Don't try to fingerprint a bare repo

Sometimes an empty (or still-synchronizing) repository ends
up being added to manifest, so when we clone it and try to
fingerprint it, we fail (nothing to fingerprint). Handle such
cases more gracefully.