There's also an extensive discussion of a possible vendor lock file format and issues related to vendoring go code here on GitHub.