3 ms·

This is nearly beside the point, but why include SHA-1 as a default hash algorihtm in a greenfield project?

• geocar 4y ago
  It's not exactly green-field: SPDX is over ten years old now, and browsers only started removing SHA-1 in the last five years.
• klysm 4y ago
  As other commenters have said, it’s not greenfield, but is there a valid attack vector on a collision here?