External roles and collection: depend on specific hashes?

[dometto]

Depending on specific hashes (rather than tags, which are mutable) is more stable/secure: it guarantees the specific code belonging to that commit hash is installed. On the other hand, it means updates will not be installed.