manifest: use commit ID instead of tag to avoid confusing version number with file extension