It's difficult to exploit, but possible. I think the actual issue here is environment accreditation not allowing the use of sha-1 at all, but that is still rar

It's difficult to exploit, but possible. I think the actual issue here is environment accreditation not allowing the use of sha-1 at all, but that is still rare. It'll become a much larger issue if a future FIPS standard ever disallows sha-1, because that will impact a ton of environments. It means git won't even work on your servers any more.