Repo "corruption" via dropbox does not need a SHA-1 collision. Git uses other files for tracking things, for example: .git/refs/* and .git/HEAD, which point to

Repo "corruption" via dropbox does not need a SHA-1 collision. Git uses other files for tracking things, for example: .git/refs/* and .git/HEAD, which point to particular objects (via SHA-1 hashes). If one of these has a "confilicted change" (via dropbox), one person has the HEAD of the repo (or some other branch) pointing to a commit they do not expect it to point to. Even more interesting is when one person wins HEAD and the other wins it's paired branch in .git/refs/ . Further, git does occasional packing of the object repository. 2 People attempting to pack the object repository when it contains different items might produce interesting results.