In fact, it looks like Uses/go.mk now has built-in functionality for make gomod-vendor, in the sense that we don't need to update the distinfo or *_TUPLE at all. It builds perfectly fine in a poudriere testport that restricts networking access after the FETCH stage.