Currently only commit hashes are accepted.
The lock file should still resolve to a hash of course.