Go uses the hash of the source code, not the commit ID. So there's no difference...

		cyberax 5 months ago \| parent \| context \| favorite \| on: Shai-Hulud malware attack: Tinycolor and over 40 N... Go uses the hash of the source code, not the commit ID. So there's no difference between vendoring and using the central repo.