If you want an artifact repository for Go, several exist with varying levels of immutability/reliability/etc. However, Go also has an answer to the situation o

If you want an artifact repository for Go, several exist with varying levels of immutability/reliability/etc. However, Go also has an answer to the situation of "I want dependencies directly from the community without a caching/authorizing intermediary, but don't want to be a victim of someone rewriting their history on GitHub/account-squatting/whatever", and that answer is vendoring plus checking diffs on package upgrade. That's often less convenient than using a trustable caching registry, but it's comparing apples and oranges: a cache like that requires a centralized solution at present, though usable distributed ones might come about at some point; vendoring just requires some of your disk space and a git clone.