How to make composer to use an exact SHA1 value?

I want to make sure composer is using an exact version of a git repository by specifing the SHA1 of the commit. How can I do this?

You can specify it after the version, as such (assuming you want the master branch): “dev-master#a93cbe224”

To cache your choice, you MUST use full lenght SHA1 hash like this:

"require": {
    "sonata-project/media-bundle": "2.2.x-dev#006121d9aee0080573ccdb05900bd58c2ffe295d",