Using a URL isn't what makes Go's dependency management that good. It's just convenience that the import is a URL. The key thing with Go is that all dependenci

Using a URL isn't what makes Go's dependency management that good. It's just convenience that the import is a URL. The key thing with Go is that all dependencies have a checksum (go.sum file) and that should be committed to the repo. So even if the domain gets hijacked and a malicious package is served up, then the checksum will fail and it will refuse to build. People should be using internal module proxies anyway for Go. You can just store the module files in a directory, a git repo or a web service and serve up an internal cache.