[timv]

I can't see why I can't have both...

If my central package repo had genuinely reproducible builds, such that I could download the source, run the build process and know that I had the same output that the repo held, then I think that I would love to have a setup where:

- I could "add a dependency" by having an automated process that downloads the source, commits it as its own module (or equivalent) in my source repo, tags it with the versioned identifier of the package, and then builds it to make sure it matches what the package repo holds.

- I could make local modifications to the package if I needed to, and my source control would track my deviation from the tagged base version

- I could upgrade my package by re-running the first step, potentially merging it with my local changes.

Hmm, I think I just described the ultimate end state for Go package management...