Go first came into the world with a brand new idea for dependency management and workspace folder structure. There was a strict hierarchy where projects would be located (in $gopath/src/site.com/user/project) and other projects would simply import the latest version of all other projects. The problem with this is that if some upstream project changes the API, then your project will break inexplicably. This is where vendor comes in.
Vendor is a subdirectory in your project that contains everything under $gopath/src that your project imports. The difference is that vendor isn't updated when upstream projects introduce new features and/or fixes. Therefore, you must update it yourself. When go looks for an import (as of the latest version), it will check vendor first and then look for the latest version in your $gopath, preventing builds from inexplicably breaking for no apparent reason.
go install updates your $gopath dependencies to the latest version; the version that all new projects and those without vendor will use.
govendor install +vendor,^program updates your specific project vendor dependencies. This should be done in a separate commit; you should go test; govendor; git commit; go test so that you can check whether updates break your project.
govendor install +local apparently just builds the project.
Also, you should IMHO use godep rather than govendor. It IHMO has better workflow; your $gopath has the latest versions and then you can update your project with godep update. It is also supposed to be standard in golang 1.10.
