Use commit hash instead of version tag

When using the commit hash it is possible to check if a download is really
needed. Only in the case the hash has changed the external project command is
executed.