I _really_ don't envy the guys working on this. One slip-up and some random repo somewhere will no longer be usable. Git takes baby steps towards swapping out vulnerable SHA-1 hashing algo for SHA-256 https://www.theregister.co.uk/2020/02/05/git_sha_256_work/ via @theregister