Freeze your git vendors with submodules and a little bash.

Git submodules make for a great what to freeze vendors:

    go list -f '{{range $imp := .Imports}}{{printf "%s\n" $imp}}{{end}}' ./... \
    | awk -F'[/]' '/[.]/ {printf "%s/%s/%s\n",$1,$2,$3}' \
    | sort -u \
    | xargs -I REPO -n1 -P1 echo git submodule add -f https://REPO vendor/REPO

git-freeze implements the above.

Note: If you're actually afraid of repo(s) disappearing, fork the repo(s) and import and vendor your fork. Using submodule is still valid and provides a consistent mechanism for vendoring as well as retaining a version trail and update/merge history for both vendor submodules and the parent's integration with updates without cluttering your repo with copies of other packages.

https://www.reddit.com/r/golang/comments/492w0u/do_you_like_go_get_want_to_vendor_your_code/d0opzll

Sorry, that's wrong. You summed it up in the second paragraph. If you're actually afraid of the repo disappearing, saving all the code into a vendor folder isn't the right approach. It's better to fork the repo and vendor your fork, for which submodule is still valid. The point is, submodules provide a consistent mechanism for vendoring.

Awesome, this looks pretty cool.  If go authors ever start using semver for their packages, it might be handy to also have a little bit of code that identifies commits that satisfy certain version ranges (i.e. >=1.4)

Yea, unfortunately, there's only so far tools can go before significantly benefiting from having language support. Enhancements to the import declaration specification would be a huge win for dependency management. And it can be enhanced without any breaking changes. I wish I had more time to contribute and I'd just enhance it myself.