> I strongly recommend against using external dependencies (e.g. bitbucket.org/howeyc/fsnotify) for something important. It's fine for development, but if "howeyc" decides he's sick of bitbucket and deletes his account, you're now screwed.
How? When you `go get` a package, it physically becomes part of your repository. If "howeyc" deletes his account, it doesn't affect the copy checked out under my repository. Unless you go out of your way to exclude the `go get` packages from getting checked in, you are safe.
When you 'go get github.com/spf13/hugo', it checks out a copy into $GOPATH/src/github.com/spf13/hugo. It then fetches all the external dependencies listed in hugo's source and fetches them, so you'll get $GOPATH/src/bitbucket.org/howeyc/fsnotify etc. Those exist in your own local tree, but if howeyc deletes his repository and somebody new tries to check out hugo, he'll get an error when "go get" fails to find bitbucket.org/howeyc/fsnotify.
Now, what you as the developer can do, as I mentioned in my original post, is get all the packages you need and put them in a $GOPATH directory, so you have $GOPATH/src/hugo and $GOPATH/src/fsnotify etc., then check in the entire $GOPATH directory. Your code then imports "fsnotify" rather than "bitbucket.org/howeyc/fsnotify" and so on. This repository is no longer trivially fetchable+compileable with "go get", but in my opinion that's a small price to pay--and compilation is still very simple.
How? When you `go get` a package, it physically becomes part of your repository. If "howeyc" deletes his account, it doesn't affect the copy checked out under my repository. Unless you go out of your way to exclude the `go get` packages from getting checked in, you are safe.