What I would be concerned with is this, before anything else:

   import "github.com/bradfitz/jndi"

where is the version specified of what we are fetching? And at least a SHA256 to validate that it continues to be the same as what we fetched the first time, once upon a time?

Without this, a good, secure logging library can suddenly turn bad in between your rebuilds, and you don't know.

You probably want this piece to be cached locally, so your project builds even when the network or github is down.

Do people really code like this?