The main problem is relying on Git&#x27;s SHA1s for security. Git was not designed for security - it was a nice side effect while SHA-1 was dependable. But it isn&#x27;t any more; a method for finding freestart collisions (&quot;SHAppening&quot; [0]) is already known, and it is expected that standard collisions will be found within a year. (Preimages are not expected for a few decades or hundred years though)<p>For the use described here, however - proving to someone else that you had a specific repository content - collision availability renders a proof useless. Similarly, for this specific use, Git&#x27;s standard support for PGP signatures is also useless - you can use a 4,096 bit RSA signature, but it only guarantees a 160-bit SHA1 hash, which (given collisions) is not dependable as a proof.<p>If you really need it, you need something else - use an SHA2 or SHA3 variant on an repeatable export of the database, e.g. using git-evtag [1] (not my project; Note: I haven&#x27;t audited it, and I don&#x27;t consider myself a qualified cryptographer - Use at your own peril).<p>[0] <a href="https:&#x2F;&#x2F;sites.google.com&#x2F;site&#x2F;itstheshappening&#x2F;" rel="nofollow">https:&#x2F;&#x2F;sites.google.com&#x2F;site&#x2F;itstheshappening&#x2F;</a><p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;cgwalters&#x2F;git-evtag" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;cgwalters&#x2F;git-evtag</a><p>edit: added wording to make clear I am not the author of git-evtag