Finally hopeful for better dependency management! I was digging through the source code and see it works with mercurial, git and bazaar using a hash or tag (so you can lock a package down to either):
https://github.com/sdboyer/gps/blob/master/vcs_source.go#L22...I'm guessing gps will be merged into the stdlib at some point.