Hi,
GOPATH can make things a little tricky if you are trying to avoid any use of go get at build time. I've found it can be quite dependent on the original source repository (does it contain a full GOPAPTH?, or is it properly go-gettable). It can be a lot harder if you don't have any control.
GoDinstall (
https://github.com/tcolgate/godinstall/), includes debianing packaging, that was working last time I tried. For pragmatic reasons it go gets godep during the build, everything else comes from the vendored sources.