I do actually literally write in this that if it was MD5 it also would not be a problem.

The hash isn't the security, the distribution is.

https://lore.kernel.org/git/Pine.LNX.4.58.0504291221250.1890...

As linked by another commenter in this thread, Linus worked out years ago that even if someone inserted a malicious object into the kernel repo, it would at best be a nuisance and not a major concern.

They address this very theoretical. In short: Yes. Which makes sense if you don't treat the hash as a form of security against malice, especially in the case of attacks that are already impractical, which is the entire thrust of the article.

Follow the ethos of the quote master!

> We could be using MD5 and it would honestly probably be just fine.