I'm working on a Go project that isn't a package but a service. It depends on `mgo`, among other things. Because this service is legally supposed to be securely versioned and highly available we've made the decision to vendorize the `mgo` dependency within the project. Due to the legal requirement we can't just rely on pulling whatever version is on `origin/master` for the dependency.

Obviously this breaks our `GOPATH` for all standard commands as it's no longer living under `GOPATH` but in a `vendor` directory within the Git repository:

```
~/src/link_tracker/
  main.go
  main_test.go
  vendor/
    src/
      labix.org/
        etc...

```

We're currently working around this using a fairly ugly Bash script that mangle lots of environment variables and does some symlinking, but it'd be nice if we could consolidate all this under a Makefile or similar.

What's the best/right way to organise this without losing our specifically versioned dependency of `mgo`?