2.0.5 is published now but @Hendrik Peter found a bug that I will publish as 2.0.6 once the fix is confirmed and merged.

I need to file an issue with the go team about an issue with the replace directive on the sumdb service. Then we can enable verifiable builds for releases... :-/