or, you know, this could just be fixed in git by using a proper hash function that allows you to trust your merkle tree.