&gt;Also, this opens up a new avenue in that now hash collisions (as unlikely as they may be) would be considered equal.<p>Hash collision implies attacker has control of both the inputs, in this case we&#x27;d be talking about a preimage attack.<p>If your attacker can perform preimage attacks on SHA256 they can also most likely hack you via your package manager.