Relevant quote from the Fossil website[0]: "Fossil started out using 160-bit SHA-1 hashes to identify check-ins, just as in Git. That changed in early 2017 whe

Relevant quote from the Fossil website[0]: "Fossil started out using 160-bit SHA-1 hashes to identify check-ins, just as in Git. That changed in early 2017 when news of the SHAttered attack broke, demonstrating that SHA-1 collisions were now practical to create. Two weeks later, the creator of Fossil delivered a new release allowing a clean migration to 256-bit SHA-3 with full backwards compatibility to old SHA-1 based repositories. [...] Meanwhile, the Git community took until August 2018 to publish their first plan for solving the same problem by moving to SHA-256, a variant of the older SHA-2 algorithm. As of this writing in February 2020, that plan hasn't been implemented, as far as this author is aware, but there is now a competing SHA-256 based plan which requires complete repository conversion from SHA-1 to SHA-256, breaking all public hashes in the repo." [0]: https://fossil-scm.org/home/doc/trunk/www/fossil-v-git.wiki#hash https://fossil-scm.org/home/doc/trunk/www/fossil-v-git.wiki#...