# Clean-environment reproduction

Use a fresh machine or container that did not build the package. Any OS with Python 3.9 or newer works.

```sh
# 1. obtain (network on)
mkdir cain42-audit && cd cain42-audit
curl -fsSLO https://cainstudio.online/evidence/auditor-kit/8.0.1/cain42-auditor-kit-8.0.1.zip
curl -fsSLO https://cainstudio.online/evidence/auditor-kit/8.0.1/cain42-auditor-kit-8.0.1.zip.sha256
curl -fsSLO https://cainstudio.online/evidence/auditor-kit/8.0.1/cain42_verify.py
sha256sum -c cain42-auditor-kit-8.0.1.zip.sha256           # 2. hash
# 3. trust anchor: follow KEYS_AND_TRUST.md; record the channels you used
# 4. inspect without executing anything
python3 -c "import zipfile;[print(i.file_size,i.filename) for i in zipfile.ZipFile('cain42-auditor-kit-8.0.1.zip').infolist()]"
# 5. disconnect from the network, then run the initial verdict
python3 -I cain42_verify.py cain42-auditor-kit-8.0.1.zip --trust-anchor <ANCHOR> \
   --expect-sha256 $(cut -d' ' -f1 cain42-auditor-kit-8.0.1.zip.sha256) --expect-version 8.0.1 --out my_result.json
# 6. extract into a scratch directory and run the fixture suite (regenerates the fixtures and compares the hashes)
mkdir x && python3 -c "import zipfile;zipfile.ZipFile('cain42-auditor-kit-8.0.1.zip').extractall('x')"
cd x/cain42-auditor-kit-8.0.1 && python3 -I TESTS/run_fixture_suite.py --out ../../fixture_results.json && cd ../..
# 7. benchmark (30 runs)
python3 -I x/cain42-auditor-kit-8.0.1/BENCHMARKS/run_benchmark.py cain42-auditor-kit-8.0.1.zip --trust-anchor <ANCHOR> \
   --expect-sha256 <SHA> --runs 30 --out my_benchmark.json
```

Then compare your results with the files published next to the ZIP: `expected_verdict.json` and `benchmark-8.0.1.json`. Record every difference on `HUMAN_REVIEW/REPRODUCIBILITY_WORKSHEET.md`. Expected verdicts can change for legitimate reasons, for example `STALE_EVIDENCE` after the freshness window ends. Record why.