I think even a collision (any collision) has yet to found.

People make too big a deal of this collision stuff, a lot of times these are very theoretical would require tremendous computation. Anyway, for this use case, even md5, how likely really to make a useful malicious that file collides with a particular known and widely used one? I dunno seems pretty unlikely.

And if you worry about that you can always use 384. Plus a side benefit is that 384 is faster on a 64-bit processor.