As a rough approximation, you need something like sqrt(N) entities before the birthday paradox becomes an issue. The Wikipedia article at https://en.wikipedia.

As a rough approximation, you need something like sqrt(N) entities before the birthday paradox becomes an issue. The Wikipedia article at https://en.wikipedia.org/wiki/Birthday_problem#Square_approximation https://en.wikipedia.org/wiki/Birthday_problem#Square_approx... gives the approximation as: n = sqrt(2 * m * p(n)) where p(n) is the probability of having a collision. Let p(n) be 1e-9 (a 1 in a billion chance). With fossil's old default of SHA1's 160 bits you'll need roughly sqrt(2 * 2^80 * 1e-9) = 49 million artifacts before the likely duplicate. A 1 in a billion chance might still be scary (if everyone on Earth has their own 50 million repo, each with unique artifacts, then there will be duplicates!), but SHA1 use in fossil is mostly a historical issue. With fossil's new default (since v2.10 in 2019) of SHA3-256, you'll need something like 1.5e34 artifacts before there is a 1-to-a-billion chance of a duplicate. As MathMonkeyMan's link points out, you can configure your repository to "shun-sha1" and only allow sha3.