Since SHA-1 is already broken (just expensive in terms of GPU-time), then the text "please see commit <sha1>" is also already broken.

You can't attack an existing normal commit.

But also collisions there aren't a big deal. People will cite short hashes when referring to things and that's not "broken".

	▲	windsurfer 5 hours ago \| parent [-]
		If it's an existing commit and you're already converting the repo, you can just convert the commit messages as well.

schacon 8 hours ago | parent | prev [-]

That is essentially only a second preimage problem, which is basically impossible.

	▲	7 hours ago \| parent [-]
		[deleted]