Source code in GOPATH disables modules mode when GO111MODULES=auto,
which is the default. Keeping it out should make things reliable here.
Note that this is not yet tested.
I didn't realise that 'go get -u' caused all dependencies to be
updated to their latest versions! This is clearly a very bad thing
to do for reproducibility. Both the initial setup and the update
script were affected.