> You should be getting your reproducible builds by vendoring your dependencies. As I said, I've been working with code I didn't write: I've effectively been t

> You should be getting your reproducible builds by vendoring your dependencies. As I said, I've been working with code I didn't write: I've effectively been taking other people's *hub code and vendoring it for them, because they haven't. This is not optimal. And this isn't trivial projects, either, e.g. https://github.com/influxdb/influxdb/ https://github.com/influxdb/influxdb/ (also connected to the author!) still uses trivial go get, and doesn't make any effort to help with vendoring.