That being said, MD5 is no longer considered cryptographically secure due to vulnerabilities discovered over the years, such as hash collisions. But finding a specific hash, like the one you mentioned, would still require a brute-force attack or an advanced cryptanalytic method, neither of which is guaranteed to succeed.
- creating minimal OCI images from Nix packages
- creating microvms from OCI images
There are certainly some tradeoffs with this approach, but given that the author is trying to optimize for size, in addition to one of the primary benefits to this approach being a really clean, structured build/deploy loop, it seems like it could be worth exploring.
They OCI images generated are super light weight.