> they usually refer to an upstream by hash

exactly the same thing as a lockfile