If you use a tagged tarball, you'll need to add the `sha`, but the `version` should be OK to omit.