github.com/golang/dep@v0.5.4/cmd/dep/testdata/harness_tests/ensure/noverify/hash_mismatch/README (about)

     1  This is a hack - it's effectively just verifying that the Gopkg.lock doesn't
     2  change for projects with noverify set, which (under the current logic) is an
     3  indicator that vendor wasn't updated.
     4  
     5  Of course, that vendor -> lock relationship isn't guaranteed to hold...