seth/rebar_lock_deps_plugin — pull request #4 by lukyanov (2012-11-19 14:20:58+00:00)
Title: SHA instead of {tag, SHA}.

Using {tag, SHA} is not a correct way to specify SHA.
If you look at rebar_deps.erl you'll see the following:

update_source1(AppDir, {git, _Url, {tag, Tag}}) ->
ShOpts = [{cd, AppDir}],
rebar_utils:sh("git fetch --tags origin", ShOpts),
rebar_utils:sh(?FMT("git checkout -q ~s", [Tag]), ShOpts);

"git fetch --tags origin" only fetches commits for tags, no more.
If there are no tags in repo then no commits will be fetched.