A SHA-1 name is 160 bits, written as 40 hex digits. A commit names its tree and parent, and each tree names its children, so a commit hash covers the whole history behind it: change one byte in last year's file and every later hash changes. History is tamper-evident, and rewriting it (Rebase and Conflicts) always yields new hashes. git rev-parse turns any revision expression into a name:
git rev-parse HEAD
git rev-parse --short HEAD
git rev-parse HEAD^{tree} HEAD:db/schema.sql0be51cec615ba290d0cd9cd68508412c95aa6182 0be51ce 64eb5254db7a4f751d2d72d53c4461fcc7fa1015 94568a7a08dacaf7a3afeb81ba74d6e3991cb40c
Short names work while unique (Git 1,932 prints at least seven digits); store full hashes in scripts. SHA-1 itself is no longer collision-proof: in February 2017 Google and CWI Amsterdam published SHAttered, two different PDFs with one SHA-1. Git switched within months to SHA-1DC, which detects the known attack patterns and rejects such objects (the SHA1_DC of Git 2.55). The long-term fix is SHA-256 (SHA-256 Transition).