Sorry about that. You are referring to StGit's homepage? and so the rule of thumb is that unless a SHA-256 sum is shown prominently on a project's homepage, stick with SHA-1?