Don't just vendor - rebuild the ecosystem and persuade the vendor to work on software management ...

You need to pass -trimpath to `go build` to get builds that are reproducible under cross-compilation. Without that flag go puts host platform-specific paths into the binaries making the cross-compilation to generate different binary compared with the native compilation.