In order to avoid supply chain attacks against the operator, and allow repository mirroring, references from the packagemanifest in OCP OLM should be by digest, not by tag.
See:
http://post-office.corp.redhat.com/archives/openshift-sme/2019-October/msg01569.html