I’m fairly sure

go get

will do the wrong thing with respect to dependencies absent of

vendor/

being checked in