It is often declared that SHA-1 is broken, but in fact still nobody can take code A and find a different code B that hashes to the same SHA1 value, which is wh

It is often declared that SHA-1 is broken, but in fact still nobody can take code A and find a different code B that hashes to the same SHA1 value, which is what git is concerned about. Even long ridiculed and buried MD5 is still perfectly secure in that sense.