Add go.mod and go.sum to lock dependencies

.tool/lint

@@ -6,11 +6,11 @@ set -o pipefail
 
 if [ ! $(command -v gometalinter) ]; then
 	go get -u github.com/alecthomas/gometalinter
-	gometalinter --install
+	GO111MODULE=off gometalinter --install
 fi
 
 for d in $(find . -type d -not -iwholename '*.git*' -a -not -iname '.tool' -a -not -iwholename '*vendor*'); do
-	gometalinter \
+	GO111MODULE=off gometalinter \
 		--exclude='error return value not checked.*(Close|Log|Print).*\(errcheck\)$' \
 		--exclude='.*_test\.go:.*error return value not checked.*\(errcheck\)$' \
 		--exclude='duplicate of.*_test.go.*\(dupl\)$' \

specs-go/go.mod

@@ -0,0 +1,15 @@
+module github.com/opencontainers/image-spec/specs-go
+
+go 1.15
+
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/opencontainers/go-digest v1.0.0
+	github.com/pkg/errors v0.9.1
+	github.com/russross/blackfriday v1.6.0
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415
+	github.com/xeipuuv/gojsonschema v1.2.0
+	go4.org v0.0.0-20201209231011-d4a079459e60
+)
+
+replace github.com/golang/lint => golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5