Just to reiterate from a post I made later. There's a (very, very, very...) few places where SHA1 is not broken. But there's no reason ever to use it for new ...

But there it's not applied as a security measure. For integrity it doesn't really matter, the only issue there is a random collision and that's still as unlikely as ever. It's pretty much impossible ...