You can specify what version you want. That doesn't necessarily imply that version will continue to be available. Ruby has the same problem with "yanked" versions of gems.

You cannot (verify using hashes that is). On the other hand, you can use git URLs with commit hashes, which works pretty well.