source_hash must be specified for remote sources