SHA1 and Mercurial (and Git) and why you have Bigger Problems
mercurial-scm.org