I would be much easier if if gpm install would print the hash of library that gets installed.
So one could start off with no hash/tag, do the install and then set the deps to that.
Or even better:
gpm install github.com/golang/glog --save
which would add the dep (include the hash) to the Godep file.