I&#x27;m not an expert but here&#x27;s my interpretation.<p>It doesn&#x27;t seem so. They still require that the SHA-1 is given different initialization vectors (if you look closely you&#x27;ll notice IV1 and IV2 are different) so I&#x27;m thinking this is what freestart means. Git objects tend to have a stricter format so injecting an initial state may be a bit further out of reach.<p>What it does mean is that the triviality of a full collision is greatly increased. I&#x27;d not trust arbitrary git DAGs anyway... I&#x27;d double check but I bet you could forge a pack with some objects that are given invalid content addresses. An integrity check would pick it up but I would also expect most git code to not check that on every operation.