It would seem this is correct. From the docs:
https://github.com/golang/dep/blob/master/docs/FAQ.md#why-is...There are two things that really slow dep down. One is unavoidable; for the other, we have a plan.
The unavoidable part is the initial clone. ... Fortunately, this is just an initial clone - pay it once, and you're done.
The other part is the work of retrieving information about dependencies. There are three parts to this:
* Getting an up-to-date list of versions from the upstream source
* Reading the Gopkg.toml for a particular version out of the local cache
* Parsing the tree of packages for import statements at a particular version
The first requires one or more network calls; the second two usually mean something like a git checkout, and the third is a filesystem walk, plus loading and parsing .go files. All of these are expensive operations.
----------------
For context, in comparison, Cargo has the same #1 problem. But for #2, the information on all dependencies is stored in the index itself; this means that Cargo can figure out what dependencies you need without any network calls at all, let alone downloading, git checkout, and filesystem walk.
I do not know how go mod compares, off the top of my head.