+1 (non-binding) I verified the SHA-512 checksum and signature, matched the source archive to v0.7.0-rc0, checked LICENSE/NOTICE and license headers, and built the downloaded source.
The default test suite passes with Go 1.25.9 on Linux: 3,344 tests passed. On Go 1.27.1, I observed one Puffin checksum error-message assertion failure; the call still rejected the corrupted input. I consider this non-blocking. Thanks for preparing the release! Xuanwo
