fetch package using git commit hash rather than master TOT