Check out the shas for a project as specified in a dependencies.json file in its top level.