add dependencies to package.json, generate shas.txt in build.sh