I think your system is probably secure. But your system is relying on sha256 providing a guarantee that it wasn't designed to provide. It's better to only rely

I think your system is probably secure. But your system is relying on sha256 providing a guarantee that it wasn't designed to provide. It's better to only rely on dependencies in ways they actually were designed for.