The Golang package dependency story has been bumpy, but one thing they got absolutely right is not having a package registry.

Anyone can host their golang package at example.com/myPkg and Go wouldn't care less what/who runs example.com