> Compare the sha commit hashes of the top commit against > the hashes from the old "true" repo. Isn't it just SHA1? I think it's generally accepted it's not

> Compare the sha commit hashes of the top commit against > the hashes from the old "true" repo. Isn't it just SHA1? I think it's generally accepted it's not secure... Also it would be quite easy to build a clone repo that looks the part with all the correct hashes, the git "database" structure is quite simple.