Comment by alerighi

If you rely on the commit SHA-1 as a integrity verification it's your problem. Git was never intended to be used as an integrity check.