Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

go1.10 darwin/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

darwin/amd64

What did you do?

echo >go.modverify && vgo build

What did you expect to see?

Successful build, with package hashes in go.modverify.

What did you see instead?

vgo: malformed go.modverify:
/Users/[user]/go/src/github.com/[user]/[package]/go.modverify:1: wrong number of fields

Other Notes

On line 137 of vgo/vendor/cmd/go/internal/vgo/fetch.go, for len(data) > 0 { doesn't account for the fact that echo >go.modverify creates a single byte file while touch go.modverify creates a 0 byte file, yet the documentation at Reproducible, Verifiable, Verified Builds shows the echo >go.modverify usage.

While the short term solution would be to change the documentation to touch go.modverify, as evidenced by the usage in the documentation, the echo >[file] usage is common for creating a blank file, and if this is done, the byte length check will err out.