Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

go version go1.11 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/davidben/Library/Caches/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/davidben/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/local/go"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/davidben/boringssl/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/qc/s_xgz3dj7_70mlmvt00ttg6m003f5q/T/go-build943187859=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

It's possible I'm just using this wrong and should be doing something else instead, so I'll describe the context: We use Go in BoringSSL for testing and various tools in our build. But we're a C/C++ library, so living in GOPATH doesn't make much sense. But living outside of GOPATH gets awkward when we want to use multiple packages.

Go modules seemed a good way to reuse Go code more idiomatically within our own tools and also reuse occasional external code. (We've currently vendored a bit of golang.org/x/crypto.)

I played with this a bit, and the former seems to work great. I then tried pulling in golang.org/x/crypto more normally. That too works great standalone, but our CI currently avoids depending on random external servers. (Though that particular module is hosted on googlesource.com too, so maybe that's actually fine?) Still, https://golang.org/cmd/go/#hdr-Modules_and_vendoring suggested go mod vendor plus passing -mod=vendor was the solution for this scenario, so I looked at that.

However, the go/build package (which I used to generate a depfile for integration into our buildsystem) shells out to go list but doesn't provide a way to pass -mod=vendor in, which means querying file lists internally fetches the module.
https://golang.org/src/go/build/build.go#L1008

What did you expect to see?

Some ImportMode, Context setting, or environment variable corresponding to -mod=vendor.

What did you see instead?

Passing defaults in causes go list to hit the network if the dependency is uncached, with no way to change the setting.