Preferable way is to download tarball with the signature from official
website and, for example, run tests with benchmarks:

    % wget http://www.cypherpunks.ru/gogost/gogost-1.1.tar.xz
    % wget http://www.cypherpunks.ru/gogost/gogost-1.1.tar.xz.sig
    % gpg --verify gogost-1.1.tar.xz.sig gogost-1.1.tar.xz
    % xz -d < gogost-1.1.tar.xz | tar xf -
    % make -C gogost-1.1 bench

And then you can include its source code in your project for example
like this:

    % mkdir -p myproj/src
    % export GOPATH=$PWD/myproj
    % cd myproj/src
    % cat > main.go <<EOF
    package main

    import (
        "encoding/hex"
        "fmt"

        "cypherpunks.ru/gogost/gost34112012256"
    )

    func main() {
        h := gost34112012256.New()
        h.Write([]byte("hello world"))
        fmt.Println(hex.EncodeToString(h.Sum(nil)))
    }
    EOF
    % cp -r ../../gogost-1.1/src/cypherpunks.ru .
    % go run main.go
    c600fd9dd049cf8abd2f5b32e840d2cb0e41ea44de1c155dcd88dc84fe58a855

You have to verify downloaded tarballs integrity and authenticity to be
sure that you retrieved trusted and untampered software. GNU Privacy
Guard is used for that purpose.

For the very first time it it necessary to get signing public key and
import it. It is provided below, but you should check alternative
resources.

    pub   rsa2048/0x82343436696FC85A 2016-09-13 [SC]
          CEBD 1282 2C46 9C02 A81A  0467 8234 3436 696F C85A
    uid   GoGOST releases <gogost at cypherpunks dot ru>

    Look in PUBKEY.asc file.
    % gpg --keyserver hkp://keys.gnupg.net/ --recv-keys 0x82343436696FC85A
    % gpg --auto-key-locate dane --locate-keys gogost at cypherpunks dot ru
    % gpg --auto-key-locate wkd --locate-keys gogost at cypherpunks dot ru
    % gpg --auto-key-locate pka --locate-keys gogost at cypherpunks dot ru