Trying out opam pin-depends for supplement dependencies, so that we only need the git hash in one place