Package management with Go is a very talked about issue. Unfortunately, go get does not support functionality to fetch specific tags or versions. It gets the package from the HEAD in git.
Recently we had a situation where a developer on our team used a package and then it got obsoleted. The package developer tagged the release before making breaking changes and the sources were still available but we had to do a git checkout and run it.
That is when I looked into package management. Go 1.5 introduced the “vendor” directory as an experiment and made it official in Go 1.6
If you use third party packages in your product, copy it to the vendor directory and go searches for dependencies there.
Ex.
package main import ( "fmt" "io" "https://github.com/mariadesouza/sftphelper" )
main.go vendor |--github.com | |--mariadesouza | | |-- sftphelper | | | |-- LICENSE | | | |-- README.md | | | |--sftphelper.go