dependency_status avoids computing things it won't need

It honours the "check" argument, which can save some time.
However, the full set is always saved to the database.
Pull hash functions out so I can generalise them later.