We're trying to give the arbitrary SHAs required by each spec a
meaningful name.

This also adds an explicit `ref` definition to each spec so we're not
dealing with a mystery guest.