According to http://www.pcworld.com/article/3174676/security/sha-1-collision-can-break-svn-code-repositories.html and https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision/ you could have two objects generating the same SHA-1 checksum. I am guessing this also effects in key generation as well.
Is there a way ina project which projects in places like sourceforge.netis starting and github.comusing git could do better to move all their infrastructure offmake sure that it uses SHA-1 to256 from the start instead of relying on SHA-256 or better1 . If yes, how ?
Comments, observations all welcome.