if the problem is that you rely on external maintainers to 1) create a tag or a ref that reaches the commits you depend on for your release, or 2) do not rebase so that you don't loose your commit. it's likely that the only option is to mirror all trees you need so that you can tag them and have no external dependency. that's one of the reason why all projects are cloned on git.omapzoom.org, because we needed to get reproducible trees since OMAP Android releases are also based on 'static' manifests