Once the repo is downloaded, the version is not checked gain. This
means that even if a package's Makefile is touched, that will only
cause a rebuild of the previously downloaded version. For packages
that are normally not deleted, like edbg, this renders PKG_VERSION
bumps ineffective, unless the user manually deletes the repo
directory.
This patch fixes that by always checking that the repo is at the
right commit.
Use fixed identity when applying patches, it fixes issues when they are
not set in the build computer or if HOME is not exported.
The commits are only used in the build system so adding the building user
information is useless.
