Outside of showing the vendored packages are the exact same (except for non-golang files removed), is there any reason to include what's in the vendor/ directory at all? It seems the go.mod and go.sum files cover downloading those already.

In this case, that was the point... Otherwise the main reason is so that you can build using the only the tarball for one module, without having to download the internet using git. But it's not really needed in the git repository, more when making dist files or so ?

See go build -mod=vendor

https://golang.org/ref/mod#build-commands

I think podman uses vendor ?

You will also find that it is a bit picky about what is in the vendor directory. For instance, now I would get this error instead:

go: inconsistent vendoring

When using go1.15, even though it was happy with go1.11. So the next step would be to maybe lift the go version a bit...