rmqa 0.2.0 reads .tar.xz and .tar.zst archives with its own decoders, so cargo-dist and other Rust and C releases can be checked inside, not just counted. It checks the .sha256 beside each file, verifies minisign signatures and cosign signatures made with a key, and rmqa init --from writes the manifest from GoReleaser’s or cargo-dist’s own record of what it built. The real cargo-dist v0.34.0 release passes all 23 files, and the minisign release’s signatures verify with its author’s key.
The independent review found one blocker in its first round and nothing in its second, all fixed with tests before release. It follows the 0.1 launch.