SPDX SHA1 incorrect

[JasperTeng]

Version: 2.4.0
Issue:
When using SPDX option for licenseUrlFileNames, SHA1 for MPL-1.1 and CDDL-1.1 seems incorrect (Note: Both are HTMLs).
I tried useDefaultContentSanitizers and it didn't help.

Ask#1: can someone advise me if the SHA1 are truly incorrect? or am i just using it incorrectly?
Ask#2: could we have the option to disable SHA1 checking for certain urls regex? (e.g.: ".*.html")

[JasperTeng]

For reference, my SHA1 for
https://mozilla.org/MPL/MPL-1.1.html = 7b00c27ab5d61cb498c250610119932a5913aa17
https://javaee.github.io/glassfish/LICENSE = 156a933e0848d8b2818cffb6d850c36740dcda93