This resolves a docker/docker-ce tag into a moby commit hash.

get-moby-commit.sh

#!/bin/bash

set -e

tag=${1:?arg should be a docker-ce tag, such as 'v17.07.0-ce'}

tmp=$(mktemp -d)
cd $tmp

wget https://raw.githubusercontent.com/shykes/moby-extras/master/cmd/moby-components
chmod +x moby-components

git clone https://github.com/docker/docker-ce
cd docker-ce
git checkout $tag
# upstreamCommit is their termonology. That's not the real upstream commit
upstreamCommit=$(../moby-components list  | grep engine | awk -F: '{print $4}')

# echo to trim some spaces
echo $(git show "${upstreamCommit}" | grep 'Upstream-commit' | awk -F: '{print $2}')