, kNoCause);
+           kNoCause);
 
     // getprop() accepts only one parameter.
-    expect(nullptr, "getprop()", kNoError, kArgsParsingFailure);
-    expect(nullptr, "getprop(\"arg1\", \"arg2\")", kNoError, kArgsParsingFailure);
+    expect(nullptr, "getprop()", kArgsParsingFailure);
+    expect(nullptr, "getprop(\"arg1\", \"arg2\")", kArgsParsingFailure);
+}
+
+TEST_F(UpdaterTest, sha1_check) {
+    // sha1_check(data) returns the SHA-1 of the data.
+    expect("81fe8bfe87576c3ecb22426f8e57847382917acf", "sha1_check(\"abcd\")", kNoCause);
+    expect("da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha1_check(\"\")", kNoCause);
+
+    // sha1_check(data, sha1_hex, [sha1_hex, ...]) returns the matched SHA-1.
+    expect("81fe8bfe87576c3ecb22426f8e57847382917acf",
+           "sha1_check(\"abcd\", \"81fe8bfe87576c3ecb22426f8e57847382917acf\")",
+           kNoCause);
+
+    expect("81fe8bfe87576c3ecb22426f8e57847382917acf",
+           "sha1_check(\"abcd\", \"wrong_sha1\", \"81fe8bfe87576c3ecb22426f8e57847382917acf\")",
+           kNoCause);
+
+    // Or "" if there's no match.
+    expect("",
+           "sha1_check(\"abcd\", \"wrong_sha1\")",
+           kNoCause);
+
+    expect("",
+           "sha1_check(\"abcd\", \"wrong_sha1\", \"wrong_sha2\")",
+           kNoCause);
+
+    // sha1_check() expects at least one argument.
+    expect(nullptr, "sha1_check()", kArgsParsingFailure);
 }
diff --git a/updater/install.cpp b/updater/install.cpp
index 86cdd5d..3546968 100644
--- a/updater/install.cpp
+++ b/updater/install.cpp
@@ -18,24 +18,24 @@
 
 #include <ctype.h>
 #include <errno.h>
+#include <fcntl.h>
+#include <ftw.h>
+#include <inttypes.h>
 #include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/capability.h>
 #include <sys/mount.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <sys/wait.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <time.h>
-#include <ftw.h>
-#include <sys/capability.h>
 #include <sys/xattr.h>
-#include <linux/xattr.h>
-#include <inttypes.h>
+#include <time.h>
+#include <unistd.h>
 
 #include <memory>
+#include <string>
 #include <vector>
 
 #include <android-base/parseint.h>
@@ -45,6 +45,7 @@
 #include <cutils/android_reboot.h>
 #include <ext4_utils/make_ext4fs.h>
 #include <ext4_utils/wipe.h>
+#include <openssl/sha.h>
 #include <selinux/label.h>
 #include <selinux/selinux.h>
 
@@ -54,8 +55,8 @@
 #include "error_code.h"
 #include "minzip/DirUtil.h"
 #include "mounts.h"
-#include "openssl/sha.h"
 #include "ota_io.h"
+#include "print_sha1.h"
 #include "tune2fs.h"
 #include "updater/updater.h"
 
@@ -111,19 +112,6 @@
     return 0;
 }
 
-// Take a sha-1 digest and return it as a newly-allocated hex string.
-char* PrintSha1(const uint8_t* digest) {
-    char* buffer = reinterpret_cast<char*>(malloc(SHA_DIGEST_LENGTH*2 + 1));
-    const char* alphabet = "0123456789abcdef";
-    size_t i;
-    for (i = 0; i < SHA_DIGEST_LENGTH; ++i) {
-        buffer[i*2] = alphabet[(digest[i] >> 4) & 0xf];
-        buffer[i*2+1] = alphabet[digest[i] & 0xf];
-    }
-    buffer[i*2] = '\0';
-    return buffer;
-}
-
 // mount(fs_type, partition_type, location, mount_point)
 //
 //    fs_type="ext4"   partition_type="EMMC"    location=device
@@ -1227,29 +1215,24 @@
     SHA1(reinterpret_cast<uint8_t*>(args[0]->data), args[0]->size, digest);
 
     if (argc == 1) {
-        return StringValue(PrintSha1(digest));
+        return StringValue(strdup(print_sha1(digest).c_str()));
     }
 
-    int i;
-    uint8_t arg_digest[SHA_DIGEST_LENGTH];
-    for (i = 1; i < argc; ++i) {
+    for (int i = 1; i < argc; ++i) {
+        uint8_t arg_digest[SHA_DIGEST_LENGTH];
         if (args[i]->type != VAL_STRING) {
-            printf("%s(): arg %d is not a string; skipping",
-                    name, i);
+            printf("%s(): arg %d is not a string; skipping", name, i);
         } else if (ParseSha1(args[i]->data, arg_digest) != 0) {
             // Warn about bad args and skip them.
-            printf("%s(): error parsing \"%s\" as sha-1; skipping",
-                   name, args[i]->data);
+            printf("%s(): error parsing \"%s\" as sha-1; skipping", name, args[i]->data);
         } else if (memcmp(digest, arg_digest, SHA_DIGEST_LENGTH) == 0) {
-            break;
+            // Found a match.
+            return args[i].release();
         }
     }
-    if (i >= argc) {
-        // Didn't match any of the hex strings; return false.
-        return StringValue(strdup(""));
-    }
-    // Found a match.
-    return args[i].release();
+
+    // Didn't match any of the hex strings; return false.
+    return StringValue(strdup(""));
 }
 
 // Read a local file and return its contents (the Value* returned