Cannot read property 'dist' of undefined

[lazywei]

I got this error when trying to setup the lockdown. The lockdown version is 0.0.6. (lockdown@latest)

$ ./node_modules/.bin/lockdown-relock
/Users/lazywei/Projects/cm/cm-mobile/node_modules/lockdown/relock.js:100
e(path.join(cache, regHost, name, ".cache.json"))).versions[version].dist.shas
                                                                    ^
TypeError: Cannot read property 'dist' of undefined
    at getShasum (/Users/lazywei/Projects/cm/cm-mobile/node_modules/lockdown/relock.js:100:102)
    at walk (/Users/lazywei/Projects/cm/cm-mobile/node_modules/lockdown/relock.js:71:14)
    at /Users/lazywei/Projects/cm/cm-mobile/node_modules/lockdown/relock.js:80:7
    at Array.forEach (native)
    at walk (/Users/lazywei/Projects/cm/cm-mobile/node_modules/lockdown/relock.js:77:36)
    at /Users/lazywei/Projects/cm/cm-mobile/node_modules/lockdown/relock.js:42:11
    at Array.forEach (native)
    at /Users/lazywei/Projects/cm/cm-mobile/node_modules/lockdown/relock.js:41:40
    at /Users/lazywei/Projects/cm/cm-mobile/node_modules/lockdown/node_modules/read-installed/read-installed.js:137:5
    at /Users/lazywei/Projects/cm/cm-mobile/node_modules/lockdown/node_modules/read-installed/read-installed.js:250:14

[arfoll]

I'm getting the same thing with the dependency virtualbox, I think it comes because it uses a git url instead of a https dist.tarball? Does lockdown work with git urls?