While we're not even remotely close to have sha256 in gotd, this is a
low-hangig fruit.

(a follow-up diff to make gotd error on non-sha1 repositories is in the
work.)

diff /home/op/w/got
commit - d9e20cb75d62b8ae0fdc5be5140c9447b4080649
path + /home/op/w/got
blob - 324517a9b35f3478a580caf319629d5efd73a9ee
file + lib/object_open_io.c
--- lib/object_open_io.c
+++ lib/object_open_io.c
@@ -428,7 +428,8 @@ open_commit(struct got_commit_object **commit,
 		got_object_close(obj);
 		if (err)
 			goto done;
-		err = got_object_parse_commit(commit, buf, len, GOT_HASH_SHA1);
+		err = got_object_parse_commit(commit, buf, len,
+		    got_repo_get_object_format(repo));
 		free(buf);
 	} else if (err->code == GOT_ERR_NO_OBJ) {
 		int fd;
@@ -525,7 +526,8 @@ open_tree(struct got_tree_object **tree,
 		if (err)
 			goto done;
 		err = got_object_parse_tree(&entries, &nentries,
-		    &nentries_alloc, buf, len, GOT_HASH_SHA1);
+		    &nentries_alloc, buf, len,
+		    got_repo_get_object_format(repo));
 		if (err)
 			goto done;
 	} else if (err->code == GOT_ERR_NO_OBJ) {
@@ -684,7 +686,7 @@ read_blob(uint8_t **outbuf, size_t *size, size_t *hdrl
 	struct got_inflate_checksum csum;
 	struct got_hash ctx;
 
-	got_hash_init(&ctx, GOT_HASH_SHA1);
+	got_hash_init(&ctx, got_repo_get_object_format(repo));
 	memset(&csum, 0, sizeof(csum));
 	csum.output_ctx = &ctx;
 
@@ -922,7 +924,8 @@ open_tag(struct got_tag_object **tag, struct got_repos
 		got_object_close(obj);
 		if (err)
 			goto done;
-		err = got_object_parse_tag(tag, buf, len, GOT_HASH_SHA1);
+		err = got_object_parse_tag(tag, buf, len,
+		    got_repo_get_object_format(repo));
 		free(buf);
 	} else if (err->code == GOT_ERR_NO_OBJ) {
 		int fd;