SHA-1 collisions are now a thing, so it's about time to get rid of SHA-1 hashes in Manifest files. The following packages have SHA-1 digests: dev-java/jdbc-informix dev-java/jdbc-oracle-bin dev-java/sun-j2ee-deployment-bin dev-util/its4 Unfortunately they are all fetch-restricted, so I couldn't check for collisions on them.