don't ever allow SHA1 collisions to exist by fetching a pack