It seems like SHA1 has been deprecated a long time ago. So why do people still not use SHA256 for new repos?
You must log in or # to comment.
Because the git commit hash is not suppose to be used as a security measure, just a identification measure.
Sha1 is still secure for this use too. Both preimage properties remain unbroken.
