You need a `sha1` and stable, tagged release.