You cannot (verify using hashes that is). On the other hand, you can use git URLs with commit hashes, which works pretty well.