Go - Requiring Local Versions of Dependent Packages

Problem: You want to use local versions of the dependent packages.

Solution: Set up Go to use a vendor directory by running go mod vendor.

Local versions are the specific version of the dependent packages that you can use and are a safeguard in case the originals disappear (it happens). Having local versions of the dependent packages can be useful (and not only because you have trust issues). Run this from the command line to download and keep local versions of the dependent packages:

$ go mod vendor

This will create a vendor subdirectory in your project directory and populate it with the dependencies from your go.mod file. It also creates a vendor/modules.txt file that contains a listing of the packages you have just vendored and the versions they were copied from.

By default, Go will use the version in the vendor directory if your Go version is 1.1.4 and above and your vendor/modules.txt file is in sync with your go.mod file.

If you want to enable vendoring explicitly, you can include the -mod vendor flag in the go command.
For example, to build the project, you will do this:
# go build -mod vendor

If you want to disable vendoring explicitly, include the -mod readonly or -mod mod in the go command.
What happens if you add a new dependent package after you have vendored the module? If go.mod has changed since modules.txt was generated, the go command will show an error, and you should update the vendor directory again by running go mod vendor .